diff --git a/data/insecure_full.json b/data/insecure_full.json
index cab6cf3d..8f443e44 100644
--- a/data/insecure_full.json
+++ b/data/insecure_full.json
@@ -1,8 +1,55 @@
 {
     "$meta": {
         "advisory": "PyUp.io metadata",
-        "timestamp": 1641016806
+        "timestamp": 1643695207
     },
+    "aadhaar-py": [
+        {
+            "advisory": "Aadhaar-py 2.0.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2022-44524",
+            "id": "pyup.io-44604",
+            "specs": [
+                "<2.0.1"
+            ],
+            "v": "<2.0.1"
+        },
+        {
+            "advisory": "Aadhaar-py 2.0.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22817",
+            "id": "pyup.io-44605",
+            "specs": [
+                "<2.0.1"
+            ],
+            "v": "<2.0.1"
+        },
+        {
+            "advisory": "Aadhaar-py 2.0.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22816",
+            "id": "pyup.io-44606",
+            "specs": [
+                "<2.0.1"
+            ],
+            "v": "<2.0.1"
+        },
+        {
+            "advisory": "Aadhaar-py 2.0.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22815",
+            "id": "pyup.io-44607",
+            "specs": [
+                "<2.0.1"
+            ],
+            "v": "<2.0.1"
+        },
+        {
+            "advisory": "Aadhaar-py 2.0.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2021-44525",
+            "id": "pyup.io-44561",
+            "specs": [
+                "<2.0.1"
+            ],
+            "v": "<2.0.1"
+        }
+    ],
     "abiflows": [
         {
             "advisory": "Abiflows version 0.6 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/abinit/abiflows/commit/479b957c3b1abe41d85aaff2d14439605ddc5d0b#diff-5a814c49249ffdc2d551933c1bec95c4b2fe64d0619470085c5fef247fea2309",
@@ -61,18 +108,18 @@
     ],
     "adversarial-robustness-toolbox": [
         {
-            "advisory": "Adversarial-robustness-toolbox version 1.6.1 updates its dependency \"Pillow\" to a secure version. See CVE-2021-28678.",
-            "cve": "CVE-2021-28678",
-            "id": "pyup.io-41782",
+            "advisory": "Adversarial-robustness-toolbox version 1.6.1 updates its dependency \"Pillow\" to a secure version. See CVE-2021-28675.",
+            "cve": "CVE-2021-28675",
+            "id": "pyup.io-41781",
             "specs": [
                 "<1.6.1"
             ],
             "v": "<1.6.1"
         },
         {
-            "advisory": "Adversarial-robustness-toolbox version 1.6.1 updates its dependency \"Pillow\" to a secure version. See CVE-2021-28675.",
-            "cve": "CVE-2021-28675",
-            "id": "pyup.io-41781",
+            "advisory": "Adversarial-robustness-toolbox version 1.6.1 updates its dependency \"Pillow\" to a secure version. See CVE-2021-28678.",
+            "cve": "CVE-2021-28678",
+            "id": "pyup.io-41782",
             "specs": [
                 "<1.6.1"
             ],
@@ -99,7 +146,7 @@
     ],
     "aegea": [
         {
-            "advisory": "Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.",
+            "advisory": "Aegea 2.2.7 updates the minimum requirement for its dependency 'paramiko' to v2.4.2 to include a security fix.",
             "cve": "CVE-2018-1000805",
             "id": "pyup.io-37611",
             "specs": [
@@ -139,18 +186,18 @@
             "v": "<101.0.1"
         },
         {
-            "advisory": "Agraph-python 101.0.3 updates urllib3 to 1.24.2 for security reasons.",
-            "cve": "CVE-2019-11324",
-            "id": "pyup.io-37085",
+            "advisory": "Agraph-python 101.0.3 updates numpy to 1.16.0 for security reasons.",
+            "cve": "PVE-2021-43014",
+            "id": "pyup.io-43014",
             "specs": [
                 "<101.0.3"
             ],
             "v": "<101.0.3"
         },
         {
-            "advisory": "Agraph-python 101.0.3 updates numpy to 1.16.0 for security reasons.",
-            "cve": "PVE-2021-43014",
-            "id": "pyup.io-43014",
+            "advisory": "Agraph-python 101.0.3 updates urllib3 to 1.24.2 for security reasons.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-37085",
             "specs": [
                 "<101.0.3"
             ],
@@ -160,8 +207,8 @@
     "ai-python": [
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41199",
-            "id": "pyup.io-43002",
+            "cve": "CVE-2021-41203",
+            "id": "pyup.io-43051",
             "specs": [
                 "<0.8.1"
             ],
@@ -169,8 +216,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41196",
-            "id": "pyup.io-43050",
+            "cve": "CVE-2021-41217",
+            "id": "pyup.io-43054",
             "specs": [
                 "<0.8.1"
             ],
@@ -178,8 +225,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41203",
-            "id": "pyup.io-43051",
+            "cve": "CVE-2021-41214",
+            "id": "pyup.io-43055",
             "specs": [
                 "<0.8.1"
             ],
@@ -187,8 +234,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41200",
-            "id": "pyup.io-43052",
+            "cve": "CVE-2021-41219",
+            "id": "pyup.io-43056",
             "specs": [
                 "<0.8.1"
             ],
@@ -196,8 +243,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41217",
-            "id": "pyup.io-43054",
+            "cve": "CVE-2021-41218",
+            "id": "pyup.io-43067",
             "specs": [
                 "<0.8.1"
             ],
@@ -205,8 +252,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41214",
-            "id": "pyup.io-43055",
+            "cve": "CVE-2021-41216",
+            "id": "pyup.io-43068",
             "specs": [
                 "<0.8.1"
             ],
@@ -214,8 +261,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41219",
-            "id": "pyup.io-43056",
+            "cve": "CVE-2021-41215",
+            "id": "pyup.io-43069",
             "specs": [
                 "<0.8.1"
             ],
@@ -223,8 +270,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41226",
-            "id": "pyup.io-43057",
+            "cve": "CVE-2021-41212",
+            "id": "pyup.io-43074",
             "specs": [
                 "<0.8.1"
             ],
@@ -232,8 +279,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41227",
-            "id": "pyup.io-43058",
+            "cve": "CVE-2021-41201",
+            "id": "pyup.io-43077",
             "specs": [
                 "<0.8.1"
             ],
@@ -241,8 +288,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41225",
-            "id": "pyup.io-43059",
+            "cve": "CVE-2021-41197",
+            "id": "pyup.io-43078",
             "specs": [
                 "<0.8.1"
             ],
@@ -250,8 +297,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41209",
-            "id": "pyup.io-43061",
+            "cve": "CVE-2021-41195",
+            "id": "pyup.io-43079",
             "specs": [
                 "<0.8.1"
             ],
@@ -259,17 +306,17 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41213",
-            "id": "pyup.io-43062",
+            "cve": "CVE-2021-41206",
+            "id": "pyup.io-43072",
             "specs": [
                 "<0.8.1"
             ],
             "v": "<0.8.1"
         },
         {
-            "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41204",
-            "id": "pyup.io-43063",
+            "advisory": "Ai-python 0.8.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-43084",
             "specs": [
                 "<0.8.1"
             ],
@@ -277,17 +324,17 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41228",
-            "id": "pyup.io-43064",
+            "cve": "CVE-2021-41210",
+            "id": "pyup.io-43081",
             "specs": [
                 "<0.8.1"
             ],
             "v": "<0.8.1"
         },
         {
-            "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41222",
-            "id": "pyup.io-43065",
+            "advisory": "Ai-python 0.8.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-43083",
             "specs": [
                 "<0.8.1"
             ],
@@ -295,8 +342,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41224",
-            "id": "pyup.io-43066",
+            "cve": "CVE-2021-41200",
+            "id": "pyup.io-43052",
             "specs": [
                 "<0.8.1"
             ],
@@ -304,8 +351,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41218",
-            "id": "pyup.io-43067",
+            "cve": "CVE-2021-41211",
+            "id": "pyup.io-43053",
             "specs": [
                 "<0.8.1"
             ],
@@ -313,8 +360,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41216",
-            "id": "pyup.io-43068",
+            "cve": "CVE-2021-41226",
+            "id": "pyup.io-43057",
             "specs": [
                 "<0.8.1"
             ],
@@ -322,8 +369,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41215",
-            "id": "pyup.io-43069",
+            "cve": "CVE-2021-41227",
+            "id": "pyup.io-43058",
             "specs": [
                 "<0.8.1"
             ],
@@ -331,8 +378,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41220",
-            "id": "pyup.io-43070",
+            "cve": "CVE-2021-41225",
+            "id": "pyup.io-43059",
             "specs": [
                 "<0.8.1"
             ],
@@ -340,8 +387,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41206",
-            "id": "pyup.io-43072",
+            "cve": "CVE-2021-41221",
+            "id": "pyup.io-43060",
             "specs": [
                 "<0.8.1"
             ],
@@ -349,8 +396,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41205",
-            "id": "pyup.io-43073",
+            "cve": "CVE-2021-41209",
+            "id": "pyup.io-43061",
             "specs": [
                 "<0.8.1"
             ],
@@ -358,8 +405,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41212",
-            "id": "pyup.io-43074",
+            "cve": "CVE-2021-41213",
+            "id": "pyup.io-43062",
             "specs": [
                 "<0.8.1"
             ],
@@ -367,8 +414,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41202",
-            "id": "pyup.io-43076",
+            "cve": "CVE-2021-41204",
+            "id": "pyup.io-43063",
             "specs": [
                 "<0.8.1"
             ],
@@ -376,8 +423,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41201",
-            "id": "pyup.io-43077",
+            "cve": "CVE-2021-41228",
+            "id": "pyup.io-43064",
             "specs": [
                 "<0.8.1"
             ],
@@ -385,8 +432,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41197",
-            "id": "pyup.io-43078",
+            "cve": "CVE-2021-41222",
+            "id": "pyup.io-43065",
             "specs": [
                 "<0.8.1"
             ],
@@ -394,8 +441,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41195",
-            "id": "pyup.io-43079",
+            "cve": "CVE-2021-41224",
+            "id": "pyup.io-43066",
             "specs": [
                 "<0.8.1"
             ],
@@ -403,8 +450,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41208",
-            "id": "pyup.io-43071",
+            "cve": "CVE-2021-41220",
+            "id": "pyup.io-43070",
             "specs": [
                 "<0.8.1"
             ],
@@ -412,8 +459,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41211",
-            "id": "pyup.io-43053",
+            "cve": "CVE-2021-41208",
+            "id": "pyup.io-43071",
             "specs": [
                 "<0.8.1"
             ],
@@ -421,8 +468,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41221",
-            "id": "pyup.io-43060",
+            "cve": "CVE-2021-41205",
+            "id": "pyup.io-43073",
             "specs": [
                 "<0.8.1"
             ],
@@ -439,8 +486,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41198",
-            "id": "pyup.io-43080",
+            "cve": "CVE-2021-41202",
+            "id": "pyup.io-43076",
             "specs": [
                 "<0.8.1"
             ],
@@ -448,8 +495,8 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
-            "cve": "CVE-2021-41210",
-            "id": "pyup.io-43081",
+            "cve": "CVE-2021-41198",
+            "id": "pyup.io-43080",
             "specs": [
                 "<0.8.1"
             ],
@@ -457,26 +504,26 @@
         },
         {
             "advisory": "Ai-python 0.8.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-43083",
+            "cve": "CVE-2021-34552",
+            "id": "pyup.io-43082",
             "specs": [
                 "<0.8.1"
             ],
             "v": "<0.8.1"
         },
         {
-            "advisory": "Ai-python 0.8.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-43084",
+            "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
+            "cve": "CVE-2021-41196",
+            "id": "pyup.io-43050",
             "specs": [
                 "<0.8.1"
             ],
             "v": "<0.8.1"
         },
         {
-            "advisory": "Ai-python 0.8.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
-            "cve": "CVE-2021-34552",
-            "id": "pyup.io-43082",
+            "advisory": "Ai-python 0.8.1 updates its dependency 'tensorflow' to v2.6.1 to include security fixes.",
+            "cve": "CVE-2021-41199",
+            "id": "pyup.io-43002",
             "specs": [
                 "<0.8.1"
             ],
@@ -523,7 +570,7 @@
             "v": "<1.6.0"
         },
         {
-            "advisory": "Aiida-core 1.6.5 updates 'PyYAML' to v5.4 to fix critical security issues.",
+            "advisory": "Aiida-core 1.6.5 updates its dependency 'pyyaml' to v5.4 to include security fixes.",
             "cve": "CVE-2019-20477",
             "id": "pyup.io-41169",
             "specs": [
@@ -552,7 +599,7 @@
     ],
     "aioapns": [
         {
-            "advisory": "Certificate hostname validation in aioapns version 1.10 was enabled by default for security reasons. It can be turned off by using no_cert_validation option.",
+            "advisory": "Certificate hostname validation in aioapns version 1.10 is enabled by default for security reasons. It can be turned off by using no_cert_validation option.",
             "cve": "PVE-2021-38620",
             "id": "pyup.io-38620",
             "specs": [
@@ -636,13 +683,31 @@
     ],
     "aiohttp-jinja2": [
         {
-            "advisory": "Aiohttp-jinja2 1.1.1 bumps minimal supported ``jinja2`` version to 2.10.1 to avoid a security vulnerability problem.",
-            "cve": "PVE-2021-37095",
+            "advisory": "Aiohttp-jinja2 1.1.1 updates minimal supported 'Jinja2' version to 2.10.1 to include security fixes.",
+            "cve": "CVE-2014-1402",
             "id": "pyup.io-37095",
             "specs": [
                 "<1.1.1"
             ],
             "v": "<1.1.1"
+        },
+        {
+            "advisory": "Aiohttp-jinja2 1.1.1 updates minimal supported 'Jinja2' version to 2.10.1 to include security fixes.",
+            "cve": "CVE-2016-10745",
+            "id": "pyup.io-44431",
+            "specs": [
+                "<1.1.1"
+            ],
+            "v": "<1.1.1"
+        },
+        {
+            "advisory": "Aiohttp-jinja2 1.1.1 updates minimal supported 'Jinja2' version to 2.10.1 to include security fixes.",
+            "cve": "CVE-2019-10906",
+            "id": "pyup.io-44432",
+            "specs": [
+                "<1.1.1"
+            ],
+            "v": "<1.1.1"
         }
     ],
     "aiohttp-swagger": [
@@ -1014,6 +1079,15 @@
         }
     ],
     "analytics-zoo": [
+        {
+            "advisory": "Analytics-zoo 0.11.1 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/intel-analytics/analytics-zoo/commit/be893d0c173563df923b54578774bd4226d0bbd9",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43615",
+            "specs": [
+                "<0.11.1"
+            ],
+            "v": "<0.11.1"
+        },
         {
             "advisory": "Analytics-zoo 0.11.1 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/intel-analytics/analytics-zoo/commit/be893d0c173563df923b54578774bd4226d0bbd9",
             "cve": "CVE-2021-45105",
@@ -1033,24 +1107,24 @@
             "v": "<0.11.1"
         },
         {
-            "advisory": "Analytics-zoo 0.11.1 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/intel-analytics/analytics-zoo/commit/be893d0c173563df923b54578774bd4226d0bbd9",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43615",
+            "advisory": "Analytics-zoo 0.11.2 updates its dependency 'log4j' to v2.17.1 to fix a medium severity vulnerability.\r\nhttps://github.com/intel-analytics/analytics-zoo/commit/c75cfc1076adbefa4f5fe0185bff4e7cf3f99b82",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44464",
             "specs": [
-                "<0.11.1"
+                "<0.11.2"
             ],
-            "v": "<0.11.1"
+            "v": "<0.11.2"
         }
     ],
-    "anncolvar": [
+    "anchorpy": [
         {
-            "advisory": "anncolvar 0.4 updates requirements.txt to fix security issues.",
-            "cve": "PVE-2021-36803",
-            "id": "pyup.io-36803",
+            "advisory": "Anchorpy 0.6.4 updates its dependency 'ipython' to v8.0.1 to include a security fix.",
+            "cve": "CVE-2022-21699",
+            "id": "pyup.io-44648",
             "specs": [
-                "<0.4"
+                "<0.6.4"
             ],
-            "v": "<0.4"
+            "v": "<0.6.4"
         }
     ],
     "annotator": [
@@ -1536,139 +1610,85 @@
     ],
     "ansible-tower-cli": [
         {
-            "advisory": "Ansible-tower-cli is vulnerable to CVE-2020-10744: The provided fix for CVE-2020-1733 was insufficient to prevent the race condition on systems using ACLs and FUSE filesystems. Ansible Engine 2.7.18, 2.8.12, and 2.9.9 and previous versions are affected. Also Ansible Tower 3.4.5, 3.5.6 and 3.6.4 and previous versions.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10744",
-            "cve": "CVE-2020-10744",
-            "id": "pyup.io-42863",
-            "specs": [
-                "<3.4.5"
-            ],
-            "v": "<3.4.5"
-        },
-        {
-            "advisory": "Ansible-tower-cli 3.6.4 includes a fix for CVE-2020-1735: A flaw was found in the Ansible Engine when the fetch module is used. An attacker could intercept the module, inject a new path, and then choose a new destination path on the controller node. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1735",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2020-1735.",
             "cve": "CVE-2020-1735",
             "id": "pyup.io-42878",
             "specs": [
-                "<3.6.4"
+                "<3.2.0"
             ],
-            "v": "<3.6.4"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Ansible-tower-cli 3.6.4 includes a fix for CVE-2020-1733: A race condition flaw was found in Ansible Engine when running a playbook with an unprivileged become user. When Ansible needs to run a module with become user, the temporary directory is created in /var/tmp. This directory is created with \"umask 77 && mkdir -p <dir>\"; this operation does not fail if the directory already exists and is owned by another user. An attacker could take advantage to gain control of the become user as the target directory can be retrieved by iterating '/proc/<pid>/cmdline'.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1733",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2020-1733.",
             "cve": "CVE-2020-1733",
             "id": "pyup.io-42880",
             "specs": [
-                "<3.6.4"
-            ],
-            "v": "<3.6.4"
-        },
-        {
-            "advisory": "Ansible-tower-cli 3.6.4 includes a fix for CVE-2020-1736: A flaw was found in Ansible Engine when a file is moved using atomic_move primitive as the file mode cannot be specified. This sets the destination files world-readable if the destination file does not exist and if the file exists, the file could be changed to have less restrictive permissions before the move. This could lead to the disclosure of sensitive data. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1736",
-            "cve": "CVE-2020-1736",
-            "id": "pyup.io-42876",
-            "specs": [
-                "<3.6.4"
+                "<3.2.0"
             ],
-            "v": "<3.6.4"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Ansible-tower-cli 3.6.4 includes a fix for CVE-2020-1740: A flaw was found in Ansible Engine when using Ansible Vault for editing encrypted files. When a user executes \"ansible-vault edit\", another user on the same computer can read the old and new secret, as it is created in a temporary file with mkstemp and the returned file descriptor is closed and the method write_data is called to write the existing secret in the file. This method will delete the file before recreating it insecurely. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1740",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2020-1740.",
             "cve": "CVE-2020-1740",
             "id": "pyup.io-42870",
             "specs": [
-                "<3.6.4"
+                "<3.2.0"
             ],
-            "v": "<3.6.4"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Ansible-tower-cli 3.6.4 includes a fix for CVE-2020-1739: A flaw was found in Ansible 2.7.16 and prior, 2.8.8 and prior, and 2.9.5 and prior. When a password is set with the argument \"password\" of svn module, it is used on svn command line, disclosing to other users within the same node. An attacker could take advantage by reading the cmdline file from that particular PID on the procfs.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1739",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2020-1739.",
             "cve": "CVE-2020-1739",
             "id": "pyup.io-42872",
             "specs": [
-                "<3.6.4"
+                "<3.2.0"
             ],
-            "v": "<3.6.4"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Ansible-tower-cli 3.6.4 includes a fix for CVE-2020-1738: A flaw was found in Ansible Engine when the module package or service is used and the parameter 'use' is not specified. If a previous task is executed with a malicious user, the module sent can be selected by the attacker using the ansible facts file. All versions in 2.7.x, 2.8.x and 2.9.x branches are believed to be vulnerable.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-1738",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2020-1738.",
             "cve": "CVE-2020-1738",
             "id": "pyup.io-42874",
             "specs": [
-                "<3.6.4"
-            ],
-            "v": "<3.6.4"
-        },
-        {
-            "advisory": "Ansible-tower-cli 3.7 includes a fix for CVE-2021-3583: A flaw was found in Ansible, where a user's controller is vulnerable to template injection. This issue can occur through facts used in the template if the user is trying to put templates in multi-line YAML strings and the facts being handled do not routinely include special template characters. This flaw allows attackers to perform command injection, which discloses sensitive information. The highest threat from this vulnerability is to confidentiality and integrity.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1968412",
-            "cve": "CVE-2021-3583",
-            "id": "pyup.io-42925",
-            "specs": [
-                "<3.7"
-            ],
-            "v": "<3.7"
-        },
-        {
-            "advisory": "Ansible-tower-cli 3.8 includes a fix for CVE-2021-3532: A flaw was found in Ansible where the secret information present in async_files are getting disclosed when the user changes the jobdir to a world readable directory. Any secret information in an async status file will be readable by a malicious user on that system. This flaw also affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1956464",
-            "cve": "CVE-2021-3532",
-            "id": "pyup.io-42922",
-            "specs": [
-                "<3.8"
-            ],
-            "v": "<3.8"
-        },
-        {
-            "advisory": "Ansible-tower-cli 3.8 includes a fix for CVE-2021-3533: A flaw was found in Ansible if an ansible user sets ANSIBLE_ASYNC_DIR to a subdirectory of a world writable directory. When this occurs, there is a race condition on the managed machine. A malicious, non-privileged account on the remote machine can exploit the race condition to access the async result data. This flaw also affects Ansible Tower 3.7 and Ansible Automation Platform 1.2.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1956477",
-            "cve": "CVE-2021-3533",
-            "id": "pyup.io-42927",
-            "specs": [
-                "<3.8"
+                "<3.2.0"
             ],
-            "v": "<3.8"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Ansible-tower-cli 3.8.2 includes a fix for CVE-2021-3447: A flaw was found in several ansible modules, where parameters containing credentials, such as secrets, were being logged in plain-text on managed nodes, as well as being made visible on the controller node when run in verbose mode. These parameters were not protected by the no_log feature. An attacker could take advantage of this information to steal those credentials, provided it had access to the log files containing them. The highest threat from this vulnerability is to data confidentiality. This flaw affects Red Hat Ansible Automation Platform in versions before 1.2.2 and Ansible Tower in versions before 3.8.2.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1939349",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2021-3447.",
             "cve": "CVE-2021-3447",
             "id": "pyup.io-42861",
             "specs": [
-                "<3.8.2"
-            ],
-            "v": "<3.8.2"
-        },
-        {
-            "advisory": "Ansible-tower-cli 3.3.6 includes a fix for CVE-2020-10684: A flaw was found in Ansible Engine, all versions 2.7.x, 2.8.x and 2.9.x prior to 2.7.17, 2.8.9 and 2.9.6 respectively, when using ansible_facts as a subkey of itself and promoting it to a variable when inject is enabled, overwriting the ansible_facts after the clean. An attacker could take advantage of this by altering the ansible_facts, such as ansible_hosts, users and any other key data which would lead into privilege escalation or code injection.",
-            "cve": "CVE-2020-10684",
-            "id": "pyup.io-42865",
-            "specs": [
-                "<=3.3.5"
+                "<3.2.0"
             ],
-            "v": "<=3.3.5"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Ansible-tower-cli 3.1.0 includes a fix for CVE-2019-14864: Ansible, versions 2.9.x before 2.9.1, 2.8.x before 2.8.7 and Ansible versions 2.7.x before 2.7.15, are not respecting the flag no_log set it to True when Sumologic and Splunk callback plugins are used to send tasks results events to collectors. This would disclose and collect any sensitive data.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14864",
-            "cve": "CVE-2019-14864",
-            "id": "pyup.io-42883",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2021-3583.",
+            "cve": "CVE-2021-3583",
+            "id": "pyup.io-42925",
             "specs": [
-                ">=3.0.0,<3.1.0"
+                "<3.2.0"
             ],
-            "v": ">=3.0.0,<3.1.0"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Ansible-tower-cli 3.1.0 includes a fix for CVE-2021-20178: A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature when using the bitbucket_pipeline_variable module. This flaw allows an attacker to steal bitbucket_pipeline credentials. The highest threat from this vulnerability is to confidentiality.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1914774",
-            "cve": "CVE-2021-20178",
-            "id": "pyup.io-42859",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2020-1736.",
+            "cve": "CVE-2020-1736",
+            "id": "pyup.io-42876",
             "specs": [
-                ">=3.0.0,<3.1.0"
+                "<3.2.0"
             ],
-            "v": ">=3.0.0,<3.1.0"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Ansible-tower-cli 3.1.0 includes a fix for CVE-2021-20191: Credentials, such as secrets, are being disclosed in console log by default and not protected by no_log feature when using those modules. An attacker can take advantage of this information to steal those credentials. The highest threat from this vulnerability is to data confidentiality.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1916813",
-            "cve": "CVE-2021-20191",
-            "id": "pyup.io-42857",
+            "advisory": "Ansible-tower-cli versions 3.1.x and before use API v1, what implies the use of ansible-tower version 3.2.x or earlier. These are affected by CVE-2020-10684.",
+            "cve": "CVE-2020-10684",
+            "id": "pyup.io-42865",
             "specs": [
-                ">=3.0.0,<3.1.0"
+                "<3.2.0"
             ],
-            "v": ">=3.0.0,<3.1.0"
+            "v": "<3.2.0"
         }
     ],
     "ansible-vault": [
@@ -1695,70 +1715,52 @@
     ],
     "ansitoimg": [
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-40993",
-            "specs": [
-                "<2021.0.1"
-            ],
-            "v": "<2021.0.1"
-        },
-        {
-            "advisory": "Ansitoimg 2021.0.1 includes a fix for CVE-2020-35655: In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tables are mishandled.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-40994",
+            "advisory": "Ansitoimg 2021.0.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-40611",
             "specs": [
                 "<2021.0.1"
             ],
             "v": "<2021.0.1"
         },
         {
-            "advisory": "Ansitoimg 2021.0.1 includes a fix for CVE-2020-35653: In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-40995",
+            "advisory": "Ansitoimg 2021.0.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-40612",
             "specs": [
                 "<2021.0.1"
             ],
             "v": "<2021.0.1"
         },
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
+            "advisory": "Ansitoimg 2021.0.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
             "cve": "CVE-2021-27923",
-            "id": "pyup.io-40607",
-            "specs": [
-                "<2021.0.1"
-            ],
-            "v": "<2021.0.1"
-        },
-        {
-            "advisory": "Ansitoimg 2021.0.1 updates the 'Pillow' dependency to >= 8.1.1 due to a high severity security vulnerability (CVE-2020-35654).",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-40609",
+            "id": "pyup.io-40993",
             "specs": [
                 "<2021.0.1"
             ],
             "v": "<2021.0.1"
         },
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-40611",
+            "advisory": "Ansitoimg 2021.0.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-40994",
             "specs": [
                 "<2021.0.1"
             ],
             "v": "<2021.0.1"
         },
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-40612",
+            "advisory": "Ansitoimg 2021.0.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-40995",
             "specs": [
                 "<2021.0.1"
             ],
             "v": "<2021.0.1"
         },
         {
-            "advisory": "Ansitoimg 2021.0.1 includes a fix for CVE-2020-35654: In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode.",
+            "advisory": "Ansitoimg 2021.0.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
             "cve": "CVE-2020-35654",
             "id": "pyup.io-40996",
             "specs": [
@@ -1769,7 +1771,7 @@
     ],
     "anymotion-sdk": [
         {
-            "advisory": "An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.",
+            "advisory": "Anymotion-sdk 1.2.5 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
             "cve": "CVE-2021-33503",
             "id": "pyup.io-40842",
             "specs": [
@@ -1849,8 +1851,8 @@
     "apache-flink": [
         {
             "advisory": "Apache-flink 1.14.2 updates its dependency 'log4j' to v2.16.0 to fix critical vulnerabilities.\r\nhttps://github.com/apache/flink/commit/361ce6591069b2f7317f1c181cdaf7965615415c",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43417",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43416",
             "specs": [
                 "<1.14.2"
             ],
@@ -1858,15 +1860,24 @@
         },
         {
             "advisory": "Apache-flink 1.14.2 updates its dependency 'log4j' to v2.16.0 to fix critical vulnerabilities.\r\nhttps://github.com/apache/flink/commit/361ce6591069b2f7317f1c181cdaf7965615415c",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43416",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43417",
             "specs": [
                 "<1.14.2"
             ],
             "v": "<1.14.2"
         },
         {
-            "advisory": "Apache-flink 1.14.2 and prior includes a version of 'log4j' affected by severe vulnerabilities.",
+            "advisory": "Apache-flink 1.14.2 and prior includes a version of 'log4j' affected by a medium severity vulnerability.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44453",
+            "specs": [
+                "<=1.14.2"
+            ],
+            "v": "<=1.14.2"
+        },
+        {
+            "advisory": "Apache-flink 1.14.2 and prior includes a version of 'log4j' affected by a severe vulnerability.",
             "cve": "CVE-2021-45105",
             "id": "pyup.io-43436",
             "specs": [
@@ -2052,8 +2063,26 @@
             "v": "<0.36.0"
         },
         {
-            "advisory": "Apache-superset 0.36.0 updates NPM dependencies to include security fixes.\r\nhttps://github.com/apache/superset/pull/9106/commits/788faad7f33e1b69afcee0f01c9fc7cdccb7f81f",
-            "cve": "PVE-2021-42732",
+            "advisory": "Apache-superset 0.36.0 updates its NPM dependency 'serialize-javascript' to v2.1.2 to include security fixes.\r\nhttps://github.com/apache/superset/pull/9106/commits/788faad7f33e1b69afcee0f01c9fc7cdccb7f81f",
+            "cve": "CVE-2019-16769",
+            "id": "pyup.io-44577",
+            "specs": [
+                "<0.36.0"
+            ],
+            "v": "<0.36.0"
+        },
+        {
+            "advisory": "Apache-superset 0.36.0 updates its NPM dependency 'serialize-javascript' to v2.1.2 to include security fixes.\r\nhttps://github.com/apache/superset/pull/9106/commits/788faad7f33e1b69afcee0f01c9fc7cdccb7f81f",
+            "cve": "CVE-2019-16772",
+            "id": "pyup.io-44578",
+            "specs": [
+                "<0.36.0"
+            ],
+            "v": "<0.36.0"
+        },
+        {
+            "advisory": "Apache-superset 0.36.0 updates its NPM dependency 'chownr' to v1.1.1 to include a security fix.\r\nhttps://github.com/apache/superset/pull/9106/commits/788faad7f33e1b69afcee0f01c9fc7cdccb7f81f",
+            "cve": "CVE-2017-18869",
             "id": "pyup.io-42732",
             "specs": [
                 "<0.36.0"
@@ -2202,6 +2231,17 @@
             "v": "<0.9.2"
         }
     ],
+    "approzium": [
+        {
+            "advisory": "Approzium 0.2.1 adds further checks on the call returned from AWS to prevent exploits like the ones described here:\r\nhttps://googleprojectzero.blogspot.com/2020/10/enter-the-vault-auth-issues-hashicorp-vault.html\r\nNOTE: This is a security precaution, there isn't any known exploit affecting this package.",
+            "cve": "PVE-2022-44510",
+            "id": "pyup.io-44510",
+            "specs": [
+                "<0.2.1"
+            ],
+            "v": "<0.2.1"
+        }
+    ],
     "appwrite": [
         {
             "advisory": "Appwrite (SDK for Python) version 0.2.0 adds support for appwrite 0.8.0. Appwrite 0.7.1 fixed an XSS vulnerability in the appwrite console.",
@@ -2242,6 +2282,17 @@
             "v": "<=0.2.2"
         }
     ],
+    "archivy": [
+        {
+            "advisory": "Archivy 1.6.2 improves CSRF protection for delete actions.\r\nhttps://github.com/archivy/archivy/commit/796c3ae318eea183fc88c87ec5a27355b0f6a99d",
+            "cve": "PVE-2022-44511",
+            "id": "pyup.io-44511",
+            "specs": [
+                "<1.6.2"
+            ],
+            "v": "<1.6.2"
+        }
+    ],
     "archmage": [
         {
             "advisory": "Directory traversal vulnerability in arCHMage 0.2.4 allows remote attackers to write to arbitrary files via a .. (dot dot) in a CHM file.",
@@ -2253,6 +2304,17 @@
             "v": "<0.3.1"
         }
     ],
+    "arrnounced": [
+        {
+            "advisory": "Arrnounced 0.4 replaces XML parser with defusedxml to prevent XML attacks.\r\nhttps://github.com/weannounce/arrnounced/commit/5a1d186b32162b317b1762b8602342b0b3050bda",
+            "cve": "PVE-2022-43754",
+            "id": "pyup.io-43754",
+            "specs": [
+                "<0.4"
+            ],
+            "v": "<0.4"
+        }
+    ],
     "asciidoc": [
         {
             "advisory": "Asciidoc 8.6.6 removes the use of 'eval()' on untrusted input to disallow malicious code execution.",
@@ -2350,6 +2412,17 @@
             "v": "<0.4.0"
         }
     ],
+    "audible": [
+        {
+            "advisory": "Audible 0.6.0 switched to 'auth_code_flow' when login, giving an auth code instead of an access token. This helps to improve the exposure of sensitive information and also authentication.\r\nhttps://github.com/mkb79/Audible/commit/85b45e91c8e4c608e410253d840b33ef85320e40",
+            "cve": "PVE-2022-44680",
+            "id": "pyup.io-44680",
+            "specs": [
+                "<0.6.0"
+            ],
+            "v": "<0.6.0"
+        }
+    ],
     "auditree-framework": [
         {
             "advisory": "Auditree-framework 1.19.0 fixes minor security issues found by the 'bandit'.",
@@ -2383,7 +2456,7 @@
     ],
     "austin-tui": [
         {
-            "advisory": "Austin-tui 1.1.1 updates its dependency 'lxml' to v4.7.1 to include a security fix.",
+            "advisory": "Austin-tui 1.1.1 updates its dependency 'lxml' to v4.6.5 to include a security fix.",
             "cve": "CVE-2021-43818",
             "id": "pyup.io-43620",
             "specs": [
@@ -2412,6 +2485,17 @@
             "v": "<0.3.1"
         }
     ],
+    "auto-optional": [
+        {
+            "advisory": "Auto-optional 0.3.2 updates its dependency 'mkdocs' to v1.2.3 to include a security fix.",
+            "cve": "CVE-2021-40978",
+            "id": "pyup.io-44586",
+            "specs": [
+                "<0.3.2"
+            ],
+            "v": "<0.3.2"
+        }
+    ],
     "auto-surprise": [
         {
             "advisory": "Auto-surprise 0.1.7 includes bot security version updates.",
@@ -2455,8 +2539,8 @@
     "autocrop": [
         {
             "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-5310",
-            "id": "pyup.io-42932",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-42938",
             "specs": [
                 "<1.1.1"
             ],
@@ -2464,8 +2548,8 @@
         },
         {
             "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-11538",
-            "id": "pyup.io-42934",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-42939",
             "specs": [
                 "<1.1.1"
             ],
@@ -2473,17 +2557,17 @@
         },
         {
             "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-10378",
-            "id": "pyup.io-42936",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-42940",
             "specs": [
                 "<1.1.1"
             ],
             "v": "<1.1.1"
         },
         {
-            "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-10994",
-            "id": "pyup.io-42937",
+            "advisory": "Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
+            "cve": "CVE-2020-15999",
+            "id": "pyup.io-42851",
             "specs": [
                 "<1.1.1"
             ],
@@ -2491,8 +2575,8 @@
         },
         {
             "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-42939",
+            "cve": "CVE-2020-10378",
+            "id": "pyup.io-42936",
             "specs": [
                 "<1.1.1"
             ],
@@ -2500,8 +2584,8 @@
         },
         {
             "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-42940",
+            "cve": "CVE-2020-5310",
+            "id": "pyup.io-42932",
             "specs": [
                 "<1.1.1"
             ],
@@ -2518,8 +2602,8 @@
         },
         {
             "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-10379",
-            "id": "pyup.io-42935",
+            "cve": "CVE-2020-11538",
+            "id": "pyup.io-42934",
             "specs": [
                 "<1.1.1"
             ],
@@ -2527,8 +2611,8 @@
         },
         {
             "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-42938",
+            "cve": "CVE-2020-10379",
+            "id": "pyup.io-42935",
             "specs": [
                 "<1.1.1"
             ],
@@ -2536,8 +2620,8 @@
         },
         {
             "advisory": "Autocrop 1.1.1 updates the minimum requirement of its dependency 'pillow' to v8.1.0 to include security fixes.",
-            "cve": "CVE-2020-15999",
-            "id": "pyup.io-42851",
+            "cve": "CVE-2020-10994",
+            "id": "pyup.io-42937",
             "specs": [
                 "<1.1.1"
             ],
@@ -2575,6 +2659,42 @@
                 "<1.1.1"
             ],
             "v": "<1.1.1"
+        },
+        {
+            "advisory": "Aws-analytics-reference-architecture 1.8.8 updates its dependency 'log4j' and its references to v2.17.0 to fix critical security vulnerabilities.\r\nhttps://github.com/aws-samples/aws-analytics-reference-architecture/commit/c2c18615602c48f19be5a34dde6a8569f2fdfe0d",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43972",
+            "specs": [
+                "<1.8.8"
+            ],
+            "v": "<1.8.8"
+        },
+        {
+            "advisory": "Aws-analytics-reference-architecture 1.8.8 updates its dependency 'log4j' and its references to v2.17.0 to fix critical security vulnerabilities.\r\nhttps://github.com/aws-samples/aws-analytics-reference-architecture/commit/c2c18615602c48f19be5a34dde6a8569f2fdfe0d",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-44479",
+            "specs": [
+                "<1.8.8"
+            ],
+            "v": "<1.8.8"
+        },
+        {
+            "advisory": "Aws-analytics-reference-architecture 1.8.8 updates its dependency 'log4j' and its references to v2.17.0 to fix critical security vulnerabilities.\r\nhttps://github.com/aws-samples/aws-analytics-reference-architecture/commit/c2c18615602c48f19be5a34dde6a8569f2fdfe0d",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-44480",
+            "specs": [
+                "<1.8.8"
+            ],
+            "v": "<1.8.8"
+        },
+        {
+            "advisory": "Aws-analytics-reference-architecture 1.11.0 and prior includes a version of 'log4j' affected by a medium severity vulnerability.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44481",
+            "specs": [
+                "<=1.11.0"
+            ],
+            "v": "<=1.11.0"
         }
     ],
     "aws-encryption-sdk": [
@@ -2608,26 +2728,6 @@
                 "<4.0.0"
             ],
             "v": "<4.0.0"
-        },
-        {
-            "advisory": "Aws-encryption-sdk-cli 4.1.0 no longer supports Python 3.5. The mentioned Python version doesn't receive security updates anymore.",
-            "cve": "PVE-2021-42631",
-            "id": "pyup.io-42631",
-            "specs": [
-                "<4.1.0"
-            ],
-            "v": "<4.1.0"
-        }
-    ],
-    "aws-glue-schema-registry": [
-        {
-            "advisory": "Aws-glue-schema-registry fixes security vulnerability in transitive dependencies.",
-            "cve": "PVE-2021-42757",
-            "id": "pyup.io-42757",
-            "specs": [
-                "<1.1.5"
-            ],
-            "v": "<1.1.5"
         }
     ],
     "aws-parallelcluster": [
@@ -2911,7 +3011,7 @@
     ],
     "bento-lib": [
         {
-            "advisory": "Bento-lib 3.0.1 includes security fix to prevent data leak in error messages from data structure queries by default and adds 'secure_errors' param for data structure querying methods.",
+            "advisory": "Bento-lib 3.0.1 includes security fix to prevent data leak in error messages from data structure queries by default and adds 'secure_errors' param for data structure querying methods.\r\nhttps://github.com/bento-platform/bento_lib/commit/991ee4fd406e3397435d1c8c02f1d0c48b9ec594\r\nhttps://github.com/bento-platform/bento_lib/commit/046a023abe8de0c3e13963a0c236df4f34ade244",
             "cve": "PVE-2021-41035",
             "id": "pyup.io-41035",
             "specs": [
@@ -3321,7 +3421,7 @@
             "v": "<1.0.0a20"
         },
         {
-            "advisory": "transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.",
+            "advisory": "Boss-cli 1.0.0alpha.18 updates its dependency 'paramiko' to v2.4.1 to include a security fix.",
             "cve": "CVE-2018-7750",
             "id": "pyup.io-36543",
             "specs": [
@@ -3548,7 +3648,16 @@
             "v": "<1.16.2"
         },
         {
-            "advisory": "Bzt 1.16.2 and prior includes a version of 'jmeter' (5.4.2) affected by severe vulnerabilities.",
+            "advisory": "Bzt 1.16.2 and prior includes a version of 'jmeter' (5.4.2) affected by a medium severity vulnerability.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44454",
+            "specs": [
+                "<=1.16.2"
+            ],
+            "v": "<=1.16.2"
+        },
+        {
+            "advisory": "Bzt 1.16.2 and prior includes a version of 'jmeter' (5.4.2) affected by a severe vulnerability.",
             "cve": "CVE-2021-45105",
             "id": "pyup.io-43435",
             "specs": [
@@ -3652,31 +3761,40 @@
     ],
     "cancat": [
         {
-            "advisory": "Cancat 1.9.3.4 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
+            "advisory": "Cancat 2.0.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43585",
+            "specs": [
+                "<=2.0.0"
+            ],
+            "v": "<=2.0.0"
+        },
+        {
+            "advisory": "Cancat 2.0.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
             "cve": "CVE-2021-45105",
             "id": "pyup.io-43586",
             "specs": [
-                "<=1.9.3.4"
+                "<=2.0.0"
             ],
-            "v": "<=1.9.3.4"
+            "v": "<=2.0.0"
         },
         {
-            "advisory": "Cancat 1.9.3.4 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43585",
+            "advisory": "Cancat 2.0.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44459",
             "specs": [
-                "<=1.9.3.4"
+                "<=2.0.0"
             ],
-            "v": "<=1.9.3.4"
+            "v": "<=2.0.0"
         },
         {
-            "advisory": "Cancat 1.9.3.4 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
+            "advisory": "Cancat 2.0.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
             "cve": "CVE-2021-44228",
             "id": "pyup.io-43587",
             "specs": [
-                "<=1.9.3.4"
+                "<=2.0.0"
             ],
-            "v": "<=1.9.3.4"
+            "v": "<=2.0.0"
         }
     ],
     "candig-server": [
@@ -3690,8 +3808,8 @@
             "v": "<0.9.0"
         },
         {
-            "advisory": "candig-server 0.9.2 changes: Jinja2 package has been updated to resolve security vulnerability issues.",
-            "cve": "PVE-2021-37218",
+            "advisory": "Candig-server 0.9.2 updates its dependency 'Jinja2' to v2.10.1 to include a security fix.",
+            "cve": "CVE-2019-10906",
             "id": "pyup.io-37218",
             "specs": [
                 "<0.9.2"
@@ -3821,6 +3939,15 @@
                 "<0.0.83"
             ],
             "v": "<0.0.83"
+        },
+        {
+            "advisory": "Cdk-ecr-deployment 2.0.7 updates 'containerd' and 'opencontainers' images to include security fixes.\r\nhttps://github.com/cdklabs/cdk-ecr-deployment/commit/74e8412f370f4ab00be5b5a1f509c2615a874a46",
+            "cve": "PVE-2022-44474",
+            "id": "pyup.io-44474",
+            "specs": [
+                "<2.0.7"
+            ],
+            "v": "<2.0.7"
         }
     ],
     "cedar-backup3": [
@@ -3854,7 +3981,7 @@
             "v": "<5.2.0"
         },
         {
-            "advisory": "Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.\r\nhttps://github.com/celery/celery/blob/master/Changelog.rst#522",
+            "advisory": "Celery 5.2.2 includes a fix for CVE-2021-23727: Celery before 5.2.2. by default trusts the messages and metadata stored in backends (result stores). When reading task metadata from the backend, the data is deserialized. Given that an attacker can gain access to, or somehow manipulate the metadata within a celery backend, they could trigger a stored command injection vulnerability and potentially gain further access to the system.",
             "cve": "CVE-2021-23727",
             "id": "pyup.io-43738",
             "specs": [
@@ -4122,9 +4249,9 @@
     ],
     "chatbot-ner": [
         {
-            "advisory": "Chatbot-ner 0.5.8 updates its dependency 'NLTK' to v3.4.5 to include a security fix.",
-            "cve": "CVE-2019-14751",
-            "id": "pyup.io-42431",
+            "advisory": "Chatbot-ner 0.5.8 updates its dependency 'django' to v1.11.26 to include security fixes.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-42434",
             "specs": [
                 "<0.5.8"
             ],
@@ -4140,9 +4267,9 @@
             "v": "<0.5.8"
         },
         {
-            "advisory": "Chatbot-ner 0.5.8 updates its dependency 'django' to v1.11.26 to include security fixes.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-42434",
+            "advisory": "Chatbot-ner 0.5.8 updates its dependency 'NLTK' to v3.4.5 to include a security fix.",
+            "cve": "CVE-2019-14751",
+            "id": "pyup.io-42431",
             "specs": [
                 "<0.5.8"
             ],
@@ -4166,15 +4293,6 @@
             ],
             "v": "<0.5.8"
         },
-        {
-            "advisory": "Chatbot-ner 0.6.0 updates its dependency 'Django' to v1.11.26 to include security fixes.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-38515",
-            "specs": [
-                "<0.6.0"
-            ],
-            "v": "<0.6.0"
-        },
         {
             "advisory": "Chatbot-ner 0.6.0 updates its dependency 'Django' to v1.11.27 to include security fixes.",
             "cve": "CVE-2019-14232",
@@ -4202,6 +4320,15 @@
             ],
             "v": "<0.6.0"
         },
+        {
+            "advisory": "Chatbot-ner 0.6.0 updates its dependency 'Django' to v1.11.26 to include security fixes.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-38515",
+            "specs": [
+                "<0.6.0"
+            ],
+            "v": "<0.6.0"
+        },
         {
             "advisory": "Chatbot-ner 0.6.0 updates its dependency 'nltk' to v3.4.5 to include a security fix.",
             "cve": "CVE-2019-14751",
@@ -4298,17194 +4425,22568 @@
     ],
     "chia": [
         {
-            "advisory": "Chia 2.4.0 updates tensorflow and tensorflow-addons versions to include mitigations against vulnerabilities.",
-            "cve": "PVE-2021-41298",
-            "id": "pyup.io-41298",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29550",
+            "id": "pyup.io-44255",
             "specs": [
                 "<2.4.0"
             ],
             "v": "<2.4.0"
-        }
-    ],
-    "chia-blockchain": [
+        },
         {
-            "advisory": "Consideration of the new consensus algorithm in chia-blockchain version 1.0beta19 resulted in a much higher security level against all attacks.",
-            "cve": "PVE-2021-39444",
-            "id": "pyup.io-39444",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29551",
+            "id": "pyup.io-44256",
             "specs": [
-                "<1.0b19"
+                "<2.4.0"
             ],
-            "v": "<1.0b19"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Chia-blockchain 1.0b27 updates its GUI to handle CVE-2020-28477.\r\nhttps://github.com/Chia-Network/chia-blockchain/commit/45c85c0030a9b07bd3d07fc0e7f7afc540b53009",
-            "cve": "CVE-2020-28477",
-            "id": "pyup.io-42341",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29552",
+            "id": "pyup.io-44257",
             "specs": [
-                "<1.0b27"
+                "<2.4.0"
             ],
-            "v": "<1.0b27"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Chia-blockchain 1.0b27 updates its dependency 'pyyaml' to v5.4.1 to include a security fix.",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-42367",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29553",
+            "id": "pyup.io-44258",
             "specs": [
-                "<1.0b27"
+                "<2.4.0"
             ],
-            "v": "<1.0b27"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Chia-blockchain 1.0beta10 includes various vulnerability fixes.",
-            "cve": "PVE-2021-38700",
-            "id": "pyup.io-38700",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29554",
+            "id": "pyup.io-44259",
             "specs": [
-                "<1.0beta10"
+                "<2.4.0"
             ],
-            "v": "<1.0beta10"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Node peers in chia-blockchain 1.0beta14 are gossiped between nodes with logic to keep connected nodes on disparate internet networks to partially protect from eclipse attacks.",
-            "cve": "PVE-2021-38844",
-            "id": "pyup.io-38844",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29555",
+            "id": "pyup.io-44260",
             "specs": [
-                "<1.0beta14"
+                "<2.4.0"
             ],
-            "v": "<1.0beta14"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Chia-blockchain 1.0beta8 removes the ability to pass in sk_seed to plotting. This increases security.",
-            "cve": "PVE-2021-38582",
-            "id": "pyup.io-38582",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29556",
+            "id": "pyup.io-44261",
             "specs": [
-                "<1.0beta8"
+                "<2.4.0"
             ],
-            "v": "<1.0beta8"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "The Windows BLS Signature library in chia-blockchain 1.0beta9 uses libsodium for additional security. Additionally, this version includes various fixes for various node dependency security vulnerabilities.",
-            "cve": "PVE-2021-38629",
-            "id": "pyup.io-38629",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29557",
+            "id": "pyup.io-44262",
             "specs": [
-                "<1.0beta9"
+                "<2.4.0"
             ],
-            "v": "<1.0beta9"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Chia-blockchain 1.0rc5 updates the 'aiohttp' dependency to 3.7.4 to address a low severity [security issue] (CVE-2021-21330).",
-            "cve": "CVE-2021-21330",
-            "id": "pyup.io-39672",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29558",
+            "id": "pyup.io-44263",
             "specs": [
-                "<1.0rc5"
+                "<2.4.0"
             ],
-            "v": "<1.0rc5"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Chia-blockchain 1.0rc6 improves defense against many DDoS attacks by rate limiting for the full node. It also changes 'chia keys add' command to take secret words a prompt on the command line or stdin instead of command line arguments.",
-            "cve": "PVE-2021-39703",
-            "id": "pyup.io-39703",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29559",
+            "id": "pyup.io-44264",
             "specs": [
-                "<1.0rc6"
+                "<2.4.0"
             ],
-            "v": "<1.0rc6"
-        }
-    ],
-    "chiavdf": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Chiavdf 1.0 includes a fix to prevent potential grinding attacks.",
-            "cve": "PVE-2021-39691",
-            "id": "pyup.io-39691",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29560",
+            "id": "pyup.io-44265",
             "specs": [
-                "<1.0"
+                "<2.4.0"
             ],
-            "v": "<1.0"
-        }
-    ],
-    "choochoo": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Choochoo 0.40.0 updates its dependency React to the latest version \"hopefully\" removing several npm vulnerabilities.",
-            "cve": "PVE-2021-41273",
-            "id": "pyup.io-41273",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29561",
+            "id": "pyup.io-44266",
             "specs": [
-                "<0.40.0"
+                "<2.4.0"
             ],
-            "v": "<0.40.0"
-        }
-    ],
-    "ciftify": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Ciftify version 2.3.3 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/edickie/ciftify/commit/7ac66dc2efc78bae272a0e1e713c81756f780969#diff-d55ace9e33dabdeba89768d93ae8fe97cf6d2ba4936fc5ab472b7bf749270b63",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41312",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29562",
+            "id": "pyup.io-44267",
             "specs": [
-                "<2.3.3"
+                "<2.4.0"
             ],
-            "v": "<2.3.3"
-        }
-    ],
-    "cinder": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cinder versions 14.1.0, 15.2.0 and 16.1.0 include a fix for CVE-2020-10755: An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the 'connection_info' element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API.\r\nhttps://wiki.openstack.org/wiki/OSSN/OSSN-0086",
-            "cve": "CVE-2020-10755",
-            "id": "pyup.io-38408",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29563",
+            "id": "pyup.io-44268",
             "specs": [
-                "<14.1.0",
-                ">=15.0.0.0rc1,<15.2.0",
-                ">=16.0.0.0b1,<16.1.0"
+                "<2.4.0"
             ],
-            "v": "<14.1.0,>=15.0.0.0rc1,<15.2.0,>=16.0.0.0b1,<16.1.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.",
-            "cve": "CVE-2013-1068",
-            "id": "pyup.io-25651",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29564",
+            "id": "pyup.io-44269",
             "specs": [
-                "<2013.2.3"
+                "<2.4.0"
             ],
-            "v": "<2013.2.3"
-        }
-    ],
-    "cipher.googlepam": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "In cipher.googlepam before 1.5.1 do not use the same cache key for all users. Previously when one user logged in successfully, others could not log in using their own passwords -- but the first user could now use her password to log in as anyone else.",
-            "cve": "PVE-2021-25652",
-            "id": "pyup.io-25652",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29565",
+            "id": "pyup.io-44270",
             "specs": [
-                "<1.5.1"
+                "<2.4.0"
             ],
-            "v": "<1.5.1"
-        }
-    ],
-    "circuit-maintenance-parser": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Circuit-maintenance-parser 1.1.0 updates the 'Pydantic' dependency version due to security advisory (GHSA-5jqp-qgf6-3pvh).",
-            "cve": "PVE-2021-41103",
-            "id": "pyup.io-41103",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29566",
+            "id": "pyup.io-44271",
             "specs": [
-                "<1.1.0"
+                "<2.4.0"
             ],
-            "v": "<1.1.0"
-        }
-    ],
-    "circup": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Circup 0.0.6 includes an unspecified security fix.",
-            "cve": "PVE-2021-37936",
-            "id": "pyup.io-37936",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29568",
+            "id": "pyup.io-44272",
             "specs": [
-                "<0.0.6"
+                "<2.4.0"
             ],
-            "v": "<0.0.6"
-        }
-    ],
-    "ck": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Ck 1.7.1 fixes a server vulnerability (action with ; can run various CMD commands).",
-            "cve": "PVE-2021-40221",
-            "id": "pyup.io-40221",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29569",
+            "id": "pyup.io-44273",
             "specs": [
-                "<1.7.1"
+                "<2.4.0"
             ],
-            "v": "<1.7.1"
-        }
-    ],
-    "ckan": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "ckan 1.5.1 fixes a security issue affecting CKAN v1.5 and before.",
-            "cve": "PVE-2021-34556",
-            "id": "pyup.io-34556",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29570",
+            "id": "pyup.io-44274",
             "specs": [
-                "<1.5.1"
+                "<2.4.0"
             ],
-            "v": "<1.5.1"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Ckan 1.8.1 fixes a possible XSS vulnerability on html input.\r\nhttps://github.com/ckan/ckan/pull/703",
-            "cve": "PVE-2021-34558",
-            "id": "pyup.io-34558",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29569",
+            "id": "pyup.io-44275",
             "specs": [
-                "<1.8.1"
+                "<2.4.0"
             ],
-            "v": "<1.8.1"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Ckan 2.6.9 fixes a code injection issue in the autocomplete module. See <https://github.com/ckan/ckan/pull/5064>.",
-            "cve": "PVE-2021-39613",
-            "id": "pyup.io-39613",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29570",
+            "id": "pyup.io-44276",
             "specs": [
-                "<2.6.9"
+                "<2.4.0"
             ],
-            "v": "<2.6.9"
-        }
-    ],
-    "clam": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "clam 0.9.10 contains security fixes, better protection against possible code injection.",
-            "cve": "PVE-2021-25653",
-            "id": "pyup.io-25653",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29569",
+            "id": "pyup.io-44277",
             "specs": [
-                "<0.9.10"
+                "<2.4.0"
             ],
-            "v": "<0.9.10"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Clam 0.9.11 fixes a RCE vulnerability in its dispatcher.\r\nhttps://github.com/proycon/clam/commit/f89ba22a3b74f0b86ce9d8190ce28b6da7331813",
-            "cve": "PVE-2021-25654",
-            "id": "pyup.io-25654",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29571",
+            "id": "pyup.io-44278",
             "specs": [
-                "<0.9.11"
+                "<2.4.0"
             ],
-            "v": "<0.9.11"
-        }
-    ],
-    "clearsilver": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.",
-            "cve": "CVE-2011-4357",
-            "id": "pyup.io-25655",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29572",
+            "id": "pyup.io-44279",
             "specs": [
-                "<0.10.5"
+                "<2.4.0"
             ],
-            "v": "<0.10.5"
-        }
-    ],
-    "cliboa": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cliboa 2.0.0b0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
-            "cve": "CVE-2021-33503",
-            "id": "pyup.io-42681",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29573",
+            "id": "pyup.io-44280",
             "specs": [
-                "<2.0.0b0"
+                "<2.4.0"
             ],
-            "v": "<2.0.0b0"
-        }
-    ],
-    "clickhouse-driver": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.",
-            "cve": "CVE-2020-26759",
-            "id": "pyup.io-42290",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29574",
+            "id": "pyup.io-44281",
             "specs": [
-                "<0.1.5"
+                "<2.4.0"
             ],
-            "v": "<0.1.5"
-        }
-    ],
-    "client-sdk-python": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Client-sdk-python 4.7.0 upgrades eth-hash to 0.2.0 with pycryptodome 3.6.6 which resolves a vulnerability.",
-            "cve": "PVE-2021-37584",
-            "id": "pyup.io-37584",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29575",
+            "id": "pyup.io-44282",
             "specs": [
-                "<4.7.0"
+                "<2.4.0"
             ],
-            "v": "<4.7.0"
-        }
-    ],
-    "clipster-desktop": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Clipster-desktop 0.3.0 includes various improvements to make the host more secure:\r\n* All clips are encrypted locally in the client before transmission to the server. \r\n* Server host can't decrypt clips: it never learns the users' password.\r\n* Password is not stored in cleartext anymore. Instead password hash is used.",
-            "cve": "PVE-2021-39388",
-            "id": "pyup.io-39388",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29576",
+            "id": "pyup.io-44283",
             "specs": [
-                "<0.3.0"
+                "<2.4.0"
             ],
-            "v": "<0.3.0"
-        }
-    ],
-    "cliquery": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cliquery 1.10.0 updates the 'lxml' dependency from 4.6.2 to 4.6.3 to fix a security vulnerability.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-40090",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29577",
+            "id": "pyup.io-44284",
             "specs": [
-                "<1.10.0"
+                "<2.4.0"
             ],
-            "v": "<1.10.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cliquery 1.9.3 updates the 'lxml' dependency from 4.3.0 to 4.6.2 to include security fixes.",
-            "cve": "CVE-2020-27783",
-            "id": "pyup.io-39423",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29578",
+            "id": "pyup.io-44285",
             "specs": [
-                "<1.9.3"
+                "<2.4.0"
             ],
-            "v": "<1.9.3"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cliquery 1.9.3 updates the 'lxml' dependency from 4.3.0 to 4.6.2 to include security fixes.",
-            "cve": "PVE-2021-39195",
-            "id": "pyup.io-43643",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29579",
+            "id": "pyup.io-44286",
             "specs": [
-                "<1.9.3"
+                "<2.4.0"
             ],
-            "v": "<1.9.3"
-        }
-    ],
-    "cloudmarker": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cloudmarker 0.0.5 adds the `FirewallRuleEvent` plugin to detect insecure firewall rules.",
-            "cve": "PVE-2021-37138",
-            "id": "pyup.io-37138",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29580",
+            "id": "pyup.io-44287",
             "specs": [
-                "<0.0.5"
+                "<2.4.0"
             ],
-            "v": "<0.0.5"
-        }
-    ],
-    "cloudwatch-to-graphite": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cloudwatch-to-graphite version 0.11.0 includes a security patch for the function 'get_config' in 'leadbutt.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/crccheck/cloudwatch-to-graphite/commit/5875100c54a54a9c90cf2fe782cc3df147d32053#diff-ddb0922eafb2fa54199e50bb13de6178b1755e780387144df032f9e26512f15e",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41313",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29581",
+            "id": "pyup.io-44288",
             "specs": [
-                "<0.11.0"
+                "<2.4.0"
             ],
-            "v": "<0.11.0"
-        }
-    ],
-    "cloverly-python-module": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cloverly-python-module 0.2.0 adds a clear session function for security purposes.",
-            "cve": "PVE-2021-41085",
-            "id": "pyup.io-41085",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29582",
+            "id": "pyup.io-44289",
             "specs": [
-                "<0.2.0"
+                "<2.4.0"
             ],
-            "v": "<0.2.0"
-        }
-    ],
-    "cmdlr": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "cmdlr 4.1.0 resists malicious js attack in `run_in_nodejs`",
-            "cve": "PVE-2021-36854",
-            "id": "pyup.io-36854",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29584",
+            "id": "pyup.io-44291",
             "specs": [
-                "<4.1.0"
+                "<2.4.0"
             ],
-            "v": "<4.1.0"
-        }
-    ],
-    "cmsplugin-filer": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cmsplugin-filer 0.10.2 includes a fix for a XSS vulnerability in 'firstof' in folder template. Users with Django>1.7 aren't affected.\r\nhttps://github.com/divio/cmsplugin-filer/pull/185",
-            "cve": "PVE-2021-25656",
-            "id": "pyup.io-25656",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29585",
+            "id": "pyup.io-44292",
             "specs": [
-                "<0.10.2"
+                "<2.4.0"
             ],
-            "v": "<0.10.2"
-        }
-    ],
-    "cnx-publishing": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cnx-publishing 0.17.6 updates its dependency 'urllib3' to v1.25.8 to include a security fix.",
-            "cve": "CVE-2020-7212",
-            "id": "pyup.io-38128",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29586",
+            "id": "pyup.io-44293",
             "specs": [
-                "<0.17.6"
+                "<2.4.0"
             ],
-            "v": "<0.17.6"
-        }
-    ],
-    "coapthon": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, CoAP reverse proxy, example collect CoAP server and client) when they receive crafted CoAP messages.",
-            "cve": "CVE-2018-12680",
-            "id": "pyup.io-42251",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29587",
+            "id": "pyup.io-44294",
             "specs": [
-                "==3.1",
-                "==4.0.0",
-                "==4.0.1",
-                "==4.0.2"
+                "<2.4.0"
             ],
-            "v": "==3.1,==4.0.0,==4.0.1,==4.0.2"
-        }
-    ],
-    "cobbler": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE. No information was provided about fixes or affected versions. See: CVE-2011-4954.",
-            "cve": "CVE-2011-4954",
-            "id": "pyup.io-37739",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29588",
+            "id": "pyup.io-44295",
             "specs": [
-                ">0"
+                "<2.4.0"
             ],
-            "v": ">0"
-        }
-    ],
-    "cockroachdb": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "cockroachdb 0.3.2 updated urllib3 to remove security vulnerability.",
-            "cve": "PVE-2021-37264",
-            "id": "pyup.io-37264",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29589",
+            "id": "pyup.io-44296",
             "specs": [
-                "<0.3.2"
+                "<2.4.0"
             ],
-            "v": "<0.3.2"
-        }
-    ],
-    "codalab": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "codalab before 0.2.33 was using a version of gunicorn that had security vulnerabilities.",
-            "cve": "PVE-2021-36386",
-            "id": "pyup.io-36386",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29590",
+            "id": "pyup.io-44297",
             "specs": [
-                "<0.2.33"
+                "<2.4.0"
             ],
-            "v": "<0.2.33"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Codalab 0.5.12 fixes a vulnerability. No description of the vulnerability was included.",
-            "cve": "PVE-2021-38927",
-            "id": "pyup.io-38927",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29591",
+            "id": "pyup.io-44298",
             "specs": [
-                "<0.5.12"
+                "<2.4.0"
             ],
-            "v": "<0.5.12"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Codalab 0.5.33 includes a fix for some front-end vulnerabilities (with `npm audit fix`).",
-            "cve": "PVE-2021-39434",
-            "id": "pyup.io-39434",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29592",
+            "id": "pyup.io-44299",
             "specs": [
-                "<0.5.33"
+                "<2.4.0"
             ],
-            "v": "<0.5.33"
-        }
-    ],
-    "code42cli": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Code42cli 1.3.0 starts to support a secure transporting of data with the TLS-TCP protocol.",
-            "cve": "PVE-2021-42534",
-            "id": "pyup.io-42534",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29593",
+            "id": "pyup.io-44300",
             "specs": [
-                "<1.3.0"
+                "<2.4.0"
             ],
-            "v": "<1.3.0"
-        }
-    ],
-    "codecov": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Codecov 2.0.16 fixes a reported command injection vulnerability.",
-            "cve": "PVE-2021-37934",
-            "id": "pyup.io-37934",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29583",
+            "id": "pyup.io-44290",
             "specs": [
-                "<2.0.16"
+                "<2.4.0"
             ],
-            "v": "<2.0.16"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Codecov 2.0.17 fixes a reported command injection vulnerability.",
-            "cve": "PVE-2021-38075",
-            "id": "pyup.io-38075",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29594",
+            "id": "pyup.io-44301",
             "specs": [
-                "<2.0.17"
+                "<2.4.0"
             ],
-            "v": "<2.0.17"
-        }
-    ],
-    "codeforcesapipy": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Codeforcesapipy 2.0.8 updates the 'lxml' dependency to 4.6.3 to resolve security issues.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-40099",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29595",
+            "id": "pyup.io-44302",
             "specs": [
-                "<2.0.8"
+                "<2.4.0"
             ],
-            "v": "<2.0.8"
-        }
-    ],
-    "cohen3": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cohen3 version 0.8.3 updates its dependency \"requests\" to include a security fix.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-42040",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29596",
+            "id": "pyup.io-44303",
             "specs": [
-                "<0.8.3"
+                "<2.4.0"
             ],
-            "v": "<0.8.3"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cohen3 version 0.9.1 updates its dependency \"urlib3\" to v1.24.2 to include a security fix.",
-            "cve": "CVE-2019-11324",
-            "id": "pyup.io-42039",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29597",
+            "id": "pyup.io-44304",
             "specs": [
-                "<0.9.1"
+                "<2.4.0"
             ],
-            "v": "<0.9.1"
-        }
-    ],
-    "coinbasepro": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Coinbasepro 0.1.0 updates requests version to >=2.20.0 to address a security vulnerability.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36975",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29598",
+            "id": "pyup.io-44305",
             "specs": [
-                "<0.1.0"
+                "<2.4.0"
             ],
-            "v": "<0.1.0"
-        }
-    ],
-    "coincurve": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "coincurve before 8.0.0 does not support the new GitHub and PyPI security requirements. \r\nBinary wheels on macOS for Python 3.5 now uses Homebrew Python for compilation due to new security requirements.",
-            "cve": "PVE-2021-36299",
-            "id": "pyup.io-36299",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29599",
+            "id": "pyup.io-44306",
             "specs": [
-                "<8.0.0"
+                "<2.4.0"
             ],
-            "v": "<8.0.0"
-        }
-    ],
-    "coinstac": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Coinstac 5.2.1 includes various security fixes and package updates.",
-            "cve": "PVE-2021-40091",
-            "id": "pyup.io-40091",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29600",
+            "id": "pyup.io-44307",
             "specs": [
-                "<5.2.1"
+                "<2.4.0"
             ],
-            "v": "<5.2.1"
-        }
-    ],
-    "colander": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "colander 1.7.0 - The URL validator regex has been updated to no longer be vulnerable to a\r\n  catastrophic backtracking that would have led to an infinite loop.",
-            "cve": "PVE-2021-36856",
-            "id": "pyup.io-36856",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29601",
+            "id": "pyup.io-44308",
             "specs": [
-                "<1.7.0"
+                "<2.4.0"
             ],
-            "v": "<1.7.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.",
-            "cve": "CVE-2017-18361",
-            "id": "pyup.io-42247",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29602",
+            "id": "pyup.io-44309",
             "specs": [
-                "<=1.6"
+                "<2.4.0"
             ],
-            "v": "<=1.6"
-        }
-    ],
-    "collective-contact-core": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "collective-contact-core before 1.10",
-            "cve": "PVE-2021-36089",
-            "id": "pyup.io-36089",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29603",
+            "id": "pyup.io-44310",
             "specs": [
-                "<1.10"
+                "<2.4.0"
             ],
-            "v": "<1.10"
-        }
-    ],
-    "collective-easyform": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Collective-easyform version 3.0.5 doesn't resolves entities in the modeleditor and removes processing instructions (commit #254).",
-            "cve": "PVE-2021-41911",
-            "id": "pyup.io-41911",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29604",
+            "id": "pyup.io-44311",
             "specs": [
-                "<3.0.5"
+                "<2.4.0"
             ],
-            "v": "<3.0.5"
-        }
-    ],
-    "collective-indexing": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Collective-indexing version 2.1 includes a fix that prevents out-of-sync security indexes on Solr. Now, reindexObjectSecurity operations are handled by the queue.\r\nhttps://github.com/plone/collective.indexing/pull/17",
-            "cve": "PVE-2021-41879",
-            "id": "pyup.io-41879",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29605",
+            "id": "pyup.io-44312",
             "specs": [
-                "<2.1"
+                "<2.4.0"
             ],
-            "v": "<2.1"
-        }
-    ],
-    "collective-noticeboard": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "collective-noticeboard before 0.7.1 has a security issue, anonymous users could modify notes positions.",
-            "cve": "PVE-2021-35879",
-            "id": "pyup.io-35879",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29606",
+            "id": "pyup.io-44313",
             "specs": [
-                "<0.7.1"
+                "<2.4.0"
             ],
-            "v": "<0.7.1"
-        }
-    ],
-    "collective.contact.core": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Collective.contact.core 1.10 fixes a security issue related to AddContact. The vulnerability was found in its dependency Plone CMS. See CVE-2016-7138.\r\nhttps://github.com/collective/collective.contact.core/pull/25",
-            "cve": "CVE-2016-7138",
-            "id": "pyup.io-25657",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29607",
+            "id": "pyup.io-44314",
             "specs": [
-                "<1.10"
+                "<2.4.0"
             ],
-            "v": "<1.10"
-        }
-    ],
-    "collective.documentviewer": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Collective.documentviewer 1.5.1 fixes a security issue on file resources permissions.\r\nhttps://github.com/collective/collective.documentviewer/commit/7222b0d30b1976d3f6773553bd6948c39efcbc20",
-            "cve": "PVE-2021-25658",
-            "id": "pyup.io-25658",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29608",
+            "id": "pyup.io-44315",
             "specs": [
-                "<1.5.1"
+                "<2.4.0"
             ],
-            "v": "<1.5.1"
-        }
-    ],
-    "collective.easyform": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "The modeleditor in collective.easyform 3.0.5 no longer resolves entities, and it removes processing instructions. This increases the security.",
-            "cve": "PVE-2021-39144",
-            "id": "pyup.io-39144",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29609",
+            "id": "pyup.io-44316",
             "specs": [
-                "<3.0.5"
+                "<2.4.0"
             ],
-            "v": "<3.0.5"
-        }
-    ],
-    "collective.js.datatables": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Collective.js.datatables 4.1.1 updates Datatables to 1.10.11, due to a XSS vulnerability in 1.10.4.",
-            "cve": "CVE-2015-6384",
-            "id": "pyup.io-25659",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29610",
+            "id": "pyup.io-44317",
             "specs": [
-                "<4.1.1"
+                "<2.4.0"
             ],
-            "v": "<4.1.1"
-        }
-    ],
-    "collective.noticeboard": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Collective.noticeboard 0.7.1 fixes a security issue, anonymous users could modify notes positions.",
-            "cve": "PVE-2021-25660",
-            "id": "pyup.io-25660",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29611",
+            "id": "pyup.io-44318",
             "specs": [
-                "<0.7.1"
+                "<2.4.0"
             ],
-            "v": "<0.7.1"
-        }
-    ],
-    "collective.portlet.twitter": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Collective.portlet.twitter 1.0b3 fixes a potential XSS (arbitrary injection) issue by escaping and quoting all attributes being set on the rendered portlet.\r\nhttps://github.com/collective/collective.portlet.twitter/pull/2",
-            "cve": "PVE-2021-25661",
-            "id": "pyup.io-25661",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29612",
+            "id": "pyup.io-44319",
             "specs": [
-                "<1.0b3"
+                "<2.4.0"
             ],
-            "v": "<1.0b3"
-        }
-    ],
-    "collective.tablepage": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "collective.tablepage 0.3 fixes a security problem: data inside text cells were transformed to HTML without any check.",
-            "cve": "PVE-2021-25664",
-            "id": "pyup.io-25664",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29613",
+            "id": "pyup.io-44320",
             "specs": [
-                "<0.3"
+                "<2.4.0"
             ],
-            "v": "<0.3"
-        }
-    ],
-    "collective.xmpp.chat": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "collective.xmpp.chat 0.3.1 updates convers.js to 0.6.3 which includes an important security fix.",
-            "cve": "PVE-2021-25666",
-            "id": "pyup.io-25666",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29614",
+            "id": "pyup.io-44321",
             "specs": [
-                "<0.3.1"
+                "<2.4.0"
             ],
-            "v": "<0.3.1"
-        }
-    ],
-    "collins-client": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Collins 2.1.0 has a very important security patch.\r\n\r\nCollins has a feature that allows you to [encrypt certain attributes](http://tumblr.github.io/collins/configuration.htmlfeatures) on every asset.  It also had a permission that restricted which users could read those encrypted tags.  It did NOT have a permission that restricted which users could modify encrypted tags.\r\n\r\n*It is strongly recommended that you upgrade to collins 2.1.0 if you are using the encrypted tags feature, as well as rotate any values stored in encrypted tags.*\r\n\r\nThe severity of this vulnerability depends heavily upon how you use collins in your infrastructure.  If you do not use the encrypted tags feature, you are not vulnerable to this problem.  If you do use the encrypted tags feature, you will need to explore your automation and consider how vulnerable you are.\r\n\r\nIf, for example, your infrastructure has automation that regularly sets the root password on servers to match a value that is in collins, an attacker without the ability to read the current password could set it to a value that they know, wait for the automation to change the password, and then gain root on a server.\r\n\r\nThis change is backwards compatible with collins v2.0.0, though once you upgrade it will stop any writes to encrypted tags by users that have not been granted `feature.canWriteEncryptedTags` permission.  We have also renamed `feature.canSeePasswords` to `feature.canSeeEncryptedTags`, but collins will continue to respect the value of `feature.canSeePasswords` if `feature.canSeeEncryptedTags` is not set.  Once `feature.canSeeEncryptedTags` is set, collins will ignore the value of `feature.canSeePasswords`.",
-            "cve": "PVE-2021-25667",
-            "id": "pyup.io-25667",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29615",
+            "id": "pyup.io-44322",
             "specs": [
-                "<2.1.0"
+                "<2.4.0"
             ],
-            "v": "<2.1.0"
-        }
-    ],
-    "colonyscanalyser": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Colonyscanalyser 0.2.0 adds snyk security checks for dependencies.",
-            "cve": "PVE-2021-37635",
-            "id": "pyup.io-37635",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29616",
+            "id": "pyup.io-44323",
             "specs": [
-                "<0.2.0"
+                "<2.4.0"
             ],
-            "v": "<0.2.0"
-        }
-    ],
-    "compliance-trestle": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Compliance-trestle 0.15.0 upgrades the 'pydantic' to 1.8.2 for an security issue.",
-            "cve": "PVE-2021-40566",
-            "id": "pyup.io-40566",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29617",
+            "id": "pyup.io-44324",
             "specs": [
-                "<0.15.0"
+                "<2.4.0"
             ],
-            "v": "<0.15.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Compliance-trestle 0.26.0 removes user names from logs.\r\nhttps://github.com/IBM/compliance-trestle/commit/4d075b89776552a1f58751674e2056ac7afac3cc",
-            "cve": "PVE-2021-42185",
-            "id": "pyup.io-42185",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29618",
+            "id": "pyup.io-44325",
             "specs": [
-                "<0.26.0"
+                "<2.4.0"
             ],
-            "v": "<0.26.0"
-        }
-    ],
-    "concrete-datastore": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Concrete-datastore 1.22.0 adds useful checks to the url_format to avoid template injections.",
-            "cve": "PVE-2021-39449",
-            "id": "pyup.io-39449",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29619",
+            "id": "pyup.io-44326",
             "specs": [
-                "<1.22.0"
+                "<2.4.0"
             ],
-            "v": "<1.22.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Concrete-datastore 1.23.0 adds checks on the url_format for reset password view to avoid template injections.",
-            "cve": "PVE-2021-39709",
-            "id": "pyup.io-39709",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37636",
+            "id": "pyup.io-44328",
             "specs": [
-                "<1.23.0"
+                "<2.4.0"
             ],
-            "v": "<1.23.0"
-        }
-    ],
-    "conference-scheduler-cli": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.",
-            "cve": "CVE-2018-14572",
-            "id": "pyup.io-36425",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37637",
+            "id": "pyup.io-44329",
             "specs": [
-                "<=0.10.1"
+                "<2.4.0"
             ],
-            "v": "<=0.10.1"
-        }
-    ],
-    "confidant": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Confidant 1.1.13 includes a security fix. It was discovered when adding tests after a refactor of some of the KMS authentication code that confidant wasn't properly checking the expiration of KMS auth tokens. If tokens were able to be exfiltrated from a service, they could be used indefinitely. Also, any tokens that are expired will now correctly fail to authenticate.",
-            "cve": "PVE-2021-26670",
-            "id": "pyup.io-26670",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37638",
+            "id": "pyup.io-44330",
             "specs": [
-                "<1.1.13"
+                "<2.4.0"
             ],
-            "v": "<1.1.13"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "confidant 1.1.14 contains a security fix: While preparing for the 1.1 stable release Lyft found a KMS  authentication vulnerability in the unreleased 1.1 branch while performing an  audit of the code. The vulnerability was introduced while adding the scoped auth  key feature (for limiting authentication keys and services to specific AWS  accounts), where the key was not properly checked after decryption. This check is  an additional verification to add additional safety on-top of the IAM policy of  your KMS keys. If IAM policy allows users to use KMS keys without limits on  encryption context, a KMS key that wasn't intended to be used for auth, could be  used for auth.",
-            "cve": "PVE-2021-25668",
-            "id": "pyup.io-25668",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37635",
+            "id": "pyup.io-44327",
             "specs": [
-                "<1.1.14"
+                "<2.4.0"
             ],
-            "v": "<1.1.14"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Confidant v1.10.0 upgrades gevent and greenlet to address CVE-2016-5180 and gevent/gevent#477.",
-            "cve": "CVE-2016-5180",
-            "id": "pyup.io-38504",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37640",
+            "id": "pyup.io-44332",
             "specs": [
-                "<1.10.0"
+                "<2.4.0"
             ],
-            "v": "<1.10.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Confidant 1.6.0 updates python-saml to address CVE-2016-1000252.",
-            "cve": "CVE-2016-1000252",
-            "id": "pyup.io-38505",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37641",
+            "id": "pyup.io-44333",
             "specs": [
-                "<1.6.0"
+                "<2.4.0"
             ],
-            "v": "<1.6.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "In confidant 5.0.0, requirements have been updated to resolve some reported security vulnerabilities in a few of the frozen requirements. A library affecting user sessions was upgraded which will cause users to be logged out after upgrade, which means if you're doing a rolling upgrade, that during the upgrade, you may have users that seemingly randomly get logged out. After a finished upgrade, users should only be logged out once, if they're currently logged in.",
-            "cve": "PVE-2021-37471",
-            "id": "pyup.io-37471",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37642",
+            "id": "pyup.io-44334",
             "specs": [
-                "<5.0.0"
+                "<2.4.0"
             ],
-            "v": "<5.0.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Confidant 6.3.0 adds support for keeping track of when credentials should be rotated. It therefore adds three new fields to the Credential model, two of which improve the security (`last_decrypted_date` and `last_rotation_date`). The former explicitly stores when someone viewed a credential. Certain credentials can potentially be highly vulnerable and could benefit from being rotated the moment the credential pair is viewed. The latter stores when a credential was last rotated. Some credentials might need to periodically be rotated for security purposes.",
-            "cve": "PVE-2021-38560",
-            "id": "pyup.io-38560",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37643",
+            "id": "pyup.io-44335",
             "specs": [
-                "<6.3.0"
+                "<2.4.0"
             ],
-            "v": "<6.3.0"
-        }
-    ],
-    "confidence": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "confidence before 0.4 has a security vulnerability from using ``yaml.load``. \r\nconfidence >=0.4 now uses ``yaml.safe_load``",
-            "cve": "PVE-2021-36308",
-            "id": "pyup.io-36308",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37644",
+            "id": "pyup.io-44336",
             "specs": [
-                "<0.4"
+                "<2.4.0"
             ],
-            "v": "<0.4"
-        }
-    ],
-    "confire": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from \"~/.confire.yaml\" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.",
-            "cve": "CVE-2017-16763",
-            "id": "pyup.io-35721",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37645",
+            "id": "pyup.io-44337",
             "specs": [
-                "<=0.2.0"
+                "<2.4.0"
             ],
-            "v": "<=0.2.0"
-        }
-    ],
-    "confluent-kafka": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Confluent-kafka 1.1.0 securely clears the private key data from memory after last use.",
-            "cve": "PVE-2021-37508",
-            "id": "pyup.io-37508",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37639",
+            "id": "pyup.io-44331",
             "specs": [
-                "<1.1.0"
+                "<2.4.0"
             ],
-            "v": "<1.1.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Confluent-kafka 1.3.0 includes a fix for CVE-2019-17543: LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"",
-            "cve": "CVE-2019-17543",
-            "id": "pyup.io-38072",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37647",
+            "id": "pyup.io-44339",
             "specs": [
-                "<1.3.0"
+                "<2.4.0"
             ],
-            "v": "<1.3.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Confluent-kafka 1.4.0 includes two security issues in the SASL SCRAM protocol handler:\r\n * The client nonce, which is expected to be a random string, was a static string.\r\n * If `sasl.username` and `sasl.password` contained characters that needed escaping, a buffer overflow and heap corruption would occur. This was protected, but too late, by an assertion.",
-            "cve": "PVE-2021-38165",
-            "id": "pyup.io-38165",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37648",
+            "id": "pyup.io-44340",
             "specs": [
-                "<1.4.0"
+                "<2.4.0"
             ],
-            "v": "<1.4.0"
-        }
-    ],
-    "conn-check": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "conn-check 1.0.18 ensures pyOpenSSL is always used instead of the ssl modules, see https://urllib3.readthedocs.org/en/latest/security.htmlpyopenssl.",
-            "cve": "PVE-2021-25669",
-            "id": "pyup.io-25669",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37649",
+            "id": "pyup.io-44341",
             "specs": [
-                "<1.0.18"
+                "<2.4.0"
             ],
-            "v": "<1.0.18"
-        }
-    ],
-    "container-service-extension": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "container-service-extension 1.2.5 adds K8s vulnerability patching",
-            "cve": "PVE-2021-36876",
-            "id": "pyup.io-36876",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37650",
+            "id": "pyup.io-44342",
             "specs": [
-                "<1.2.5"
+                "<2.4.0"
             ],
-            "v": "<1.2.5"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image, or (2) an existing container, to which the attacker previously had write access, that can be attached with docker exec. This occurs because of file-descriptor mishandling, related to /proc/self/exe.",
-            "cve": "CVE-2019-5736",
-            "id": "pyup.io-37100",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37651",
+            "id": "pyup.io-44343",
             "specs": [
-                "<1.2.7"
+                "<2.4.0"
             ],
-            "v": "<1.2.7"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Container-service-extension 2.5.0b1  updates the hardcoded_password_string: false positives and test environment password strings marked not vulnerable.",
-            "cve": "PVE-2021-37529",
-            "id": "pyup.io-37529",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37646",
+            "id": "pyup.io-44338",
             "specs": [
-                "<2.5.0b1"
+                "<2.4.0"
             ],
-            "v": "<2.5.0b1"
-        }
-    ],
-    "contentful": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Contentful 1.11.3 updates 'requests' version due to a vulnerability found in versions '2.19' and below.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36633",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37652",
+            "id": "pyup.io-44344",
             "specs": [
-                "<1.11.3"
+                "<2.4.0"
             ],
-            "v": "<1.11.3"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.",
-            "cve": "CVE-2020-13258",
-            "id": "pyup.io-38314",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37653",
+            "id": "pyup.io-44345",
             "specs": [
-                "<=1.12.3"
+                "<2.4.0"
             ],
-            "v": "<=1.12.3"
-        }
-    ],
-    "contentful-management": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Contentful-management 2.5.0 updates 'requests' version due to a vulnerability found in previous versions.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36599",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37654",
+            "id": "pyup.io-44346",
             "specs": [
-                "<2.5.0"
+                "<2.4.0"
             ],
-            "v": "<2.5.0"
-        }
-    ],
-    "contestms": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "contestms 1.2.0 fixes several security bugs around an unsafe use of isolate. These won't be backported to 1.1, so make sure you update.",
-            "cve": "PVE-2021-34249",
-            "id": "pyup.io-34249",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37655",
+            "id": "pyup.io-44347",
             "specs": [
-                "<1.2.0"
+                "<2.4.0"
             ],
-            "v": "<1.2.0"
-        }
-    ],
-    "cookie-manager": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cookie-manager 1.0.3 bumps dependency versions to fix a security issue.",
-            "cve": "PVE-2021-38106",
-            "id": "pyup.io-38106",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37656",
+            "id": "pyup.io-44348",
             "specs": [
-                "<1.0.3"
+                "<2.4.0"
             ],
-            "v": "<1.0.3"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cookie-manager 1.1.0 bumps Bleach to patch a vulnerability.",
-            "cve": "PVE-2021-38153",
-            "id": "pyup.io-38153",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37657",
+            "id": "pyup.io-44349",
             "specs": [
-                "<1.1.0"
+                "<2.4.0"
             ],
-            "v": "<1.1.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cookie-manager 1.2.1 fixes a security vulnerability discovered and patched in a dependency. See Bleach 3.3.0 <https://github.com/mozilla/bleach/releases/tag/v3.3.0> for further details.",
-            "cve": "PVE-2021-40165",
-            "id": "pyup.io-40165",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37658",
+            "id": "pyup.io-44350",
             "specs": [
-                "<1.2.1"
+                "<2.4.0"
             ],
-            "v": "<1.2.1"
-        }
-    ],
-    "cookiecutter": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cookiecutter 0.1.0 fixes insecure gitlab_token retrieval - see: https://github.com/NathanUrwin/cookiecutter-git/issues/6",
-            "cve": "PVE-2021-34683",
-            "id": "pyup.io-34683",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37659",
+            "id": "pyup.io-44351",
             "specs": [
-                "<0.1.0"
+                "<2.4.0"
             ],
-            "v": "<0.1.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cookiecutter 1.1.0 sets explicitly the list of allowed hosts for security reasons.",
-            "cve": "PVE-2021-37672",
-            "id": "pyup.io-37672",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37660",
+            "id": "pyup.io-44352",
             "specs": [
-                "<1.1.0"
+                "<2.4.0"
             ],
-            "v": "<1.1.0"
-        }
-    ],
-    "coordination-network-toolkit": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.",
-            "cve": "CVE-2021-33503",
-            "id": "pyup.io-40624",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37661",
+            "id": "pyup.io-44353",
             "specs": [
-                "<1.0.2"
+                "<2.4.0"
             ],
-            "v": "<1.0.2"
-        }
-    ],
-    "copyparty": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "The maintainers of Copyparty report that they \"hopefully\" have fixed a bug in version 0.12.3 where malicious POSTs through an nginx reverse-proxy could put the connection in a bad state, causing the next legit request to fail with bad headers",
-            "cve": "PVE-2021-41050",
-            "id": "pyup.io-41050",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37662",
+            "id": "pyup.io-44354",
             "specs": [
-                "<0.12.3"
+                "<2.4.0"
             ],
-            "v": "<0.12.3"
-        }
-    ],
-    "cortex": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "cortex before 0.32.0",
-            "cve": "PVE-2021-40128",
-            "id": "pyup.io-40128",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37663",
+            "id": "pyup.io-44355",
             "specs": [
-                "<0.32.0"
+                "<2.4.0"
             ],
-            "v": "<0.32.0"
-        }
-    ],
-    "cosmos-wfm": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "cosmos-wfm before 2.1.1 is vulnerable to an attack where malicious hackers can run arbitrary code if they have file system (even external mounts!)+network access on the machine running luigid (executed by the user that you run luigid with).",
-            "cve": "PVE-2021-34181",
-            "id": "pyup.io-34181",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37665",
+            "id": "pyup.io-44357",
             "specs": [
-                "<2.1.1"
+                "<2.4.0"
             ],
-            "v": "<2.1.1"
-        }
-    ],
-    "coveralls": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "coveralls 0.1.1 removes repo_token from verbose output for security reasons.",
-            "cve": "PVE-2021-25671",
-            "id": "pyup.io-25671",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37666",
+            "id": "pyup.io-44358",
             "specs": [
-                "<0.1.1"
+                "<2.4.0"
             ],
-            "v": "<0.1.1"
-        }
-    ],
-    "covert": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Covert 0.2.1 ensures that all authentication tokens are unique, also for repeated public keys.\r\nhttps://github.com/covert-encryption/covert/commit/1a40aa80bb9f0401e2eb59d93df5e531c4ec1623",
-            "cve": "PVE-2021-42679",
-            "id": "pyup.io-42679",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37667",
+            "id": "pyup.io-44359",
             "specs": [
-                "<0.2.1"
+                "<2.4.0"
             ],
-            "v": "<0.2.1"
-        }
-    ],
-    "cplay-ng": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "cplay-ng 1.50 fixes insecure /tmp handling.",
-            "cve": "PVE-2021-25672",
-            "id": "pyup.io-25672",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37664",
+            "id": "pyup.io-44356",
             "specs": [
-                "<1.50"
+                "<2.4.0"
             ],
-            "v": "<1.50"
-        }
-    ],
-    "crate-docs-theme": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Crate-docs-theme 0.13.0 updates/removes Bootstrap and jQuery packages (nine vulnerabilities detected).",
-            "cve": "PVE-2021-39529",
-            "id": "pyup.io-39529",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37668",
+            "id": "pyup.io-44360",
             "specs": [
-                "<0.13.0"
+                "<2.4.0"
             ],
-            "v": "<0.13.0"
-        }
-    ],
-    "creavel": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "creavel before 0.11.0 has a unspecified security issue and is vulnerable via unknown vectors.",
-            "cve": "PVE-2021-25673",
-            "id": "pyup.io-25673",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37669",
+            "id": "pyup.io-44361",
             "specs": [
-                "<0.11.0"
+                "<2.4.0"
             ],
-            "v": "<0.11.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "creavel 0.14.0 fixes jinja2 security by using SandboxedEnvironment.",
-            "cve": "PVE-2021-25674",
-            "id": "pyup.io-25674",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37670",
+            "id": "pyup.io-44362",
             "specs": [
-                "<0.14.0"
+                "<2.4.0"
             ],
-            "v": "<0.14.0"
-        }
-    ],
-    "credstash": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Credstash 1.16.0 updates its dependency pyyaml to a version >=4.2b1 to include a security fix.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-37852",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37671",
+            "id": "pyup.io-44363",
             "specs": [
-                "<1.16.0"
+                "<2.4.0"
             ],
-            "v": "<1.16.0"
-        }
-    ],
-    "creopyson": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Creopyson 0.4.2 modifies the pipenv config for the bleach security alert.",
-            "cve": "PVE-2021-37964",
-            "id": "pyup.io-37964",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37673",
+            "id": "pyup.io-44365",
             "specs": [
-                "<0.4.2"
+                "<2.4.0"
             ],
-            "v": "<0.4.2"
-        }
-    ],
-    "cromwell-tools": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cromwell-tools 1.0.0 updates requests to v2.20.0 to avoid security issues.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36659",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37674",
+            "id": "pyup.io-44366",
             "specs": [
-                "<1.0.0"
+                "<2.4.0"
             ],
-            "v": "<1.0.0"
-        }
-    ],
-    "crossbar": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "In crossbar before 0.15.0 if the `allowedOrigins` websocket option was set, the resulting matching was insufficient and would allow more origins than intended.",
-            "cve": "PVE-2021-25675",
-            "id": "pyup.io-25675",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37675",
+            "id": "pyup.io-44367",
             "specs": [
-                "<0.15.0"
+                "<2.4.0"
             ],
-            "v": "<0.15.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "crossbar 0.6.4 fixes a WAMP-CRA timing attack very, very unlikely to be exploitable.",
-            "cve": "PVE-2021-25676",
-            "id": "pyup.io-25676",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37676",
+            "id": "pyup.io-44368",
             "specs": [
-                "<0.6.4"
+                "<2.4.0"
             ],
-            "v": "<0.6.4"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Crossbar 20.12.3 fixes a dependency on Autobahn v20.12.3, which in turn fixes a potential security issue when enabling the Web status page ('enable_webstatus') on WebSocket-WAMP listening transports.",
-            "cve": "PVE-2021-39329",
-            "id": "pyup.io-39329",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37677",
+            "id": "pyup.io-44369",
             "specs": [
-                "<20.12.3"
+                "<2.4.0"
             ],
-            "v": "<20.12.3"
-        }
-    ],
-    "croud": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Croud 0.3.0 includes a fix for CVE-2017-18342, an arbitrary code execution vulnerability in yaml.load().\r\nhttps://github.com/crate/croud/commit/821f2ba47285f5b5ad3e2e2782c44f867da931ee",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-42353",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37678",
+            "id": "pyup.io-44370",
             "specs": [
-                "<0.3.0"
+                "<2.4.0"
             ],
-            "v": "<0.3.0"
-        }
-    ],
-    "crypt": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "crypt  is a package affected by pytosquatting: http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/",
-            "cve": "PVE-2021-34981",
-            "id": "pyup.io-34981",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37679",
+            "id": "pyup.io-44371",
             "specs": [
-                ">0",
-                "<0"
+                "<2.4.0"
             ],
-            "v": ">0,<0"
-        }
-    ],
-    "cryptacular": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.",
-            "cve": "CVE-2011-2483",
-            "id": "pyup.io-42230",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37680",
+            "id": "pyup.io-44372",
             "specs": [
-                "<1.2"
+                "<2.4.0"
             ],
-            "v": "<1.2"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.",
-            "cve": "PVE-2021-25677",
-            "id": "pyup.io-25677",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37681",
+            "id": "pyup.io-44373",
             "specs": [
-                "<1.2"
+                "<2.4.0"
             ],
-            "v": "<1.2"
-        }
-    ],
-    "crypto-candlesticks": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Crypto-candlesticks 0.1.5 fixes a vulnerability in the 'jinja2' dependency.",
-            "cve": "PVE-2021-39697",
-            "id": "pyup.io-39697",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37682",
+            "id": "pyup.io-44374",
             "specs": [
-                "<0.1.5"
+                "<2.4.0"
             ],
-            "v": "<0.1.5"
-        }
-    ],
-    "cryptography": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "cryptography 0.9.1 fixes a double free in the OpenSSL backend when using DSA  to verify signatures. Note that this only affects PyPy 2.6.0 and (presently unreleased) CFFI versions greater than 1.1.0.",
-            "cve": "PVE-2021-25678",
-            "id": "pyup.io-25678",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37683",
+            "id": "pyup.io-44375",
             "specs": [
-                "<0.9.1"
+                "<2.4.0"
             ],
-            "v": "<0.9.1"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "The OpenSSL backend prior to 1.0.2 made extensive use  of assertions to check response codes where our tests could not trigger a  failure.  However, when Python is run with ``-O`` these asserts are optimized  away.  If a user ran Python with this flag and got an invalid response code  this could result in undefined behavior or worse. Accordingly, all response  checks from the OpenSSL backend have been converted from ``assert``  to a true function call. Credit **Emilia K\u00e4sper (Google Security Team)**  for the report.",
-            "cve": "PVE-2021-25679",
-            "id": "pyup.io-25679",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37672",
+            "id": "pyup.io-44364",
             "specs": [
-                "<1.0.2"
+                "<2.4.0"
             ],
-            "v": "<1.0.2"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.",
-            "cve": "CVE-2016-9243",
-            "id": "pyup.io-25680",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37684",
+            "id": "pyup.io-44376",
             "specs": [
-                "<1.5.3"
+                "<2.4.0"
             ],
-            "v": "<1.5.3"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cryptography 3.3 no longer allows loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing.",
-            "cve": "PVE-2021-39252",
-            "id": "pyup.io-39252",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37685",
+            "id": "pyup.io-44377",
             "specs": [
-                "<3.3"
+                "<2.4.0"
             ],
-            "v": "<3.3"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. See: CVE-2020-36242.",
-            "cve": "CVE-2020-36242",
-            "id": "pyup.io-39606",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37686",
+            "id": "pyup.io-44378",
             "specs": [
-                "<3.3.2"
+                "<2.4.0"
             ],
-            "v": "<3.3.2"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cryptography 3.2 was released with the warning that its maintainers became aware of a Bleichenbacher vulnerability that they were only partly able to mitigate. See: CVE-2020-25659.",
-            "cve": "CVE-2020-25659",
-            "id": "pyup.io-38932",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37687",
+            "id": "pyup.io-44379",
             "specs": [
-                "<=3.2"
+                "<2.4.0"
             ],
-            "v": "<=3.2"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage. See: CVE-2018-10903.",
-            "cve": "CVE-2018-10903",
-            "id": "pyup.io-36351",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37688",
+            "id": "pyup.io-44380",
             "specs": [
-                ">=1.9.0,<2.3"
+                "<2.4.0"
             ],
-            "v": ">=1.9.0,<2.3"
-        }
-    ],
-    "cryptography-vectors": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "cryptography-vectors 0.9.1 fixes a double free in the OpenSSL backend when using DSA to verify signatures. Note that this only affects PyPy 2.6.0 and (presently  unreleased) CFFI versions greater than 1.1.0.",
-            "cve": "PVE-2021-25681",
-            "id": "pyup.io-25681",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37689",
+            "id": "pyup.io-44381",
             "specs": [
-                "<0.9.1"
+                "<2.4.0"
             ],
-            "v": "<0.9.1"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "The OpenSSL backend prior to 1.0.2 made extensive use  of assertions to check response codes where our tests could not trigger a  failure.  However, when Python is run with ``-O`` these asserts are optimized  away.  If a user ran Python with this flag and got an invalid response code  this could result in undefined behavior or worse. Accordingly, all response  checks from the OpenSSL backend have been converted from ``assert``  to a true function call. Credit **Emilia K\u00e4sper (Google Security Team)**  for the report.",
-            "cve": "PVE-2021-25682",
-            "id": "pyup.io-25682",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37690",
+            "id": "pyup.io-44382",
             "specs": [
-                "<1.0.2"
+                "<2.4.0"
             ],
-            "v": "<1.0.2"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.",
-            "cve": "CVE-2016-9243",
-            "id": "pyup.io-25683",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-37691",
+            "id": "pyup.io-44383",
             "specs": [
-                "<1.5.3"
+                "<2.4.0"
             ],
-            "v": "<1.5.3"
-        }
-    ],
-    "cssutils": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "In cssutils before 0.9.6a2 comments added by ``cssutils.resolveImports`` only use the import rules' href and not the absolute href of the referenced sheets anymore (might have been a possible security hole when showing a full local path to a sheet in a combined but not minified sheet)",
-            "cve": "PVE-2021-25684",
-            "id": "pyup.io-25684",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2019-20838",
+            "id": "pyup.io-41298",
             "specs": [
-                "<0.9.6a2"
+                "<2.4.0"
             ],
-            "v": "<0.9.6a2"
-        }
-    ],
-    "cstar": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cstar 0.5.0 fixes a security problem in a dependency (spotify). See: <https://github.com/spotify/cstar/pull/8>.",
-            "cve": "PVE-2021-39224",
-            "id": "pyup.io-39224",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-13790",
+            "id": "pyup.io-44174",
             "specs": [
-                "<0.5.0"
+                "<2.4.0"
             ],
-            "v": "<0.5.0"
-        }
-    ],
-    "cumin": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.",
-            "cve": "CVE-2012-1575",
-            "id": "pyup.io-35357",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-14155",
+            "id": "pyup.io-44175",
             "specs": [
-                "<r5238"
+                "<2.4.0"
             ],
-            "v": "<r5238"
-        }
-    ],
-    "cupy": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "`cupy.load` in cupy 7.0.0b2 specifies `allow_pickle=False` by default to follow the security fix made in NumPy 1.16.3 (see https://github.com/numpy/numpy/pull/13359 and https://github.com/cupy/cupy/pull/2290). Most users should not be affected by this change; users loading `ndarray` serialized using pickle may need to explicitly specify `allow_pickle=True`.",
-            "cve": "PVE-2021-37395",
-            "id": "pyup.io-37395",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15190",
+            "id": "pyup.io-44176",
             "specs": [
-                "<7.0.0b2"
+                "<2.4.0"
             ],
-            "v": "<7.0.0b2"
-        }
-    ],
-    "cutty": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Cutty 0.14.0 updates its dependency 'babel' to v2.9.1 to include a security fix.",
-            "cve": "CVE-2021-42771",
-            "id": "pyup.io-42219",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15191",
+            "id": "pyup.io-44177",
             "specs": [
-                "<0.14.0"
+                "<2.4.0"
             ],
-            "v": "<0.14.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Cutty version 0.3.0 updates its dependency \"actions/cache\" to v2.1.5 to include a security fix.\r\nhttps://github.com/cjolowicz/cutty/commit/427fc30d81d7ade397004f92719ffd121b4a4c28",
-            "cve": "CVE-2020-15228",
-            "id": "pyup.io-41993",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15192",
+            "id": "pyup.io-44178",
             "specs": [
-                "<0.3.0"
+                "<2.4.0"
             ],
-            "v": "<0.3.0"
-        }
-    ],
-    "dact": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dact 1.1.1 includes a few security patches.",
-            "cve": "PVE-2021-39403",
-            "id": "pyup.io-39403",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15193",
+            "id": "pyup.io-44179",
             "specs": [
-                "<1.1.1"
+                "<2.4.0"
             ],
-            "v": "<1.1.1"
-        }
-    ],
-    "dash": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dash 1.20.0 starts to validate callback request 'outputs' vs. 'output' to avoid a perceived security issue.",
-            "cve": "PVE-2021-40183",
-            "id": "pyup.io-40183",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15194",
+            "id": "pyup.io-44180",
             "specs": [
-                "<1.20.0"
+                "<2.4.0"
             ],
-            "v": "<1.20.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Dash 1.21.0 updates its dependency 'Plotly.js' to v2.2.1 to include a security fix.",
-            "cve": "PVE-2021-40962",
-            "id": "pyup.io-40962",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15195",
+            "id": "pyup.io-44181",
             "specs": [
-                "<1.21.0"
+                "<2.4.0"
             ],
-            "v": "<1.21.0"
-        }
-    ],
-    "dash-bio": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dash-bio 0.5.1 fixes an abandoned resource vulnerability with CircosJS fork.",
-            "cve": "PVE-2021-39411",
-            "id": "pyup.io-39411",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15196",
+            "id": "pyup.io-44182",
             "specs": [
-                "<0.5.1"
+                "<2.4.0"
             ],
-            "v": "<0.5.1"
-        }
-    ],
-    "dash-io": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dash-io 0.0.1.post1 removes the 'Pickle' library for security reason.",
-            "cve": "PVE-2021-40961",
-            "id": "pyup.io-40961",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15197",
+            "id": "pyup.io-44183",
             "specs": [
-                "<0.0.1.post1"
+                "<2.4.0"
             ],
-            "v": "<0.0.1.post1"
-        }
-    ],
-    "dash-table": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dash-table 4.7.0 sanitizes table \"id\" for stylesheet injection.\r\nhttps://github.com/plotly/dash-table/pull/766",
-            "cve": "PVE-2021-41222",
-            "id": "pyup.io-41222",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15198",
+            "id": "pyup.io-44184",
             "specs": [
-                "<4.7.0"
+                "<2.4.0"
             ],
-            "v": "<4.7.0"
-        }
-    ],
-    "dask": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dask 2021.10.0 includes a fix for CVE-2021-42343: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters starting with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.",
-            "cve": "CVE-2021-42343",
-            "id": "pyup.io-42345",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15199",
+            "id": "pyup.io-44185",
             "specs": [
-                "<2021.10.0"
+                "<2.4.0"
             ],
-            "v": "<2021.10.0"
-        }
-    ],
-    "database-sanitizer": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Database-sanitizer version 1.1.0 includes a security patch for the function 'from_file' in 'database_sanitizer/config.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/andersinno/python-database-sanitizer/commit/ace4e0823d7b81c6f3bf683eb97193b36cc6c040#diff-6090be0559642595d2ff5ff2e9d265c6d152a75ef98845380436d0f06e0b3c19",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41314",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15200",
+            "id": "pyup.io-44186",
             "specs": [
-                "<1.1.0"
+                "<2.4.0"
             ],
-            "v": "<1.1.0"
-        }
-    ],
-    "datacube": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "datacube 1.6.2 is a Patch release to build a new Docker container, to resolve an upstream security bug.",
-            "cve": "PVE-2021-36835",
-            "id": "pyup.io-36835",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15201",
+            "id": "pyup.io-44187",
             "specs": [
-                "<1.6.2"
+                "<2.4.0"
             ],
-            "v": "<1.6.2"
-        }
-    ],
-    "datacube-ows": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datacube-ows 1.8.8 removes the CodeCov token from ows to fix a security breach.\r\nhttps://github.com/opendatacube/datacube-ows/pull/585",
-            "cve": "PVE-2021-42558",
-            "id": "pyup.io-42558",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15202",
+            "id": "pyup.io-44188",
             "specs": [
-                "<1.8.8"
+                "<2.4.0"
             ],
-            "v": "<1.8.8"
-        }
-    ],
-    "datagristle": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datagristle 0.1.7 bumps versions on dependent modules to eliminate vulnerabilities.",
-            "cve": "PVE-2021-40237",
-            "id": "pyup.io-40237",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15203",
+            "id": "pyup.io-44189",
             "specs": [
-                "<0.1.7"
+                "<2.4.0"
             ],
-            "v": "<0.1.7"
-        }
-    ],
-    "datajob": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datajob 0.6.0 includes a patch to shell out commands more securely.",
-            "cve": "PVE-2021-40144",
-            "id": "pyup.io-40144",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15204",
+            "id": "pyup.io-44190",
             "specs": [
-                "<0.6.0"
+                "<2.4.0"
             ],
-            "v": "<0.6.0"
-        }
-    ],
-    "datasette": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datasette 0.29.1 fixes a bug where static mounts used relative paths, which could lead to traversal exploits.\r\nhttps://github.com/simonw/datasette/commit/82889507cafa4b823e89af90b6674fd76653fb86",
-            "cve": "PVE-2021-42226",
-            "id": "pyup.io-42226",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15205",
+            "id": "pyup.io-44191",
             "specs": [
-                "<0.29.1"
+                "<2.4.0"
             ],
-            "v": "<0.29.1"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Datasette 0.44 adds CSRF protection for /-/messages tool and writable canned queries.\r\nhttps://github.com/simonw/datasette/issues/793",
-            "cve": "PVE-2021-42225",
-            "id": "pyup.io-42225",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15206",
+            "id": "pyup.io-44192",
             "specs": [
-                "<0.44"
+                "<2.4.0"
             ],
-            "v": "<0.44"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Datasette 0.46 contains a security fix related to authenticated writable canned queries. CSRF tokens were incorrectly included in read-only canned query forms, which could allow them to be leaked to a sophisticated attacker.",
-            "cve": "PVE-2021-38671",
-            "id": "pyup.io-38671",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15207",
+            "id": "pyup.io-44193",
             "specs": [
-                "<0.46"
+                "<2.4.0"
             ],
-            "v": "<0.46"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Datasette 0.55 starts to use Python 3.7.10 in official Docker image, applying the latest security fix.",
-            "cve": "PVE-2021-40541",
-            "id": "pyup.io-40541",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15208",
+            "id": "pyup.io-44194",
             "specs": [
-                "<0.55"
+                "<2.4.0"
             ],
-            "v": "<0.55"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Datasette 0.56.1 fixes a reflected cross-site scripting security hole with the '?_trace=1' feature. You should upgrade to this version, or to the 'Datasette' 0.57, as soon as possible.",
-            "cve": "PVE-2021-40619",
-            "id": "pyup.io-40619",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15209",
+            "id": "pyup.io-44195",
             "specs": [
-                "<0.56.1"
+                "<2.4.0"
             ],
-            "v": "<0.56.1"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.",
-            "cve": "CVE-2021-32670",
-            "id": "pyup.io-42314",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15210",
+            "id": "pyup.io-44196",
             "specs": [
-                "<0.57"
+                "<2.4.0"
             ],
-            "v": "<0.57"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Datasette 0.57 fixes a reflected cross-site scripting security hole with the '?_trace=1' feature. You should upgrade to this version, or to the 'Datasette' 0.56.1, as soon as possible.",
-            "cve": "PVE-2021-40618",
-            "id": "pyup.io-40618",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15211",
+            "id": "pyup.io-44197",
             "specs": [
-                "<0.57"
+                "<2.4.0"
             ],
-            "v": "<0.57"
-        }
-    ],
-    "datasette-auth-passwords": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datasette-auth-passwords 0.4.1 now depends on the 'datasette' >=0.56.1, to avoid a security vulnerability.",
-            "cve": "PVE-2021-40620",
-            "id": "pyup.io-40620",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15212",
+            "id": "pyup.io-44198",
             "specs": [
-                "<0.4.1"
+                "<2.4.0"
             ],
-            "v": "<0.4.1"
-        }
-    ],
-    "datasette-css-properties": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datasette-css-properties 0.2 makes the '.css' pages send the 'x-content-type-options: nosniff' header to protect against browsers incorrectly rendering the CSS as HTML which could be an XSS security hole.\r\nhttps://github.com/simonw/datasette-css-properties/commit/faf181430667af0e4f4954163fefcc32e8fdbd9c",
-            "cve": "PVE-2021-39422",
-            "id": "pyup.io-39422",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15213",
+            "id": "pyup.io-44199",
             "specs": [
-                "<0.2"
+                "<2.4.0"
             ],
-            "v": "<0.2"
-        }
-    ],
-    "datasette-graphql": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Satasette-graphql before 1.2 included a plugin that could expose schema details of databases that should not be visible, though not their actual row content. See: <https://github.com/simonw/datasette-graphql/security/advisories/GHSA-74hv-qjjq-h7g5>.",
-            "cve": "PVE-2021-39174",
-            "id": "pyup.io-39174",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15214",
+            "id": "pyup.io-44200",
             "specs": [
-                "<1.2"
+                "<2.4.0"
             ],
-            "v": "<1.2"
-        }
-    ],
-    "datasette-indieauth": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datasette-indieauth before 1.1 trusts the \"me\" field returned by the authorization server without verifying it.",
-            "cve": "PVE-2021-39164",
-            "id": "pyup.io-39164",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15265",
+            "id": "pyup.io-44201",
             "specs": [
-                "<1.1"
+                "<2.4.0"
             ],
-            "v": "<1.1"
-        }
-    ],
-    "datasette-insert": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datasette-insert 0.6 is locked down by default. This plugin no longer defaults to allowing all, reducing the risk that someone may deploy it without sufficient security.",
-            "cve": "PVE-2021-38644",
-            "id": "pyup.io-38644",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15266",
+            "id": "pyup.io-44202",
             "specs": [
-                "<0.6"
+                "<2.4.0"
             ],
-            "v": "<0.6"
-        }
-    ],
-    "datasette-query-links": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datasette-query-links 0.1.1 fixes an XSS security bug.\r\nhttps://github.com/simonw/datasette-query-links/issues/2",
-            "cve": "PVE-2021-41092",
-            "id": "pyup.io-41092",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-15358",
+            "id": "pyup.io-44203",
             "specs": [
-                "<0.1.1"
+                "<2.4.0"
             ],
-            "v": "<0.1.1"
-        }
-    ],
-    "datasette-seaborn": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "The maintainers or the datasette-seaborn package acknowledge that version 0.1a0 is buggy and probably not secure.",
-            "cve": "PVE-2021-38782",
-            "id": "pyup.io-38782",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-26266",
+            "id": "pyup.io-44204",
             "specs": [
-                "==0.1a0"
+                "<2.4.0"
             ],
-            "v": "==0.1a0"
-        }
-    ],
-    "dateable-chronos": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dateable-chronos 0.8 includes a  fix for a XSS vulnerability in the get_view_day method.\r\nhttps://github.com/collective/dateable.chronos/commit/fd91af02186e61b3e161a2f620da9422eb228c71",
-            "cve": "PVE-2021-35988",
-            "id": "pyup.io-35988",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-26267",
+            "id": "pyup.io-44205",
             "specs": [
-                "<0.8"
+                "<2.4.0"
             ],
-            "v": "<0.8"
-        }
-    ],
-    "dateable.chronos": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dateable.chronos 0.8 includes a  fix for a XSS vulnerability in the get_view_day method.\r\nhttps://github.com/collective/dateable.chronos/commit/fd91af02186e61b3e161a2f620da9422eb228c71",
-            "cve": "PVE-2021-25685",
-            "id": "pyup.io-25685",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-26268",
+            "id": "pyup.io-44206",
             "specs": [
-                "<0.8"
+                "<2.4.0"
             ],
-            "v": "<0.8"
-        }
-    ],
-    "datera-cinder": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datera-cinder 2018.10.30.0 updates the required 'requests' version to >=2.20.0 to include a fix for CVE-2018-18074.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-37204",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-26270",
+            "id": "pyup.io-44207",
             "specs": [
-                "<2018.10.30.0"
+                "<2.4.0"
             ],
-            "v": "<2018.10.30.0"
-        }
-    ],
-    "datumaro": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Datumaro version 0.1.10 includes a fix for an arbitrary code execution vulnerability: Cifar implementation is based on pickle, which can run arbitrary code on unpickling.\r\nhttps://github.com/openvinotoolkit/datumaro/issues/327",
-            "cve": "PVE-2021-41817",
-            "id": "pyup.io-41817",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-26271",
+            "id": "pyup.io-44208",
             "specs": [
-                "<0.1.10"
+                "<2.4.0"
             ],
-            "v": "<0.1.10"
-        }
-    ],
-    "dawgie": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dawgie 1.2.3 includes a vulnerability fix.",
-            "cve": "PVE-2021-40122",
-            "id": "pyup.io-40122",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-8169",
+            "id": "pyup.io-44209",
             "specs": [
-                "<1.2.3"
+                "<2.4.0"
             ],
-            "v": "<1.2.3"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Dawgie 1.2.9 adds clean methods to limit malicious code.",
-            "cve": "PVE-2021-40121",
-            "id": "pyup.io-40121",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-8177",
+            "id": "pyup.io-44210",
             "specs": [
-                "<1.2.9"
+                "<2.4.0"
             ],
-            "v": "<1.2.9"
-        }
-    ],
-    "dbcat": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dbcat 0.3.1 updates its dependency 'cryptography' to v3.4.4 to include a security fix.",
-            "cve": "CVE-2020-36242",
-            "id": "pyup.io-42696",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-8231",
+            "id": "pyup.io-44211",
             "specs": [
-                "<0.3.1"
+                "<2.4.0"
             ],
-            "v": "<0.3.1"
-        }
-    ],
-    "dbt-core": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dbt-core 0.20.0rc1 updates its dependency 'jinja2' to v2.11.3 to include a security fix.",
-            "cve": "CVE-2020-28493",
-            "id": "pyup.io-42229",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-8286",
+            "id": "pyup.io-44213",
             "specs": [
-                "<0.20.0rc1"
+                "<2.4.0"
             ],
-            "v": "<0.20.0rc1"
-        }
-    ],
-    "dbtos3": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Dbtos3 version 0.0.2a0 includes security fixes related to dependencies' updates.",
-            "cve": "PVE-2021-42017",
-            "id": "pyup.io-42017",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2020-8284",
+            "id": "pyup.io-44212",
             "specs": [
-                "<0.0.2a0"
+                "<2.4.0"
             ],
-            "v": "<0.0.2a0"
-        }
-    ],
-    "ddtrace": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "ddtrace  0.11.0 removes the `sql.query` tag from SQL spans, so that the content is properly obfuscated in the Agent. This security fix is required to prevent wrong data collection of reported SQL queries. This issue impacts only MySQL integrations and NOT `psycopg2` or `sqlalchemy` while using the PostgreSQL driver.",
-            "cve": "PVE-2021-35790",
-            "id": "pyup.io-35790",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-22876",
+            "id": "pyup.io-44214",
             "specs": [
-                "<0.11.0"
+                "<2.4.0"
             ],
-            "v": "<0.11.0"
-        }
-    ],
-    "debianized-jupyterhub": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "debianized-jupyterhub 0.9.51 updates to release 0.9.5 + NB 5.7.7 (fix for Open Redirect vulnerability)",
-            "cve": "PVE-2021-37002",
-            "id": "pyup.io-37002",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-22897",
+            "id": "pyup.io-44215",
             "specs": [
-                "<0.9.51"
+                "<2.4.0"
             ],
-            "v": "<0.9.51"
-        }
-    ],
-    "debops": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Debops 0.8.0 installs upstream NodeSource APT packages by default. This is due to `no security support in Debian Stable`__, therefore an upstream packages should be considered more secure. The upstream NodeJS packages include a compatible NPM release, therefore it won't be separately installed from GitHub.",
-            "cve": "PVE-2021-36371",
-            "id": "pyup.io-36371",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-22898",
+            "id": "pyup.io-44216",
             "specs": [
-                "<0.8.0"
+                "<2.4.0"
             ],
-            "v": "<0.8.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Debops 1.0.0:\r\n\r\n- The :command:`lxc-prepare-ssh` script will read the public SSH keys from specific files (``root`` key file, and the ``$SUDO_USER`` key file) and will not accept any custom files to read from, to avoid possible security issues. Each public SSH key listed in the key files is validated before being added to the container's ``root`` account.\r\n\r\n- The :command:`lxc-new-unprivileged` script will similarly not accept any custom files as initial LXC container configuration to fix any potential security holes when used via :command:`sudo`. The default LXC configuration file used by the script can be configured in :file:`/etc/lxc/lxc.conf` configuration file.\r\n\r\n- (:ref:`debops.php` role) New APT signing keys` have been created for his Debian APT repository with PHP packages, due to security concerns. The :ref:`debops.php` role will remove the old APT GPG key and add the new one automatically. See: <https://www.patreon.com/posts/dpa-new-signing-25451165>.",
-            "cve": "PVE-2021-37159",
-            "id": "pyup.io-37159",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-22901",
+            "id": "pyup.io-44217",
             "specs": [
-                "<1.0.0"
+                "<2.4.0"
             ],
-            "v": "<1.0.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "The :command:\"lxc-prepare-ssh\" script in debops 1.1.0 will no longer install SSH keys from the LXC host \"root\" account on the LXC container \"root\" account. That could cause confusion and unintended security breaches when other services (for example backup scripts or remote command execution tools) install their own SSH keys on the LXC host and they are subsequently copied inside of the LXC containers created on that host.\r\nhttps://github.com/debops/debops/commit/6dd088e413ef4c5dac23d94bb338ae19398985e2",
-            "cve": "PVE-2021-37404",
-            "id": "pyup.io-37404",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29513",
+            "id": "pyup.io-44218",
             "specs": [
-                "<1.1.0"
+                "<2.4.0"
             ],
-            "v": "<1.1.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Debops 1.2.0 includes a security patch for CVE-2019-11043: In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.",
-            "cve": "CVE-2019-11043",
-            "id": "pyup.io-37733",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29514",
+            "id": "pyup.io-44219",
             "specs": [
-                "<1.2.0"
+                "<2.4.0"
             ],
-            "v": "<1.2.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Debops 1.7.0 includes a change in its RoundCube configuration. RoundCube will use the user login and password credentials to authenticate to the SMTP (submission) service before sending e-mail messages. This allows the SMTP server to check the message details, block mail with forged sender address, etc. The default configuration uses encrypted connections to the IMAP and SMTP services to ensure confidentiality and security.",
-            "cve": "PVE-2021-37732",
-            "id": "pyup.io-37732",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29515",
+            "id": "pyup.io-44220",
             "specs": [
-                "<1.7.0"
+                "<2.4.0"
             ],
-            "v": "<1.7.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "RoundCube in debops 2.0.0 uses the user login and password credentials to authenticate to the SMTP (submission) service before sending e-mail messages. This allows the SMTP server to check the message details, block mail with forged sender address, etc. The default configuration uses encrypted connections to the IMAP and SMTP services to ensure confidentiality and security.",
-            "cve": "PVE-2021-26403",
-            "id": "pyup.io-26403",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29516",
+            "id": "pyup.io-44221",
             "specs": [
-                "<2.0.0"
+                "<2.4.0"
             ],
-            "v": "<2.0.0"
-        }
-    ],
-    "decaptcha": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "decaptcha 1.0.0 includes a patch for security vulnerability: pin pillow>=6.2.0",
-            "cve": "PVE-2021-37892",
-            "id": "pyup.io-37892",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29517",
+            "id": "pyup.io-44222",
             "specs": [
-                "<1.0.0"
+                "<2.4.0"
             ],
-            "v": "<1.0.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "decaptcha 1.0.1 includes a patch for security vulnerability: tensorflow==1.15.0",
-            "cve": "PVE-2021-37891",
-            "id": "pyup.io-37891",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29518",
+            "id": "pyup.io-44223",
             "specs": [
-                "<1.0.1"
+                "<2.4.0"
             ],
-            "v": "<1.0.1"
-        }
-    ],
-    "deeposlandia": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Deeposlandia 0.6 updates its dependencies, especially `Tensorflow`, due to vulnerability issues.",
-            "cve": "PVE-2021-38133",
-            "id": "pyup.io-38133",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29519",
+            "id": "pyup.io-44224",
             "specs": [
-                "<0.6"
+                "<2.4.0"
             ],
-            "v": "<0.6"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Deeposlandia 0.6.2 updates pillow to 7.1.1 to fix a moderate-severity vulnerability in pillow <6.2.2.",
-            "cve": "PVE-2021-38285",
-            "id": "pyup.io-38285",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29520",
+            "id": "pyup.io-44225",
             "specs": [
-                "<0.6.2"
+                "<2.4.0"
             ],
-            "v": "<0.6.2"
-        }
-    ],
-    "definitions": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution.",
-            "cve": "CVE-2018-20325",
-            "id": "pyup.io-36752",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29521",
+            "id": "pyup.io-44226",
             "specs": [
-                "<=0.2.0"
+                "<2.4.0"
             ],
-            "v": "<=0.2.0"
-        }
-    ],
-    "defusedexpat": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.",
-            "cve": "CVE-2013-1664",
-            "id": "pyup.io-33054",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29522",
+            "id": "pyup.io-44227",
             "specs": [
-                "<0.3"
+                "<2.4.0"
             ],
-            "v": "<0.3"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.",
-            "cve": "CVE-2013-1665",
-            "id": "pyup.io-33055",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29523",
+            "id": "pyup.io-44228",
             "specs": [
-                "<0.3"
+                "<2.4.0"
             ],
-            "v": "<0.3"
-        }
-    ],
-    "defusedxml": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.",
-            "cve": "CVE-2013-1664",
-            "id": "pyup.io-33056",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29524",
+            "id": "pyup.io-44229",
             "specs": [
-                "<0.4"
+                "<2.4.0"
             ],
-            "v": "<0.4"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.",
-            "cve": "CVE-2013-1665",
-            "id": "pyup.io-33057",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29525",
+            "id": "pyup.io-44230",
             "specs": [
-                "<0.4"
+                "<2.4.0"
             ],
-            "v": "<0.4"
-        }
-    ],
-    "deis": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Deis 1.4.0 disables SSLv3 in its router module to handle CVE-2014-3566.\r\nhttps://github.com/deis/deis/commit/93bb0fd9cb33e5b8bdcfdc277d15d61b938a88d4",
-            "cve": "CVE-2014-3566",
-            "id": "pyup.io-25691",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29526",
+            "id": "pyup.io-44231",
             "specs": [
-                "<1.4.0"
+                "<2.4.0"
             ],
-            "v": "<1.4.0"
-        }
-    ],
-    "deltachat": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Deltachat 1.0.0b17 fixes SQL/injection malformed Chat-Group-Name breakage.",
-            "cve": "PVE-2021-40086",
-            "id": "pyup.io-40086",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29527",
+            "id": "pyup.io-44232",
             "specs": [
-                "<1.0.0b17"
+                "<2.4.0"
             ],
-            "v": "<1.0.0b17"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "deltachat 1.0.0beta.2 has several security fixes",
-            "cve": "PVE-2021-37922",
-            "id": "pyup.io-37922",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29528",
+            "id": "pyup.io-44233",
             "specs": [
-                "<1.0.0beta.2"
+                "<2.4.0"
             ],
-            "v": "<1.0.0beta.2"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Deltachat 1.51.0 improves and harden secure join feature.",
-            "cve": "PVE-2021-40084",
-            "id": "pyup.io-40084",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29529",
+            "id": "pyup.io-44234",
             "specs": [
-                "<1.51.0"
+                "<2.4.0"
             ],
-            "v": "<1.51.0"
-        }
-    ],
-    "deluge": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Deluge 2.0.0 updates SSL/TLS Protocol parameters for better security.",
-            "cve": "PVE-2021-37155",
-            "id": "pyup.io-37155",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29530",
+            "id": "pyup.io-44235",
             "specs": [
-                "<2.0.0"
+                "<2.4.0"
             ],
-            "v": "<2.0.0"
-        }
-    ],
-    "descarteslabs": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Descarteslabs 1.8.1 upgrades the 'requests' dependency (>=2.25.1, <3) to fix a security issue.",
-            "cve": "PVE-2021-40827",
-            "id": "pyup.io-40827",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29531",
+            "id": "pyup.io-44236",
             "specs": [
-                "<1.8.1"
+                "<2.4.0"
             ],
-            "v": "<1.8.1"
-        }
-    ],
-    "destringcare": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Destringcare 0.0.4 removes its dependency 'pycrypto' to fix security vulnerabilities.",
-            "cve": "CVE-2013-7459",
-            "id": "pyup.io-37228",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29532",
+            "id": "pyup.io-44237",
             "specs": [
-                "<0.0.4"
+                "<2.4.0"
             ],
-            "v": "<0.0.4"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Destringcare 0.0.4 removes its dependency 'pycrypto' to fix security vulnerabilities.",
-            "cve": "CVE-2018-6594",
-            "id": "pyup.io-42205",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29533",
+            "id": "pyup.io-44238",
             "specs": [
-                "<0.0.4"
+                "<2.4.0"
             ],
-            "v": "<0.0.4"
-        }
-    ],
-    "determined": [
+            "v": "<2.4.0"
+        },
         {
-            "advisory": "Determined 0.12.12rc0 upgrades lodash to fix a vulnerability.",
-            "cve": "PVE-2021-38656",
-            "id": "pyup.io-38656",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29535",
+            "id": "pyup.io-44240",
             "specs": [
-                "<0.12.12rc0"
+                "<2.4.0"
             ],
-            "v": "<0.12.12rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.12.7 resolves new node security vulnerabilities (fd34fec) and updates link to support secure blank targets (d1146d3).",
-            "cve": "PVE-2021-38415",
-            "id": "pyup.io-38415",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29536",
+            "id": "pyup.io-44241",
             "specs": [
-                "<0.12.7"
+                "<2.4.0"
             ],
-            "v": "<0.12.7"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.14.0 updates the 'storybook' dependency to resolve a GitHub security vulnerability for 'highlight.js'.",
-            "cve": "PVE-2021-39625",
-            "id": "pyup.io-39625",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29537",
+            "id": "pyup.io-44242",
             "specs": [
-                "<0.14.0"
+                "<2.4.0"
             ],
-            "v": "<0.14.0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.16.0.dev0 upgrades the 'ws' dependency to patch a security vulnerability.",
-            "cve": "PVE-2021-40670",
-            "id": "pyup.io-40670",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29538",
+            "id": "pyup.io-44243",
             "specs": [
-                "<0.16.0.dev0"
+                "<2.4.0"
             ],
-            "v": "<0.16.0.dev0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.16.4 includes a fix to prevent log html injection via unicode.",
-            "cve": "PVE-2021-41255",
-            "id": "pyup.io-41255",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29539",
+            "id": "pyup.io-44244",
             "specs": [
-                "<0.16.4"
+                "<2.4.0"
             ],
-            "v": "<0.16.4"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.0rc0 switches from debian:10.3-slim to ubuntu:20.04 and unattended-upgrades, to get better security upgrades.\r\nhttps://github.com/determined-ai/determined/pull/2914",
-            "cve": "PVE-2021-42148",
-            "id": "pyup.io-42148",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29540",
+            "id": "pyup.io-44245",
             "specs": [
-                "<0.17.0rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.0rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41196",
-            "id": "pyup.io-43315",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29541",
+            "id": "pyup.io-44246",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41203",
-            "id": "pyup.io-43316",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29542",
+            "id": "pyup.io-44247",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41200",
-            "id": "pyup.io-43317",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29543",
+            "id": "pyup.io-44248",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41214",
-            "id": "pyup.io-43319",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29544",
+            "id": "pyup.io-44249",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41219",
-            "id": "pyup.io-43320",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29545",
+            "id": "pyup.io-44250",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41225",
-            "id": "pyup.io-43321",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29546",
+            "id": "pyup.io-44251",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41209",
-            "id": "pyup.io-43325",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29547",
+            "id": "pyup.io-44252",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41204",
-            "id": "pyup.io-43327",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29548",
+            "id": "pyup.io-44253",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41218",
-            "id": "pyup.io-43331",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29549",
+            "id": "pyup.io-44254",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<2.4.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41216",
-            "id": "pyup.io-43332",
+            "advisory": "Chia 2.4.0 updates Tensorflow to v2.4.3 to include security fixes.",
+            "cve": "CVE-2021-29534",
+            "id": "pyup.io-44239",
             "specs": [
-                "<0.17.4rc0"
+                "<2.4.0"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<2.4.0"
+        }
+    ],
+    "chia-blockchain": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41215",
-            "id": "pyup.io-43333",
+            "advisory": "Consideration of the new consensus algorithm in chia-blockchain version 1.0beta19 resulted in a much higher security level against all attacks.",
+            "cve": "PVE-2021-39444",
+            "id": "pyup.io-39444",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0b19"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.0b19"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41206",
-            "id": "pyup.io-43335",
+            "advisory": "Chia-blockchain 1.0b27 updates its GUI to handle CVE-2020-28477.\r\nhttps://github.com/Chia-Network/chia-blockchain/commit/45c85c0030a9b07bd3d07fc0e7f7afc540b53009",
+            "cve": "CVE-2020-28477",
+            "id": "pyup.io-42341",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0b27"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.0b27"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41212",
-            "id": "pyup.io-43337",
+            "advisory": "Chia-blockchain 1.0b27 updates its dependency 'pyyaml' to v5.4.1 to include a security fix.",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-42367",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0b27"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.0b27"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41210",
-            "id": "pyup.io-43338",
+            "advisory": "Chia-blockchain 1.0beta10 includes various vulnerability fixes.",
+            "cve": "PVE-2021-38700",
+            "id": "pyup.io-38700",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0beta10"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.0beta10"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41207",
-            "id": "pyup.io-43339",
+            "advisory": "Node peers in chia-blockchain 1.0beta14 are gossiped between nodes with logic to keep connected nodes on disparate internet networks to partially protect from eclipse attacks.",
+            "cve": "PVE-2021-38844",
+            "id": "pyup.io-38844",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0beta14"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.0beta14"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41197",
-            "id": "pyup.io-43342",
+            "advisory": "Chia-blockchain 1.0beta8 removes the ability to pass in sk_seed to plotting. This increases security.",
+            "cve": "PVE-2021-38582",
+            "id": "pyup.io-38582",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0beta8"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.0beta8"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41195",
-            "id": "pyup.io-43343",
+            "advisory": "The Windows BLS Signature library in chia-blockchain 1.0beta9 uses libsodium for additional security. Additionally, this version includes various fixes for various node dependency security vulnerabilities.",
+            "cve": "PVE-2021-38629",
+            "id": "pyup.io-38629",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0beta9"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.0beta9"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41198",
-            "id": "pyup.io-43344",
+            "advisory": "Chia-blockchain 1.0rc5 updates the 'aiohttp' dependency to 3.7.4 to address a low severity [security issue] (CVE-2021-21330).",
+            "cve": "CVE-2021-21330",
+            "id": "pyup.io-39672",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0rc5"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.0rc5"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41217",
-            "id": "pyup.io-43318",
+            "advisory": "Chia-blockchain 1.0rc6 improves defense against many DDoS attacks by rate limiting for the full node. It also changes 'chia keys add' command to take secret words a prompt on the command line or stdin instead of command line arguments.",
+            "cve": "PVE-2021-39703",
+            "id": "pyup.io-39703",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0rc6"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<1.0rc6"
+        }
+    ],
+    "chiavdf": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41226",
-            "id": "pyup.io-43322",
+            "advisory": "Chiavdf 1.0 includes a fix to prevent potential grinding attacks.",
+            "cve": "PVE-2021-39691",
+            "id": "pyup.io-39691",
             "specs": [
-                "<0.17.4rc0"
+                "<1.0"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<1.0"
+        }
+    ],
+    "choochoo": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41227",
-            "id": "pyup.io-43323",
+            "advisory": "Choochoo 0.40.0 updates its dependency React to the latest version \"hopefully\" removing several npm vulnerabilities.",
+            "cve": "PVE-2021-41273",
+            "id": "pyup.io-41273",
             "specs": [
-                "<0.17.4rc0"
+                "<0.40.0"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<0.40.0"
+        }
+    ],
+    "ciftify": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41221",
-            "id": "pyup.io-43324",
+            "advisory": "Ciftify version 2.3.3 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/edickie/ciftify/commit/7ac66dc2efc78bae272a0e1e713c81756f780969#diff-d55ace9e33dabdeba89768d93ae8fe97cf6d2ba4936fc5ab472b7bf749270b63",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41312",
             "specs": [
-                "<0.17.4rc0"
+                "<2.3.3"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<2.3.3"
+        }
+    ],
+    "cinder": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41213",
-            "id": "pyup.io-43326",
+            "advisory": "Cinder versions 14.1.0, 15.2.0 and 16.1.0 include a fix for CVE-2020-10755: An insecure-credentials flaw was found in all openstack-cinder versions before openstack-cinder 14.1.0, all openstack-cinder 15.x.x versions before openstack-cinder 15.2.0 and all openstack-cinder 16.x.x versions before openstack-cinder 16.1.0. When using openstack-cinder with the Dell EMC ScaleIO or VxFlex OS backend storage driver, credentials for the entire backend are exposed in the 'connection_info' element in all Block Storage v3 Attachments API calls containing that element. This flaw enables an end-user to create a volume, make an API call to show the attachment detail information, and retrieve a username and password that may be used to connect to another user's volume. Additionally, these credentials are valid for the ScaleIO or VxFlex OS Management API.\r\nhttps://wiki.openstack.org/wiki/OSSN/OSSN-0086",
+            "cve": "CVE-2020-10755",
+            "id": "pyup.io-38408",
             "specs": [
-                "<0.17.4rc0"
+                "<14.1.0",
+                ">=15.0.0.0rc1,<15.2.0",
+                ">=16.0.0.0b1,<16.1.0"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<14.1.0,>=15.0.0.0rc1,<15.2.0,>=16.0.0.0b1,<16.1.0"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41228",
-            "id": "pyup.io-43328",
-            "specs": [
-                "<0.17.4rc0"
-            ],
-            "v": "<0.17.4rc0"
-        },
-        {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41222",
-            "id": "pyup.io-43329",
+            "advisory": "The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.",
+            "cve": "CVE-2013-1068",
+            "id": "pyup.io-25651",
             "specs": [
-                "<0.17.4rc0"
+                "<2013.2.3"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<2013.2.3"
+        }
+    ],
+    "cipher.googlepam": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41224",
-            "id": "pyup.io-43330",
+            "advisory": "In cipher.googlepam before 1.5.1 do not use the same cache key for all users. Previously when one user logged in successfully, others could not log in using their own passwords -- but the first user could now use her password to log in as anyone else.",
+            "cve": "PVE-2021-25652",
+            "id": "pyup.io-25652",
             "specs": [
-                "<0.17.4rc0"
+                "<1.5.1"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<1.5.1"
+        }
+    ],
+    "circuit-maintenance-parser": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41208",
-            "id": "pyup.io-43334",
+            "advisory": "Circuit-maintenance-parser 1.1.0 updates the 'Pydantic' dependency version due to security advisory (GHSA-5jqp-qgf6-3pvh).",
+            "cve": "PVE-2021-41103",
+            "id": "pyup.io-41103",
             "specs": [
-                "<0.17.4rc0"
+                "<1.1.0"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<1.1.0"
+        }
+    ],
+    "circup": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41205",
-            "id": "pyup.io-43336",
+            "advisory": "Circup 0.0.6 includes an unspecified security fix.",
+            "cve": "PVE-2021-37936",
+            "id": "pyup.io-37936",
             "specs": [
-                "<0.17.4rc0"
+                "<0.0.6"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<0.0.6"
+        }
+    ],
+    "ck": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41202",
-            "id": "pyup.io-43340",
+            "advisory": "Ck 1.7.1 fixes a server vulnerability (action with ; can run various CMD commands).",
+            "cve": "PVE-2021-40221",
+            "id": "pyup.io-40221",
             "specs": [
-                "<0.17.4rc0"
+                "<1.7.1"
             ],
-            "v": "<0.17.4rc0"
-        },
+            "v": "<1.7.1"
+        }
+    ],
+    "ckan": [
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41201",
-            "id": "pyup.io-43341",
+            "advisory": "ckan 1.5.1 fixes a security issue affecting CKAN v1.5 and before.",
+            "cve": "PVE-2021-34556",
+            "id": "pyup.io-34556",
             "specs": [
-                "<0.17.4rc0"
+                "<1.5.1"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.5.1"
         },
         {
-            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
-            "cve": "CVE-2021-41199",
-            "id": "pyup.io-42944",
+            "advisory": "Ckan 1.8.1 fixes a possible XSS vulnerability on html input.\r\nhttps://github.com/ckan/ckan/pull/703",
+            "cve": "PVE-2021-34558",
+            "id": "pyup.io-34558",
             "specs": [
-                "<0.17.4rc0"
+                "<1.8.1"
             ],
-            "v": "<0.17.4rc0"
+            "v": "<1.8.1"
         },
         {
-            "advisory": "Determined 0.17.5 updates its dependency 'swagger-ui' to v4.1.0 to include a fix for a XSS vulnerability.\r\nhttps://github.com/determined-ai/determined/pull/3234",
-            "cve": "PVE-2021-43348",
-            "id": "pyup.io-43348",
-            "specs": [
-                "<0.17.5"
-            ],
-            "v": "<0.17.5"
-        }
-    ],
-    "devito": [
-        {
-            "advisory": "Devito version 4.3-beta includes a fix to handle ARM processors vulnerabilities.\r\nhttps://github.com/devitocodes/devito/pull/1515",
-            "cve": "PVE-2021-42102",
-            "id": "pyup.io-42102",
+            "advisory": "Ckan 2.6.9 fixes a code injection issue in the autocomplete module. See <https://github.com/ckan/ckan/pull/5064>.",
+            "cve": "PVE-2021-39613",
+            "id": "pyup.io-39613",
             "specs": [
-                "<4.3-beta"
+                "<2.6.9"
             ],
-            "v": "<4.3-beta"
+            "v": "<2.6.9"
         }
     ],
-    "devpi-ldap": [
+    "clam": [
         {
-            "advisory": "Devpi-ldap version 2.0.0 includes a security patch for the function 'init' in 'devpi_ldap/main.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\n https://github.com/devpi/devpi-ldap/commit/8da2b3c1ed44e8223ce006a3737dc6a8446e945d#diff-ecbfd22333fa5942c9fe7a999189222d1ca71d72a1a89d7a1f55d559671eb200",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41316",
+            "advisory": "clam 0.9.10 contains security fixes, better protection against possible code injection.",
+            "cve": "PVE-2021-25653",
+            "id": "pyup.io-25653",
             "specs": [
-                "<2.0.0"
+                "<0.9.10"
             ],
-            "v": "<2.0.0"
-        }
-    ],
-    "diffpriv": [
+            "v": "<0.9.10"
+        },
         {
-            "advisory": "Diffpriv 1.0.0rc1 includes a security fix: with the 'diff' and 'enc' modules, parameters were stored in Python memory, and never removed. This commit deletes these parameters and helps prevent attackers from gaining access to these parameters, which can help them gain access to the original text and/or data.",
-            "cve": "PVE-2021-40539",
-            "id": "pyup.io-40539",
+            "advisory": "Clam 0.9.11 fixes a RCE vulnerability in its dispatcher.\r\nhttps://github.com/proycon/clam/commit/f89ba22a3b74f0b86ce9d8190ce28b6da7331813",
+            "cve": "PVE-2021-25654",
+            "id": "pyup.io-25654",
             "specs": [
-                "<1.0.0rc1"
+                "<0.9.11"
             ],
-            "v": "<1.0.0rc1"
+            "v": "<0.9.11"
         }
     ],
-    "digitalmarketplace-utils": [
+    "clearsilver": [
         {
-            "advisory": "Digitalmarketplace-utils versions before v22.0.0 included vulnerabilities where untrusted input might result in susceptibility to a cross-site scripting (XSS) exploit.\r\nhttps://github.com/Crown-Commercial-Service/digitalmarketplace-utils/pull/286",
-            "cve": "PVE-2021-39653",
-            "id": "pyup.io-39653",
+            "advisory": "Format string vulnerability in the p_cgi_error function in python/neo_cgi.c in the Python CGI Kit (neo_cgi) module for Clearsilver 0.10.5 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format string specifiers that are not properly handled when creating CGI error messages using the cgi_error API function.",
+            "cve": "CVE-2011-4357",
+            "id": "pyup.io-25655",
             "specs": [
-                "<22.0.0"
+                "<0.10.5"
             ],
-            "v": "<22.0.0"
+            "v": "<0.10.5"
         }
     ],
-    "dirac": [
+    "cliboa": [
         {
-            "advisory": "The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).",
-            "cve": "CVE-2021-23841",
-            "id": "pyup.io-42328",
+            "advisory": "Cliboa 2.0.0b0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
+            "cve": "CVE-2021-33503",
+            "id": "pyup.io-42681",
             "specs": [
-                "<2.1"
+                "<2.0.0b0"
             ],
-            "v": "<2.1"
+            "v": "<2.0.0b0"
         }
     ],
-    "directory-client-core": [
+    "clickhouse-driver": [
         {
-            "advisory": "Directory-client-core 5.1.1 upgrades a vulnerable Django version to Django 1.11.22.",
-            "cve": "PVE-2021-38689",
-            "id": "pyup.io-38689",
+            "advisory": "clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted server response, due to a buffer overflow.",
+            "cve": "CVE-2020-26759",
+            "id": "pyup.io-42290",
             "specs": [
-                "<5.1.1"
+                "<0.1.5"
             ],
-            "v": "<5.1.1"
+            "v": "<0.1.5"
         }
     ],
-    "directory-components": [
-        {
-            "advisory": "Directory-components 25.0.1 includes an update to fix the lodash vulnerability.",
-            "cve": "PVE-2021-37298",
-            "id": "pyup.io-37298",
-            "specs": [
-                "<25.0.1"
-            ],
-            "v": "<25.0.1"
-        },
+    "client-sdk-python": [
         {
-            "advisory": "The `django_language` and `country` cookies in directory-components 33.0.0 set as secure and http-only.",
-            "cve": "PVE-2021-37475",
-            "id": "pyup.io-37475",
+            "advisory": "Client-sdk-python 4.7.0 upgrades eth-hash to 0.2.0 with pycryptodome 3.6.6 which resolves a vulnerability.",
+            "cve": "PVE-2021-37584",
+            "id": "pyup.io-37584",
             "specs": [
-                "<33.0.0"
+                "<4.7.0"
             ],
-            "v": "<33.0.0"
+            "v": "<4.7.0"
         }
     ],
-    "dirsearch": [
+    "clipster-desktop": [
         {
-            "advisory": "Dirsearch 0.4.2 fixes a CSV Injection vulnerability. See also: <https://www.exploit-db.com/exploits/49370>.",
-            "cve": "PVE-2021-40799",
-            "id": "pyup.io-40799",
+            "advisory": "Clipster-desktop 0.3.0 includes various improvements to make the host more secure:\r\n* All clips are encrypted locally in the client before transmission to the server. \r\n* Server host can't decrypt clips: it never learns the users' password.\r\n* Password is not stored in cleartext anymore. Instead password hash is used.",
+            "cve": "PVE-2021-39388",
+            "id": "pyup.io-39388",
             "specs": [
-                "<0.4.2"
+                "<0.3.0"
             ],
-            "v": "<0.4.2"
+            "v": "<0.3.0"
         }
     ],
-    "discogs-client": [
+    "cliquery": [
         {
-            "advisory": "Discogs-client 2.2.2 updates dependency 'requests' to v2.20.0 to resolve security vulnerabilities.",
-            "cve": "CVE-2014-1829",
-            "id": "pyup.io-42494",
+            "advisory": "Cliquery 1.10.0 updates the 'lxml' dependency from 4.6.2 to 4.6.3 to fix a security vulnerability.",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-40090",
             "specs": [
-                "<2.2.2"
+                "<1.10.0"
             ],
-            "v": "<2.2.2"
+            "v": "<1.10.0"
         },
         {
-            "advisory": "Discogs-client 2.2.2 updates dependency 'PyYAML' to v4.2b1 to resolve security vulnerabilities.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-42495",
+            "advisory": "Cliquery 1.9.3 updates the 'lxml' dependency from 4.3.0 to 4.6.2 to include security fixes.",
+            "cve": "CVE-2020-27783",
+            "id": "pyup.io-39423",
             "specs": [
-                "<2.2.2"
+                "<1.9.3"
             ],
-            "v": "<2.2.2"
+            "v": "<1.9.3"
         },
         {
-            "advisory": "Discogs-client 2.2.2 updates dependency 'requests' to v2.20.0 to resolve security vulnerabilities.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36787",
+            "advisory": "Cliquery 1.9.3 updates the 'lxml' dependency from 4.3.0 to 4.6.2 to include security fixes.",
+            "cve": "PVE-2021-39195",
+            "id": "pyup.io-43643",
             "specs": [
-                "<2.2.2"
+                "<1.9.3"
             ],
-            "v": "<2.2.2"
+            "v": "<1.9.3"
         }
     ],
-    "discord-ext-slash": [
+    "cloudmarker": [
         {
-            "advisory": "For some extra security, Discord-ext-slash 0.2.3 looks up commands by both their name and guild ID if their command ID fails to return any results (it returns a warning with 'SlashWarning' both times, and returns an error if still no command is found.)",
-            "cve": "PVE-2021-39641",
-            "id": "pyup.io-39641",
+            "advisory": "Cloudmarker 0.0.5 adds the `FirewallRuleEvent` plugin to detect insecure firewall rules.",
+            "cve": "PVE-2021-37138",
+            "id": "pyup.io-37138",
             "specs": [
-                "<0.2.3"
+                "<0.0.5"
             ],
-            "v": "<0.2.3"
+            "v": "<0.0.5"
         }
     ],
-    "discordpie": [
+    "cloudwatch-to-graphite": [
         {
-            "advisory": "Discordpie 0.5.1 includes a security patch. No details are given.",
-            "cve": "PVE-2021-38343",
-            "id": "pyup.io-38343",
+            "advisory": "Cloudwatch-to-graphite version 0.11.0 includes a security patch for the function 'get_config' in 'leadbutt.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/crccheck/cloudwatch-to-graphite/commit/5875100c54a54a9c90cf2fe782cc3df147d32053#diff-ddb0922eafb2fa54199e50bb13de6178b1755e780387144df032f9e26512f15e",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41313",
             "specs": [
-                "<0.5.1"
+                "<0.11.0"
             ],
-            "v": "<0.5.1"
+            "v": "<0.11.0"
         }
     ],
-    "dispatch": [
+    "cloverly-python-module": [
         {
-            "advisory": "Dispatch 1.3.16 updates its dependency 'Django' to v3.1.8 to include security fixes.",
-            "cve": "CVE-2021-28658",
-            "id": "pyup.io-43729",
+            "advisory": "Cloverly-python-module 0.2.0 adds a clear session function for security purposes.",
+            "cve": "PVE-2021-41085",
+            "id": "pyup.io-41085",
             "specs": [
-                "<1.3.16"
+                "<0.2.0"
             ],
-            "v": "<1.3.16"
-        },
+            "v": "<0.2.0"
+        }
+    ],
+    "cmdlr": [
         {
-            "advisory": "Dispatch 1.3.16 updates its dependency 'Django' to v3.1.8 to include security fixes.",
-            "cve": "CVE-2021-23336",
-            "id": "pyup.io-40402",
+            "advisory": "cmdlr 4.1.0 resists malicious js attack in `run_in_nodejs`",
+            "cve": "PVE-2021-36854",
+            "id": "pyup.io-36854",
             "specs": [
-                "<1.3.16"
+                "<4.1.0"
             ],
-            "v": "<1.3.16"
+            "v": "<4.1.0"
         }
     ],
-    "divina": [
+    "cmsplugin-filer": [
         {
-            "advisory": "Divina 0.1 adds a security group with ssh access enabled on partitioning EC2.",
-            "cve": "PVE-2021-41294",
-            "id": "pyup.io-41294",
+            "advisory": "Cmsplugin-filer 0.10.2 includes a fix for a XSS vulnerability in 'firstof' in folder template. Users with Django>1.7 aren't affected.\r\nhttps://github.com/divio/cmsplugin-filer/pull/185",
+            "cve": "PVE-2021-25656",
+            "id": "pyup.io-25656",
             "specs": [
-                "<0.1"
+                "<0.10.2"
             ],
-            "v": "<0.1"
-        },
+            "v": "<0.10.2"
+        }
+    ],
+    "cnx-publishing": [
         {
-            "advisory": "Divina 2021.8.1 adds a security group with ssh access enabled for the EC2 partitioning.",
-            "cve": "PVE-2021-41237",
-            "id": "pyup.io-41237",
+            "advisory": "Cnx-publishing 0.17.6 updates its dependency 'urllib3' to v1.25.8 to include a security fix.",
+            "cve": "CVE-2020-7212",
+            "id": "pyup.io-38128",
             "specs": [
-                "<2021.8.1"
+                "<0.17.6"
             ],
-            "v": "<2021.8.1"
+            "v": "<0.17.6"
         }
     ],
-    "diycrate": [
+    "coapthon": [
         {
-            "advisory": "Diycrate version 0.2.11.0 includes a security patch for the function 'oauth_dance' in 'diycrate/oauth_utils.py'. It contained requests calls with verify=False, disabling SSL certificate checks.\r\nhttps://github.com/jheld/diycrate/commit/40e51a586f16da215a3ff8096cfa64e23b0fa5cb#diff-7772b99d74abcfaa2bf013c9a4647b2b42cec23f84a79a5d4de0ef6973720971",
-            "cve": "PVE-2021-41317",
-            "id": "pyup.io-41317",
+            "advisory": "The Serialize.deserialize() method in CoAPthon 3.1, 4.0.0, 4.0.1, and 4.0.2 mishandles certain exceptions, leading to a denial of service in applications that use this library (e.g., the standard CoAP server, CoAP client, CoAP reverse proxy, example collect CoAP server and client) when they receive crafted CoAP messages.",
+            "cve": "CVE-2018-12680",
+            "id": "pyup.io-42251",
             "specs": [
-                "<0.2.11.0"
+                "==3.1",
+                "==4.0.0",
+                "==4.0.1",
+                "==4.0.2"
             ],
-            "v": "<0.2.11.0"
+            "v": "==3.1,==4.0.0,==4.0.1,==4.0.2"
         }
     ],
-    "djangae": [
+    "cobbler": [
         {
-            "advisory": "djangae before 0.9.4 uses Django 1.7 which is no longer supported (EOL, with known security issues).",
-            "cve": "PVE-2021-25693",
-            "id": "pyup.io-25693",
+            "advisory": "Cobbler has local privilege escalation via the use of insecure location for PYTHON_EGG_CACHE. No information was provided about fixes or affected versions. See: CVE-2011-4954.",
+            "cve": "CVE-2011-4954",
+            "id": "pyup.io-37739",
             "specs": [
-                "<0.9.4"
+                ">0"
             ],
-            "v": "<0.9.4"
+            "v": ">0"
         }
     ],
-    "django": [
+    "cockroachdb": [
         {
-            "advisory": "The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected \"static media files,\" which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.",
-            "cve": "CVE-2009-2659",
-            "id": "pyup.io-25694",
+            "advisory": "cockroachdb 0.3.2 updated urllib3 to remove security vulnerability.",
+            "cve": "PVE-2021-37264",
+            "id": "pyup.io-37264",
             "specs": [
-                "<1.0"
+                "<0.3.2"
             ],
-            "v": "<1.0"
-        },
+            "v": "<0.3.2"
+        }
+    ],
+    "codalab": [
         {
-            "advisory": "Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.",
-            "cve": "CVE-2009-3695",
-            "id": "pyup.io-25695",
+            "advisory": "codalab before 0.2.33 was using a version of gunicorn that had security vulnerabilities.",
+            "cve": "PVE-2021-36386",
+            "id": "pyup.io-36386",
             "specs": [
-                "<1.0.4",
-                ">=1.1,<1.1.1"
+                "<0.2.33"
             ],
-            "v": "<1.0.4,>=1.1,<1.1.1"
+            "v": "<0.2.33"
         },
         {
-            "advisory": "The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.",
-            "cve": "CVE-2010-4535",
-            "id": "pyup.io-33059",
+            "advisory": "Codalab 0.5.12 fixes a vulnerability. No description of the vulnerability was included.",
+            "cve": "PVE-2021-38927",
+            "id": "pyup.io-38927",
             "specs": [
-                "<1.1.3",
-                ">=1.2,<1.2.4"
+                "<0.5.12"
             ],
-            "v": "<1.1.3,>=1.2,<1.2.4"
+            "v": "<0.5.12"
         },
         {
-            "advisory": "The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.",
-            "cve": "CVE-2010-4534",
-            "id": "pyup.io-33058",
+            "advisory": "Codalab 0.5.33 includes a fix for some front-end vulnerabilities (with `npm audit fix`).",
+            "cve": "PVE-2021-39434",
+            "id": "pyup.io-39434",
             "specs": [
-                "<1.1.3",
-                ">=1.2,<1.2.4"
+                "<0.5.33"
             ],
-            "v": "<1.1.3,>=1.2,<1.2.4"
-        },
+            "v": "<0.5.33"
+        }
+    ],
+    "codecov": [
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.",
-            "cve": "CVE-2011-0697",
-            "id": "pyup.io-33061",
+            "advisory": "Codecov 2.0.16 fixes a reported command injection vulnerability.",
+            "cve": "PVE-2021-37934",
+            "id": "pyup.io-37934",
             "specs": [
-                "<1.1.4"
+                "<2.0.16"
             ],
-            "v": "<1.1.4"
+            "v": "<2.0.16"
         },
         {
-            "advisory": "Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a \"combination of browser plugins and redirects,\" a related issue to CVE-2011-0447.",
-            "cve": "CVE-2011-0696",
-            "id": "pyup.io-33060",
+            "advisory": "Codecov 2.0.17 fixes a reported command injection vulnerability.",
+            "cve": "PVE-2021-38075",
+            "id": "pyup.io-38075",
             "specs": [
-                "<1.1.4",
-                ">=1.2,<1.2.5"
+                "<2.0.17"
             ],
-            "v": "<1.1.4,>=1.2,<1.2.5"
-        },
+            "v": "<2.0.17"
+        }
+    ],
+    "codeforcesapipy": [
         {
-            "advisory": "Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.",
-            "cve": "CVE-2011-0698",
-            "id": "pyup.io-33062",
+            "advisory": "Codeforcesapipy 2.0.8 updates the 'lxml' dependency to 4.6.3 to resolve security issues.",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-40099",
             "specs": [
-                "<1.1.4",
-                ">=1.2,<1.2.5"
+                "<2.0.8"
             ],
-            "v": "<1.1.4,>=1.2,<1.2.5"
-        },
+            "v": "<2.0.8"
+        }
+    ],
+    "cohen3": [
         {
-            "advisory": "Django 1.11.x before 1.11.19 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.",
-            "cve": "CVE-2019-6975",
-            "id": "pyup.io-36885",
+            "advisory": "Cohen3 version 0.8.3 updates its dependency \"requests\" to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-42040",
             "specs": [
-                "<1.11.19,>=1.11.0"
+                "<0.8.3"
             ],
-            "v": "<1.11.19,>=1.11.0"
+            "v": "<0.8.3"
         },
         {
-            "advisory": "An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.",
-            "cve": "CVE-2019-12781",
-            "id": "pyup.io-37261",
+            "advisory": "Cohen3 version 0.9.1 updates its dependency \"urlib3\" to v1.24.2 to include a security fix.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-42039",
             "specs": [
-                "<1.11.22,>1.11",
-                "<2.1.10,>2.1",
-                "<2.2.3,>2.2"
+                "<0.9.1"
             ],
-            "v": "<1.11.22,>1.11,<2.1.10,>2.1,<2.2.3,>2.2"
-        },
+            "v": "<0.9.1"
+        }
+    ],
+    "coinbasepro": [
         {
-            "advisory": "Django 1.11.22 fixes a security issue in 1.11.21.",
-            "cve": "PVE-2021-37259",
-            "id": "pyup.io-37259",
+            "advisory": "Coinbasepro 0.1.0 updates requests version to >=2.20.0 to address a security vulnerability.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36975",
             "specs": [
-                "<1.11.22,>1.11.21"
+                "<0.1.0"
             ],
-            "v": "<1.11.22,>1.11.21"
-        },
+            "v": "<0.1.0"
+        }
+    ],
+    "coincurve": [
         {
-            "advisory": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.) See CVE-2019-19844.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-37771",
+            "advisory": "coincurve before 8.0.0 does not support the new GitHub and PyPI security requirements. \r\nBinary wheels on macOS for Python 3.5 now uses Homebrew Python for compilation due to new security requirements.",
+            "cve": "PVE-2021-36299",
+            "id": "pyup.io-36299",
             "specs": [
-                "<1.11.27",
-                ">=2.0a1,<2.2.9",
-                ">=3.0a1,<3.0.1"
+                "<8.0.0"
             ],
-            "v": "<1.11.27,>=2.0a1,<2.2.9,>=3.0a1,<3.0.1"
-        },
+            "v": "<8.0.0"
+        }
+    ],
+    "coinstac": [
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.",
-            "cve": "CVE-2010-3082",
-            "id": "pyup.io-25701",
+            "advisory": "Coinstac 5.2.1 includes various security fixes and package updates.",
+            "cve": "PVE-2021-40091",
+            "id": "pyup.io-40091",
             "specs": [
-                "<1.2.2"
+                "<5.2.1"
             ],
-            "v": "<1.2.2"
-        },
+            "v": "<5.2.1"
+        }
+    ],
+    "colander": [
         {
-            "advisory": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.",
-            "cve": "CVE-2011-4138",
-            "id": "pyup.io-33065",
+            "advisory": "colander 1.7.0 - The URL validator regex has been updated to no longer be vulnerable to a\r\n  catastrophic backtracking that would have led to an infinite loop.",
+            "cve": "PVE-2021-36856",
+            "id": "pyup.io-36856",
             "specs": [
-                "<1.2.7",
-                ">=1.3,<1.3.1"
+                "<1.7.0"
             ],
-            "v": "<1.2.7,>=1.3,<1.3.1"
+            "v": "<1.7.0"
         },
         {
-            "advisory": "The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.",
-            "cve": "CVE-2011-4140",
-            "id": "pyup.io-33066",
+            "advisory": "In Pylons Colander through 1.6, the URL validator allows an attacker to potentially cause an infinite loop thereby causing a denial of service via an unclosed parenthesis.",
+            "cve": "CVE-2017-18361",
+            "id": "pyup.io-42247",
             "specs": [
-                "<1.2.7",
-                ">=1.3,<1.3.1"
+                "<=1.6"
             ],
-            "v": "<1.2.7,>=1.3,<1.3.1"
-        },
+            "v": "<=1.6"
+        }
+    ],
+    "collective-contact-core": [
         {
-            "advisory": "django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.",
-            "cve": "CVE-2011-4136",
-            "id": "pyup.io-33063",
+            "advisory": "collective-contact-core before 1.10",
+            "cve": "PVE-2021-36089",
+            "id": "pyup.io-36089",
             "specs": [
-                "<1.2.7",
-                ">=1.3,<1.3.1"
+                "<1.10"
             ],
-            "v": "<1.2.7,>=1.3,<1.3.1"
-        },
+            "v": "<1.10"
+        }
+    ],
+    "collective-easyform": [
         {
-            "advisory": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.",
-            "cve": "CVE-2011-4137",
-            "id": "pyup.io-33064",
+            "advisory": "Collective-easyform version 3.0.5 doesn't resolves entities in the modeleditor and removes processing instructions (commit #254).",
+            "cve": "PVE-2021-41911",
+            "id": "pyup.io-41911",
             "specs": [
-                "<1.2.7",
-                ">=1.3,<1.3.1"
+                "<3.0.5"
             ],
-            "v": "<1.2.7,>=1.3,<1.3.1"
-        },
+            "v": "<3.0.5"
+        }
+    ],
+    "collective-indexing": [
         {
-            "advisory": "The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.",
-            "cve": "CVE-2012-3442",
-            "id": "pyup.io-33067",
+            "advisory": "Collective-indexing version 2.1 includes a fix that prevents out-of-sync security indexes on Solr. Now, reindexObjectSecurity operations are handled by the queue.\r\nhttps://github.com/plone/collective.indexing/pull/17",
+            "cve": "PVE-2021-41879",
+            "id": "pyup.io-41879",
             "specs": [
-                "<1.3.2",
-                ">=1.4,<1.4.1"
+                "<2.1"
             ],
-            "v": "<1.3.2,>=1.4,<1.4.1"
-        },
+            "v": "<2.1"
+        }
+    ],
+    "collective-noticeboard": [
         {
-            "advisory": "The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.",
-            "cve": "CVE-2012-3444",
-            "id": "pyup.io-33069",
+            "advisory": "collective-noticeboard before 0.7.1 has a security issue, anonymous users could modify notes positions.",
+            "cve": "PVE-2021-35879",
+            "id": "pyup.io-35879",
             "specs": [
-                "<1.3.2",
-                ">=1.4,<1.4.1"
+                "<0.7.1"
             ],
-            "v": "<1.3.2,>=1.4,<1.4.1"
-        },
+            "v": "<0.7.1"
+        }
+    ],
+    "collective.contact.core": [
         {
-            "advisory": "The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.",
-            "cve": "CVE-2012-3443",
-            "id": "pyup.io-33068",
+            "advisory": "Collective.contact.core 1.10 fixes a security issue related to AddContact. The vulnerability was found in its dependency Plone CMS. See CVE-2016-7138.\r\nhttps://github.com/collective/collective.contact.core/pull/25",
+            "cve": "CVE-2016-7138",
+            "id": "pyup.io-25657",
             "specs": [
-                "<1.3.2",
-                ">=1.4,<1.4.1"
+                "<1.10"
             ],
-            "v": "<1.3.2,>=1.4,<1.4.1"
-        },
+            "v": "<1.10"
+        }
+    ],
+    "collective.documentviewer": [
         {
-            "advisory": "The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.",
-            "cve": "CVE-2012-4520",
-            "id": "pyup.io-25709",
+            "advisory": "Collective.documentviewer 1.5.1 fixes a security issue on file resources permissions.\r\nhttps://github.com/collective/collective.documentviewer/commit/7222b0d30b1976d3f6773553bd6948c39efcbc20",
+            "cve": "PVE-2021-25658",
+            "id": "pyup.io-25658",
             "specs": [
-                "<1.3.4",
-                ">=1.4,<1.4.2"
+                "<1.5.1"
             ],
-            "v": "<1.3.4,>=1.4,<1.4.2"
-        },
+            "v": "<1.5.1"
+        }
+    ],
+    "collective.easyform": [
         {
-            "advisory": "The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI. See: CVE-2014-0483.",
-            "cve": "CVE-2014-0483",
-            "id": "pyup.io-35516",
+            "advisory": "The modeleditor in collective.easyform 3.0.5 no longer resolves entities, and it removes processing instructions. This increases the security.\r\nhttps://github.com/collective/collective.easyform/commit/261ea800fbe3bd650a83b1fe7558ba51bd7d0c9e",
+            "cve": "PVE-2021-39144",
+            "id": "pyup.io-39144",
             "specs": [
-                "<1.4.14",
-                ">=1.5,<1.5.9",
-                ">=1.6,<1.6.6",
-                ">=1.7,<1.7rc3"
+                "<3.0.5"
             ],
-            "v": "<1.4.14,>=1.5,<1.5.9,>=1.6,<1.6.6,>=1.7,<1.7rc3"
-        },
+            "v": "<3.0.5"
+        }
+    ],
+    "collective.js.datatables": [
         {
-            "advisory": "The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a \"\\njavascript:\" URL.",
-            "cve": "CVE-2015-0220",
-            "id": "pyup.io-33071",
+            "advisory": "Collective.js.datatables 4.1.1 updates Datatables to 1.10.11, due to a XSS vulnerability in 1.10.4.",
+            "cve": "CVE-2015-6384",
+            "id": "pyup.io-25659",
             "specs": [
-                "<1.4.18",
-                ">=1.6,<1.6.10",
-                ">=1.7,<1.7.3"
+                "<4.1.1"
             ],
-            "v": "<1.4.18,>=1.6,<1.6.10,>=1.7,<1.7.3"
-        },
+            "v": "<4.1.1"
+        }
+    ],
+    "collective.noticeboard": [
         {
-            "advisory": "The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.",
-            "cve": "CVE-2015-0221",
-            "id": "pyup.io-33072",
+            "advisory": "Collective.noticeboard 0.7.1 fixes a security issue, anonymous users could modify notes positions.",
+            "cve": "PVE-2021-25660",
+            "id": "pyup.io-25660",
             "specs": [
-                "<1.4.18",
-                ">=1.6,<1.6.10",
-                ">=1.7,<1.7.3"
+                "<0.7.1"
             ],
-            "v": "<1.4.18,>=1.6,<1.6.10,>=1.7,<1.7.3"
-        },
+            "v": "<0.7.1"
+        }
+    ],
+    "collective.portlet.twitter": [
         {
-            "advisory": "Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.",
-            "cve": "CVE-2015-0219",
-            "id": "pyup.io-33070",
+            "advisory": "Collective.portlet.twitter 1.0b3 fixes a potential XSS (arbitrary injection) issue by escaping and quoting all attributes being set on the rendered portlet.\r\nhttps://github.com/collective/collective.portlet.twitter/pull/2",
+            "cve": "PVE-2021-25661",
+            "id": "pyup.io-25661",
             "specs": [
-                "<1.4.18",
-                ">=1.7,<1.7.3",
-                ">=1.6,<1.6.10"
+                "<1.0b3"
             ],
-            "v": "<1.4.18,>=1.7,<1.7.3,>=1.6,<1.6.10"
-        },
+            "v": "<1.0b3"
+        }
+    ],
+    "collective.tablepage": [
         {
-            "advisory": "The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.",
-            "cve": "CVE-2016-2512",
-            "id": "pyup.io-33073",
+            "advisory": "collective.tablepage 0.3 fixes a security problem: data inside text cells were transformed to HTML without any check.",
+            "cve": "PVE-2021-25664",
+            "id": "pyup.io-25664",
             "specs": [
-                "<1.8.10",
-                ">=1.9,<1.9.3"
+                "<0.3"
             ],
-            "v": "<1.8.10,>=1.9,<1.9.3"
-        },
+            "v": "<0.3"
+        }
+    ],
+    "collective.xmpp.chat": [
         {
-            "advisory": "The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.",
-            "cve": "CVE-2016-2513",
-            "id": "pyup.io-33074",
+            "advisory": "collective.xmpp.chat 0.3.1 updates convers.js to 0.6.3 which includes an important security fix.",
+            "cve": "PVE-2021-25666",
+            "id": "pyup.io-25666",
             "specs": [
-                "<1.8.10",
-                ">=1.9,<1.9.3"
+                "<0.3.1"
             ],
-            "v": "<1.8.10,>=1.9,<1.9.3"
-        },
+            "v": "<0.3.1"
+        }
+    ],
+    "collins-client": [
         {
-            "advisory": "An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the \"view\" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.",
-            "cve": "CVE-2018-16984",
-            "id": "pyup.io-36522",
+            "advisory": "Collins 2.1.0 has a very important security patch.\r\n\r\nCollins has a feature that allows you to [encrypt certain attributes](http://tumblr.github.io/collins/configuration.htmlfeatures) on every asset.  It also had a permission that restricted which users could read those encrypted tags.  It did NOT have a permission that restricted which users could modify encrypted tags.\r\n\r\n*It is strongly recommended that you upgrade to collins 2.1.0 if you are using the encrypted tags feature, as well as rotate any values stored in encrypted tags.*\r\n\r\nThe severity of this vulnerability depends heavily upon how you use collins in your infrastructure.  If you do not use the encrypted tags feature, you are not vulnerable to this problem.  If you do use the encrypted tags feature, you will need to explore your automation and consider how vulnerable you are.\r\n\r\nIf, for example, your infrastructure has automation that regularly sets the root password on servers to match a value that is in collins, an attacker without the ability to read the current password could set it to a value that they know, wait for the automation to change the password, and then gain root on a server.\r\n\r\nThis change is backwards compatible with collins v2.0.0, though once you upgrade it will stop any writes to encrypted tags by users that have not been granted `feature.canWriteEncryptedTags` permission.  We have also renamed `feature.canSeePasswords` to `feature.canSeeEncryptedTags`, but collins will continue to respect the value of `feature.canSeePasswords` if `feature.canSeeEncryptedTags` is not set.  Once `feature.canSeeEncryptedTags` is set, collins will ignore the value of `feature.canSeePasswords`.",
+            "cve": "PVE-2021-25667",
+            "id": "pyup.io-25667",
             "specs": [
-                "<2.1.2,>=2.1"
+                "<2.1.0"
             ],
-            "v": "<2.1.2,>=2.1"
-        },
+            "v": "<2.1.0"
+        }
+    ],
+    "colonyscanalyser": [
         {
-            "advisory": "django before 2.1.2 fixes a security bug in 2.1.x. \r\nIf an admin user has the change permission to the user model, only part of the\r\npassword hash is displayed in the change form. Admin users with the view (but\r\nnot change) permission to the user model were displayed the entire hash.",
-            "cve": "CVE-2018-16984",
-            "id": "pyup.io-36517",
+            "advisory": "Colonyscanalyser 0.2.0 adds snyk security checks for dependencies.",
+            "cve": "PVE-2021-37635",
+            "id": "pyup.io-37635",
             "specs": [
-                "<2.1.2,>=2.1.0"
+                "<0.2.0"
             ],
-            "v": "<2.1.2,>=2.1.0"
-        },
+            "v": "<0.2.0"
+        }
+    ],
+    "compliance-trestle": [
         {
-            "advisory": "Django 2.1.x before 2.1.6  allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.",
-            "cve": "CVE-2019-6975",
-            "id": "pyup.io-36883",
+            "advisory": "Compliance-trestle 0.15.0 upgrades the 'pydantic' to 1.8.2 for an security issue.",
+            "cve": "PVE-2021-40566",
+            "id": "pyup.io-40566",
             "specs": [
-                "<2.1.6,>=2.1.0"
+                "<0.15.0"
             ],
-            "v": "<2.1.6,>=2.1.0"
+            "v": "<0.15.0"
         },
         {
-            "advisory": "Django versions 2.2.24, 3.1.12, and 3.2.4 include a fix for CVE-2021-33203: Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. See CVE-2021-33203.\r\nhttps://www.djangoproject.com/weblog/2021/jun/02/security-releases/\r\nhttps://docs.djangoproject.com/en/3.2/releases/security/\r\nhttps://groups.google.com/forum/#%21forum/django-announce",
-            "cve": "CVE-2021-33203",
-            "id": "pyup.io-40637",
+            "advisory": "Compliance-trestle 0.26.0 removes user names from logs.\r\nhttps://github.com/IBM/compliance-trestle/commit/4d075b89776552a1f58751674e2056ac7afac3cc",
+            "cve": "PVE-2021-42185",
+            "id": "pyup.io-42185",
             "specs": [
-                "<2.2.24",
-                ">=3.0a1,<3.1.12",
-                ">=3.2a1,<3.2.4"
+                "<0.26.0"
             ],
-            "v": "<2.2.24,>=3.0a1,<3.1.12,>=3.2a1,<3.2.4"
-        },
+            "v": "<0.26.0"
+        }
+    ],
+    "concrete-datastore": [
         {
-            "advisory": "Django versions 2.2.25, 3.1.14 and 3.2.10 include a fix for CVE-2021-44420: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.\r\nhttps://www.djangoproject.com/weblog/2021/dec/07/security-releases/",
-            "cve": "CVE-2021-44420",
-            "id": "pyup.io-43041",
+            "advisory": "Concrete-datastore 1.22.0 adds useful checks to the url_format to avoid template injections.",
+            "cve": "PVE-2021-39449",
+            "id": "pyup.io-39449",
             "specs": [
-                "<2.2.25",
-                ">=3.2a1,<3.2.10",
-                ">=3.1a1,<3.1.14"
+                "<1.22.0"
             ],
-            "v": "<2.2.25,>=3.2a1,<3.2.10,>=3.1a1,<3.1.14"
+            "v": "<1.22.0"
         },
         {
-            "advisory": "django 1.11.15 fixes a phishing security issue in 1.11.14 if the :class:`~django.middleware.common.CommonMiddleware` and the :setting:`APPEND_SLASH` setting are both enabled, and if the project has a URL pattern that accepts any path ending in a slash. See: CVE-2018-14574.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-36359",
+            "advisory": "Concrete-datastore 1.23.0 adds checks on the url_format for reset password view to avoid template injections.",
+            "cve": "PVE-2021-39709",
+            "id": "pyup.io-39709",
             "specs": [
-                "==1.11.14"
+                "<1.23.0"
             ],
-            "v": "==1.11.14"
-        },
+            "v": "<1.23.0"
+        }
+    ],
+    "conference-scheduler-cli": [
         {
-            "advisory": "Django 1.11.21 fixes a security issue in 1.11.20: CVE-2019-12308 (AdminURLFieldWidget XSS).",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-37186",
+            "advisory": "In conference-scheduler-cli, a pickle.load call on imported data allows remote attackers to execute arbitrary code via a crafted .pickle file, as demonstrated by Python code that contains an os.system call.",
+            "cve": "CVE-2018-14572",
+            "id": "pyup.io-36425",
             "specs": [
-                "==1.11.20"
+                "<=0.10.1"
             ],
-            "v": "==1.11.20"
-        },
+            "v": "<=0.10.1"
+        }
+    ],
+    "confidant": [
         {
-            "advisory": "Django 1.11.23 fixes CVE-2019-14235 in 1.11.22.",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-39599",
+            "advisory": "Confidant 1.1.13 includes a security fix. It was discovered when adding tests after a refactor of some of the KMS authentication code that confidant wasn't properly checking the expiration of KMS auth tokens. If tokens were able to be exfiltrated from a service, they could be used indefinitely. Also, any tokens that are expired will now correctly fail to authenticate.",
+            "cve": "PVE-2021-26670",
+            "id": "pyup.io-26670",
             "specs": [
-                "==1.11.22"
+                "<1.1.13"
             ],
-            "v": "==1.11.22"
+            "v": "<1.1.13"
         },
         {
-            "advisory": "Django 1.11.23 fixes CVE-2019-14233 in 1.11.22.",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-39601",
+            "advisory": "confidant 1.1.14 contains a security fix: While preparing for the 1.1 stable release Lyft found a KMS  authentication vulnerability in the unreleased 1.1 branch while performing an  audit of the code. The vulnerability was introduced while adding the scoped auth  key feature (for limiting authentication keys and services to specific AWS  accounts), where the key was not properly checked after decryption. This check is  an additional verification to add additional safety on-top of the IAM policy of  your KMS keys. If IAM policy allows users to use KMS keys without limits on  encryption context, a KMS key that wasn't intended to be used for auth, could be  used for auth.",
+            "cve": "PVE-2021-25668",
+            "id": "pyup.io-25668",
             "specs": [
-                "==1.11.22"
+                "<1.1.14"
             ],
-            "v": "==1.11.22"
+            "v": "<1.1.14"
         },
         {
-            "advisory": "Django 1.11.23 fixes CVE-2019-14234 in 1.11.22.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-39600",
+            "advisory": "Confidant v1.10.0 upgrades gevent and greenlet to address CVE-2016-5180 and gevent/gevent#477.",
+            "cve": "CVE-2016-5180",
+            "id": "pyup.io-38504",
             "specs": [
-                "==1.11.22"
+                "<1.10.0"
             ],
-            "v": "==1.11.22"
+            "v": "<1.10.0"
         },
         {
-            "advisory": "Django 1.11.23 fixes the following security issue in 1.11.22: CVE-2019-14232.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-37326",
+            "advisory": "Confidant 1.6.0 updates python-saml to address CVE-2016-1000252.",
+            "cve": "CVE-2016-1000252",
+            "id": "pyup.io-38505",
             "specs": [
-                "==1.11.22"
+                "<1.6.0"
             ],
-            "v": "==1.11.22"
+            "v": "<1.6.0"
         },
         {
-            "advisory": "Django 1.11.27 fixes CVE-2019-19844 in 1.11.26: potential account hijack via password reset form.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-37663",
+            "advisory": "In confidant 5.0.0, requirements have been updated to resolve some reported security vulnerabilities in a few of the frozen requirements. A library affecting user sessions was upgraded which will cause users to be logged out after upgrade, which means if you're doing a rolling upgrade, that during the upgrade, you may have users that seemingly randomly get logged out. After a finished upgrade, users should only be logged out once, if they're currently logged in.",
+            "cve": "PVE-2021-37471",
+            "id": "pyup.io-37471",
             "specs": [
-                "==1.11.26"
+                "<5.0.0"
             ],
-            "v": "==1.11.26"
+            "v": "<5.0.0"
         },
         {
-            "advisory": "Django 1.11.28 fixes a security issue in 1.11.27. Potential SQL injection via `StringAgg(delimiter)`. See: CVE-2020-7471.",
-            "cve": "CVE-2020-7471",
-            "id": "pyup.io-37817",
+            "advisory": "Confidant 6.3.0 adds support for keeping track of when credentials should be rotated. It therefore adds three new fields to the Credential model, two of which improve the security (`last_decrypted_date` and `last_rotation_date`). The former explicitly stores when someone viewed a credential. Certain credentials can potentially be highly vulnerable and could benefit from being rotated the moment the credential pair is viewed. The latter stores when a credential was last rotated. Some credentials might need to periodically be rotated for security purposes.",
+            "cve": "PVE-2021-38560",
+            "id": "pyup.io-38560",
             "specs": [
-                "==1.11.27"
+                "<6.3.0"
             ],
-            "v": "==1.11.27"
-        },
+            "v": "<6.3.0"
+        }
+    ],
+    "confidence": [
         {
-            "advisory": "django 2.0.8 fixes a security issue and several bugs in 2.0.7 if the :class:`~django.middleware.common.CommonMiddleware` and the\r\n:setting:`APPEND_SLASH` setting are both enabled, and if the project has a\r\nURL pattern that accepts any path ending in a slash. See: CVE-2018-14574.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-36358",
+            "advisory": "confidence before 0.4 has a security vulnerability from using ``yaml.load``. \r\nconfidence >=0.4 now uses ``yaml.safe_load``",
+            "cve": "PVE-2021-36308",
+            "id": "pyup.io-36308",
             "specs": [
-                "==2.0.7"
+                "<0.4"
             ],
-            "v": "==2.0.7"
-        },
+            "v": "<0.4"
+        }
+    ],
+    "confire": [
         {
-            "advisory": "Django 2.1.11 fixes a security issue in 2.1.10:\r\n- CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-37325",
+            "advisory": "An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from \"~/.confire.yaml\" using the yaml.load function, a YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.",
+            "cve": "CVE-2017-16763",
+            "id": "pyup.io-35721",
             "specs": [
-                "==2.1.10"
+                "<=0.2.0"
             ],
-            "v": "==2.1.10"
-        },
+            "v": "<=0.2.0"
+        }
+    ],
+    "confluent-kafka": [
         {
-            "advisory": "Django 2.1.11 fixes security issues in 2.1.10:\r\n- CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-39598",
+            "advisory": "Confluent-kafka 1.1.0 securely clears the private key data from memory after last use.",
+            "cve": "PVE-2021-37508",
+            "id": "pyup.io-37508",
             "specs": [
-                "==2.1.10"
+                "<1.1.0"
             ],
-            "v": "==2.1.10"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Django 2.1.11 fixes security issues in 2.1.10:\r\n- CVE-2019-14235: Potential memory exhaustion in ``django.utils.encoding.uri_to_iri()``",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-39596",
+            "advisory": "Confluent-kafka 1.3.0 includes a fix for CVE-2019-17543: LZ4 before 1.9.2 has a heap-based buffer overflow in LZ4_write32 (related to LZ4_compress_destSize), affecting applications that call LZ4_compress_fast with a large input. (This issue can also lead to data corruption.) NOTE: the vendor states \"only a few specific / uncommon usages of the API are at risk.\"",
+            "cve": "CVE-2019-17543",
+            "id": "pyup.io-38072",
             "specs": [
-                "==2.1.10"
+                "<1.3.0"
             ],
-            "v": "==2.1.10"
+            "v": "<1.3.0"
         },
         {
-            "advisory": "Django 2.1.11 fixes security issues in 2.1.10:\r\n- CVE-2019-14234: SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField``",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-39597",
+            "advisory": "Confluent-kafka 1.4.0 includes two security issues in the SASL SCRAM protocol handler:\r\n * The client nonce, which is expected to be a random string, was a static string.\r\n * If `sasl.username` and `sasl.password` contained characters that needed escaping, a buffer overflow and heap corruption would occur. This was protected, but too late, by an assertion.",
+            "cve": "PVE-2021-38165",
+            "id": "pyup.io-38165",
             "specs": [
-                "==2.1.10"
+                "<1.4.0"
             ],
-            "v": "==2.1.10"
-        },
+            "v": "<1.4.0"
+        }
+    ],
+    "conn-check": [
         {
-            "advisory": "Django 2.1.15 fixes CVE-2019-19118 in 2.1.14: Privilege escalation in the Django admin.",
-            "cve": "CVE-2019-19118",
-            "id": "pyup.io-37657",
+            "advisory": "conn-check 1.0.18 ensures pyOpenSSL is always used instead of the ssl modules, see https://urllib3.readthedocs.org/en/latest/security.htmlpyopenssl.",
+            "cve": "PVE-2021-25669",
+            "id": "pyup.io-25669",
             "specs": [
-                "==2.1.14"
+                "<1.0.18"
             ],
-            "v": "==2.1.14"
-        },
+            "v": "<1.0.18"
+        }
+    ],
+    "container-service-extension": [
         {
-            "advisory": "Django 2.1.9 fixes security issues in 2.1.8: CVE-2019-12308 (AdminURLFieldWidget XSS).",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-37185",
+            "advisory": "container-service-extension 1.2.5 adds K8s vulnerability patching",
+            "cve": "PVE-2021-36876",
+            "id": "pyup.io-36876",
             "specs": [
-                "==2.1.8"
+                "<1.2.5"
             ],
-            "v": "==2.1.8"
+            "v": "<1.2.5"
         },
         {
-            "advisory": "Django 2.2.2 fixes security issues in 2.2.1: CVE-2019-12308 (AdminURLFieldWidget XSS).",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-37184",
+            "advisory": "Container-service-extension 1.2.7 updates docker images to include a fix for CVE-2019-5736.\r\nhttps://github.com/vmware/container-service-extension/commit/1f03f960871afe8774541747712d4a72f6378839",
+            "cve": "CVE-2019-5736",
+            "id": "pyup.io-37100",
             "specs": [
-                "==2.2.1"
+                "<1.2.7"
             ],
-            "v": "==2.2.1"
+            "v": "<1.2.7"
         },
         {
-            "advisory": "Django 2.2.18 fixes a security issue with severity \"low\" in 2.2.17 (CVE-2021-3281).",
-            "cve": "CVE-2021-3281",
-            "id": "pyup.io-39523",
+            "advisory": "Container-service-extension 2.5.0b1  updates the hardcoded_password_string: false positives and test environment password strings marked not vulnerable.",
+            "cve": "PVE-2021-37529",
+            "id": "pyup.io-37529",
             "specs": [
-                "==2.2.17"
+                "<2.5.0b1"
             ],
-            "v": "==2.2.17"
-        },
+            "v": "<2.5.0b1"
+        }
+    ],
+    "contentful": [
         {
-            "advisory": "Django 2.2.3 fixes CVE-2019-12781 in 2.2.2: incorrect HTTP detection with reverse-proxy connecting via HTTPS.",
-            "cve": "CVE-2019-12781",
-            "id": "pyup.io-37324",
+            "advisory": "Contentful 1.11.3 updates 'requests' version due to a vulnerability found in versions '2.19' and below.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36633",
             "specs": [
-                "==2.2.2"
+                "<1.11.3"
             ],
-            "v": "==2.2.2"
+            "v": "<1.11.3"
         },
         {
-            "advisory": "Django 2.2.24 fixes security issue in 2.2.23 (CVE-2021-33571).",
-            "cve": "PVE-2021-40597",
-            "id": "pyup.io-40597",
+            "advisory": "Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.",
+            "cve": "CVE-2020-13258",
+            "id": "pyup.io-38314",
             "specs": [
-                "==2.2.23"
+                "<=1.12.3"
             ],
-            "v": "==2.2.23"
-        },
+            "v": "<=1.12.3"
+        }
+    ],
+    "contentful-management": [
         {
-            "advisory": "Django 2.2.24 fixes security issue in 2.2.23 (CVE-2021-33203).",
-            "cve": "PVE-2021-40586",
-            "id": "pyup.io-40586",
+            "advisory": "Contentful-management 2.5.0 updates 'requests' version due to a vulnerability found in previous versions.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36599",
             "specs": [
-                "==2.2.23"
+                "<2.5.0"
             ],
-            "v": "==2.2.23"
-        },
-        {
-            "advisory": "Django 2.2.4 fixes security issues in 2.2.3:\r\n- CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-39593",
+            "v": "<2.5.0"
+        }
+    ],
+    "contestms": [
+        {
+            "advisory": "contestms 1.2.0 fixes several security bugs around an unsafe use of isolate. These won't be backported to 1.1, so make sure you update.",
+            "cve": "PVE-2021-34249",
+            "id": "pyup.io-34249",
             "specs": [
-                "==2.2.3"
+                "<1.2.0"
             ],
-            "v": "==2.2.3"
-        },
+            "v": "<1.2.0"
+        }
+    ],
+    "cookie-manager": [
         {
-            "advisory": "Django 2.2.4 fixes security issues in 2.2.3:\r\n- CVE-2019-14234: SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField``",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-39592",
+            "advisory": "Cookie-manager 1.0.3 bumps dependency versions to fix a security issue.",
+            "cve": "PVE-2021-38106",
+            "id": "pyup.io-38106",
             "specs": [
-                "==2.2.3"
+                "<1.0.3"
             ],
-            "v": "==2.2.3"
+            "v": "<1.0.3"
         },
         {
-            "advisory": "Django 2.2.4 fixes security issues in 2.2.3:\r\n- CVE-2019-14235: Potential memory exhaustion in ``django.utils.encoding.uri_to_iri()``",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-39591",
+            "advisory": "Cookie-manager 1.1.0 updates its dependency Bleach to include a security fix.",
+            "cve": "CVE-2020-6817",
+            "id": "pyup.io-38153",
             "specs": [
-                "==2.2.3"
+                "<1.1.0"
             ],
-            "v": "==2.2.3"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Django 2.2.4 fixes a security issue in 2.2.3:\r\n- CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-37323",
+            "advisory": "Cookie-manager 1.2.1 fixes a security vulnerability discovered and patched in a dependency. See Bleach 3.3.0 <https://github.com/mozilla/bleach/releases/tag/v3.3.0> for further details.",
+            "cve": "PVE-2021-40165",
+            "id": "pyup.io-40165",
             "specs": [
-                "==2.2.3"
+                "<1.2.1"
             ],
-            "v": "==2.2.3"
-        },
+            "v": "<1.2.1"
+        }
+    ],
+    "cookiecutter": [
         {
-            "advisory": "Django 2.2.8 fixes CVE-2019-19118 in 2.2.7: Privilege escalation in the Django admin.",
-            "cve": "CVE-2019-19118",
-            "id": "pyup.io-37656",
+            "advisory": "Cookiecutter 0.1.0 fixes insecure gitlab_token retrieval - see: https://github.com/NathanUrwin/cookiecutter-git/issues/6",
+            "cve": "PVE-2021-34683",
+            "id": "pyup.io-34683",
             "specs": [
-                "==2.2.7"
+                "<0.1.0"
             ],
-            "v": "==2.2.7"
+            "v": "<0.1.0"
         },
         {
-            "advisory": "Django 2.2.9 fixes CVE-2019-19844 in 2.2.8: potential account hijack via password reset form.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-37662",
+            "advisory": "Cookiecutter 1.1.0 sets explicitly the list of allowed hosts for security reasons.",
+            "cve": "PVE-2021-37672",
+            "id": "pyup.io-37672",
             "specs": [
-                "==2.2.8"
+                "<1.1.0"
             ],
-            "v": "==2.2.8"
-        },
+            "v": "<1.1.0"
+        }
+    ],
+    "coordination-network-toolkit": [
         {
-            "advisory": "Django 2.2.10 fixes a security issue in 2.2.9. Potential SQL injection via `StringAgg(delimiter)`. See CVE-2020-7471.",
-            "cve": "CVE-2020-7471",
-            "id": "pyup.io-37816",
+            "advisory": "Coordination-network-toolkit 1.0.2 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
+            "cve": "CVE-2021-33503",
+            "id": "pyup.io-40624",
             "specs": [
-                "==2.2.9"
+                "<1.0.2"
             ],
-            "v": "==2.2.9"
-        },
+            "v": "<1.0.2"
+        }
+    ],
+    "copyparty": [
         {
-            "advisory": "Django 3.0.1 fixes CVE-2019-19844 in 3.0: potential account hijack via password reset form.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-37661",
+            "advisory": "The maintainers of Copyparty report that they \"hopefully\" have fixed a bug in version 0.12.3 where malicious POSTs through an nginx reverse-proxy could put the connection in a bad state, causing the next legit request to fail with bad headers",
+            "cve": "PVE-2021-41050",
+            "id": "pyup.io-41050",
             "specs": [
-                "==3.0"
+                "<0.12.3"
             ],
-            "v": "==3.0"
-        },
+            "v": "<0.12.3"
+        }
+    ],
+    "cortex": [
         {
-            "advisory": "Django 3.0.12 fixes a security issue with severity \"low\" in 3.0.11 (CVE-2021-3281).",
-            "cve": "CVE-2021-3281",
-            "id": "pyup.io-39522",
+            "advisory": "cortex before 0.32.0",
+            "cve": "PVE-2021-40128",
+            "id": "pyup.io-40128",
             "specs": [
-                "==3.0.11"
+                "<0.32.0"
             ],
-            "v": "==3.0.11"
-        },
+            "v": "<0.32.0"
+        }
+    ],
+    "cosmos-wfm": [
         {
-            "advisory": "Django 3.0.3 fixes a security issue and several bugs in 3.0.2. Potential SQL injection via `StringAgg(delimiter)`. See: CVE-2020-7471.",
-            "cve": "CVE-2020-7471",
-            "id": "pyup.io-37815",
+            "advisory": "cosmos-wfm before 2.1.1 is vulnerable to an attack where malicious hackers can run arbitrary code if they have file system (even external mounts!)+network access on the machine running luigid (executed by the user that you run luigid with).",
+            "cve": "PVE-2021-34181",
+            "id": "pyup.io-34181",
             "specs": [
-                "==3.0.2"
+                "<2.1.1"
             ],
-            "v": "==3.0.2"
-        },
+            "v": "<2.1.1"
+        }
+    ],
+    "cova": [
         {
-            "advisory": "Django 3.1.12 fixes two security issues in 3.1.11 (CVE-2021-33571).",
-            "cve": "PVE-2021-40598",
-            "id": "pyup.io-40598",
+            "advisory": "Cova 0.7.4 updates its dependency 'dask' to v2021.10.0 to include a security fix.",
+            "cve": "CVE-2021-42343",
+            "id": "pyup.io-44672",
             "specs": [
-                "==3.1.11"
+                "<0.7.4"
             ],
-            "v": "==3.1.11"
-        },
+            "v": "<0.7.4"
+        }
+    ],
+    "coveralls": [
         {
-            "advisory": "Django 3.1.12 fixes two security issues in 3.1.11 (CVE-2021-33203).",
-            "cve": "PVE-2021-40585",
-            "id": "pyup.io-40585",
+            "advisory": "coveralls 0.1.1 removes repo_token from verbose output for security reasons.",
+            "cve": "PVE-2021-25671",
+            "id": "pyup.io-25671",
             "specs": [
-                "==3.1.11"
+                "<0.1.1"
             ],
-            "v": "==3.1.11"
-        },
+            "v": "<0.1.1"
+        }
+    ],
+    "covert": [
         {
-            "advisory": "Django 3.1.6 fixes a security issue with severity \"low\" and a bug in 3.1.5 (CVE-2021-3281).",
-            "cve": "CVE-2021-3281",
-            "id": "pyup.io-39521",
+            "advisory": "Covert 0.2.1 ensures that all authentication tokens are unique, also for repeated public keys.\r\nhttps://github.com/covert-encryption/covert/commit/1a40aa80bb9f0401e2eb59d93df5e531c4ec1623",
+            "cve": "PVE-2021-42679",
+            "id": "pyup.io-42679",
             "specs": [
-                "==3.1.5"
+                "<0.2.1"
             ],
-            "v": "==3.1.5"
+            "v": "<0.2.1"
         },
         {
-            "advisory": "Django 3.2.4 fixes two security issues and several bugs in 3.2.3 (CVE-2021-33203).",
-            "cve": "PVE-2021-40584",
-            "id": "pyup.io-40584",
+            "advisory": "Covert 0.6.0 fixes an indistinguishability flaw in the ephemeral keys: encrypted archives could be easily distinguishable from random.\r\nhttps://github.com/covert-encryption/covert/issues/55",
+            "cve": "PVE-2022-44428",
+            "id": "pyup.io-44428",
             "specs": [
-                "==3.2.3"
+                "<0.6.0"
             ],
-            "v": "==3.2.3"
-        },
+            "v": "<0.6.0"
+        }
+    ],
+    "cplay-ng": [
         {
-            "advisory": "Django 3.2.4 fixes two security issues and several bugs in 3.2.3 (CVE-2021-3357).",
-            "cve": "PVE-2021-40599",
-            "id": "pyup.io-40599",
+            "advisory": "cplay-ng 1.50 fixes insecure /tmp handling.",
+            "cve": "PVE-2021-25672",
+            "id": "pyup.io-25672",
             "specs": [
-                "==3.2.3"
+                "<1.50"
             ],
-            "v": "==3.2.3"
-        },
+            "v": "<1.50"
+        }
+    ],
+    "crate-docs-theme": [
         {
-            "advisory": "Django 1.10.3 fixes two security issues and several bugs in 1.10.2.\r\n\r\nUser with hardcoded password created when running tests on Oracle\r\n=================================================================\r\n\r\nWhen running tests with an Oracle database, Django creates a temporary database\r\nuser. In older versions, if a password isn't manually specified in the database\r\nsettings ``TEST`` dictionary, a hardcoded password is used. This could allow\r\nan attacker with network access to the database server to connect.\r\n\r\nThis user is usually dropped after the test suite completes, but not when using\r\nthe ``manage.py test --keepdb`` option or if the user has an active session\r\n(such as an attacker's connection).\r\n\r\nA randomly generated password is now used for each test run.\r\n\r\nDNS rebinding vulnerability when ``DEBUG=True``\r\n===============================================",
-            "cve": "PVE-2021-25722",
-            "id": "pyup.io-25722",
+            "advisory": "Crate-docs-theme 0.13.0 updates/removes Bootstrap and jQuery packages (nine vulnerabilities detected).",
+            "cve": "PVE-2021-39529",
+            "id": "pyup.io-39529",
             "specs": [
-                ">=1.10,<1.10.3"
+                "<0.13.0"
             ],
-            "v": ">=1.10,<1.10.3"
-        },
+            "v": "<0.13.0"
+        }
+    ],
+    "creavel": [
         {
-            "advisory": "Django version 1.10.7, 1.9.13 and 1.8.18 include a fix for CVE-2017-7233: Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an \"on success\" URL. The security check for these redirects (namely 'django.utils.http.is_safe_url()') considered some numeric URLs \"safe\" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on 'is_safe_url()' to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.\r\nhttps://www.djangoproject.com/weblog/2017/apr/04/security-releases/",
-            "cve": "CVE-2017-7233",
-            "id": "pyup.io-33300",
+            "advisory": "creavel before 0.11.0 has a unspecified security issue and is vulnerable via unknown vectors.",
+            "cve": "PVE-2021-25673",
+            "id": "pyup.io-25673",
             "specs": [
-                ">=1.10,<1.10.7",
-                ">=1.9.0,<1.9.13",
-                ">=1.8.0,<1.8.18"
+                "<0.11.0"
             ],
-            "v": ">=1.10,<1.10.7,>=1.9.0,<1.9.13,>=1.8.0,<1.8.18"
+            "v": "<0.11.0"
         },
         {
-            "advisory": "Django 1.10.8 fixes a security issue in 1.10.7.  In older versions, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with 'DEBUG = True' (which makes this page accessible) in your production settings. See also: CVE-2017-12794, described as \"Possible XSS in traceback section of technical 500 debug page\".",
-            "cve": "CVE-2017-12794",
-            "id": "pyup.io-34918",
+            "advisory": "creavel 0.14.0 fixes jinja2 security by using SandboxedEnvironment.",
+            "cve": "PVE-2021-25674",
+            "id": "pyup.io-25674",
             "specs": [
-                ">=1.10.7,<1.10.8"
+                "<0.14.0"
             ],
-            "v": ">=1.10.7,<1.10.8"
-        },
+            "v": "<0.14.0"
+        }
+    ],
+    "credstash": [
         {
-            "advisory": "Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.",
-            "cve": "CVE-2020-7471",
-            "id": "pyup.io-37970",
+            "advisory": "Credstash 1.16.0 updates its dependency pyyaml to a version >=4.2b1 to include a security fix.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-37852",
             "specs": [
-                ">=1.11,<1.11.28",
-                ">=2.2,<2.2.10",
-                ">=3.0,<3.0.3"
+                "<1.16.0"
             ],
-            "v": ">=1.11,<1.11.28,>=2.2,<2.2.10,>=3.0,<3.0.3"
-        },
+            "v": "<1.16.0"
+        }
+    ],
+    "creopyson": [
         {
-            "advisory": "Django 1.11.5 fixes a security issue and several bugs in 1.11.4.\r\n\r\nCVE-2017-12794: Possible XSS in traceback section of technical 500 debug page\r\n=============================================================================\r\n\r\nIn older versions, HTML autoescaping was disabled in a portion of the template\r\nfor the technical 500 debug page. Given the right circumstances, this allowed\r\na cross-site scripting attack. This vulnerability shouldn't affect most\r\nproduction sites since you shouldn't run with ``DEBUG = True`` (which makes\r\nthis page accessible) in your production settings.",
-            "cve": "CVE-2017-12794",
-            "id": "pyup.io-34917",
+            "advisory": "Creopyson 0.4.2 modifies the pipenv config for the bleach security alert.",
+            "cve": "PVE-2021-37964",
+            "id": "pyup.io-37964",
             "specs": [
-                ">=1.11,<1.11.5"
+                "<0.4.2"
             ],
-            "v": ">=1.11,<1.11.5"
-        },
+            "v": "<0.4.2"
+        }
+    ],
+    "cromwell-tools": [
         {
-            "advisory": "An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-37191",
+            "advisory": "Cromwell-tools 1.0.0 updates requests to v2.20.0 to avoid security issues.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36659",
             "specs": [
-                ">=1.11.0,<1.11.21",
-                ">=2.1,<2.1.9",
-                ">=2.2,<2.2.2"
+                "<1.0.0"
             ],
-            "v": ">=1.11.0,<1.11.21,>=2.1,<2.1.9,>=2.2,<2.2.2"
-        },
+            "v": "<1.0.0"
+        }
+    ],
+    "crossbar": [
         {
-            "advisory": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-37329",
+            "advisory": "In crossbar before 0.15.0 if the `allowedOrigins` websocket option was set, the resulting matching was insufficient and would allow more origins than intended.",
+            "cve": "PVE-2021-25675",
+            "id": "pyup.io-25675",
             "specs": [
-                ">=1.11.0,<1.11.23",
-                ">=2.1.0,<2.1.11",
-                ">=2.2.0,<2.2.4"
+                "<0.15.0"
             ],
-            "v": ">=1.11.0,<1.11.23,>=2.1.0,<2.1.11,>=2.2.0,<2.2.4"
+            "v": "<0.15.0"
         },
         {
-            "advisory": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-37357",
+            "advisory": "crossbar 0.6.4 fixes a WAMP-CRA timing attack very, very unlikely to be exploitable.",
+            "cve": "PVE-2021-25676",
+            "id": "pyup.io-25676",
             "specs": [
-                ">=1.11.0,<1.11.23",
-                ">=2.1.0,<2.1.11",
-                ">=2.2.0,<2.2.4"
+                "<0.6.4"
             ],
-            "v": ">=1.11.0,<1.11.23,>=2.1.0,<2.1.11,>=2.2.0,<2.2.4"
+            "v": "<0.6.4"
         },
         {
-            "advisory": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-37330",
+            "advisory": "Crossbar 20.12.3 fixes a dependency on Autobahn v20.12.3, which in turn fixes a potential security issue when enabling the Web status page ('enable_webstatus') on WebSocket-WAMP listening transports.",
+            "cve": "PVE-2021-39329",
+            "id": "pyup.io-39329",
             "specs": [
-                ">=1.11.0,<1.11.23",
-                ">=2.1.0,<2.1.11",
-                ">=2.2.0,<2.2.4"
+                "<20.12.3"
             ],
-            "v": ">=1.11.0,<1.11.23,>=2.1.0,<2.1.11,>=2.2.0,<2.2.4"
-        },
+            "v": "<20.12.3"
+        }
+    ],
+    "croud": [
         {
-            "advisory": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-37331",
+            "advisory": "Croud 0.3.0 includes a fix for CVE-2017-18342, an arbitrary code execution vulnerability in yaml.load().\r\nhttps://github.com/crate/croud/commit/821f2ba47285f5b5ad3e2e2782c44f867da931ee",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-42353",
             "specs": [
-                ">=1.11.0,<1.11.23",
-                ">=2.1.0,<2.1.11",
-                ">=2.2.0,<2.2.4"
+                "<0.3.0"
             ],
-            "v": ">=1.11.0,<1.11.23,>=2.1.0,<2.1.11,>=2.2.0,<2.2.4"
-        },
+            "v": "<0.3.0"
+        }
+    ],
+    "crypt": [
         {
-            "advisory": "Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL Injections if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL. See: CVE-2020-9402.",
-            "cve": "CVE-2020-9402",
-            "id": "pyup.io-38010",
+            "advisory": "crypt  is a package affected by pytosquatting: http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/",
+            "cve": "PVE-2021-34981",
+            "id": "pyup.io-34981",
             "specs": [
-                ">=1.11.0,<1.11.29",
-                ">=2.2.0,<2.2.11",
-                ">=3.0.0,<3.0.4"
+                ">0",
+                "<0"
             ],
-            "v": ">=1.11.0,<1.11.29,>=2.2.0,<2.2.11,>=3.0.0,<3.0.4"
-        },
+            "v": ">0,<0"
+        }
+    ],
+    "cryptacular": [
         {
-            "advisory": "CVE-2018-6188: Information leakage in ``AuthenticationForm``\r\n============================================================\r\n\r\nA regression in Django 1.11.8 made\r\n:class:`~django.contrib.auth.forms.AuthenticationForm` run its\r\n``confirm_login_allowed()`` method even if an incorrect password is entered.\r\nThis can leak information about a user, depending on what messages\r\n``confirm_login_allowed()`` raises. If ``confirm_login_allowed()`` isn't\r\noverridden, an attacker enter an arbitrary username and see if that user has\r\nbeen set to ``is_active=False``. If ``confirm_login_allowed()`` is overridden,\r\nmore sensitive details could be leaked.\r\n\r\nThis issue is fixed with the caveat that ``AuthenticationForm`` can no longer\r\nraise the \"This account is inactive.\" error if the authentication backend\r\nrejects inactive users (the default authentication backend, ``ModelBackend``,\r\nhas done that since Django 1.10). This issue will be revisited for Django 2.1\r\nas a fix to address the caveat will likely be too invasive for inclusion in\r\nolder versions.",
-            "cve": "CVE-2018-6188",
-            "id": "pyup.io-35174",
+            "advisory": "crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.",
+            "cve": "CVE-2011-2483",
+            "id": "pyup.io-42230",
             "specs": [
-                ">=1.11.8,<1.11.10"
+                "<1.2"
             ],
-            "v": ">=1.11.8,<1.11.10"
+            "v": "<1.2"
         },
         {
-            "advisory": "django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. A remote user can redirect the target user's browser to an arbitrary site.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-36368",
+            "advisory": "crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it easier for context-dependent attackers to determine a cleartext password by leveraging knowledge of a password hash.",
+            "cve": "PVE-2021-25677",
+            "id": "pyup.io-25677",
             "specs": [
-                ">=1.11a1,<1.11.15",
-                ">=2.0a1,<2.0.8"
+                "<1.2"
             ],
-            "v": ">=1.11a1,<1.11.15,>=2.0a1,<2.0.8"
-        },
+            "v": "<1.2"
+        }
+    ],
+    "cryptice": [
         {
-            "advisory": "In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. See: CVE-2019-3498.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-36771",
+            "advisory": "Cryptice 2.0 improves user data validation to avoid security issues.\r\nhttps://github.com/RenardDev/CryptICE/commit/2a8627747ab1a180e1466a21cf2fb6a9f665489a",
+            "cve": "PVE-2022-43753",
+            "id": "pyup.io-43753",
             "specs": [
-                ">=1.11a1,<1.11.18"
+                "<2.0"
             ],
-            "v": ">=1.11a1,<1.11.18"
-        },
+            "v": "<2.0"
+        }
+    ],
+    "crypto-candlesticks": [
         {
-            "advisory": "The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.",
-            "cve": "CVE-2013-0305",
-            "id": "pyup.io-33111",
+            "advisory": "Crypto-candlesticks 0.1.5 fixes a vulnerability in the 'jinja2' dependency.",
+            "cve": "PVE-2021-39697",
+            "id": "pyup.io-39697",
             "specs": [
-                ">=1.3,<1.3.6",
-                ">=1.4,<1.4.4",
-                ">=1.5,<1.5.1"
+                "<0.1.5"
             ],
-            "v": ">=1.3,<1.3.6,>=1.4,<1.4.4,>=1.5,<1.5.1"
-        },
+            "v": "<0.1.5"
+        }
+    ],
+    "cryptography": [
         {
-            "advisory": "The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.",
-            "cve": "CVE-2013-0306",
-            "id": "pyup.io-33112",
+            "advisory": "cryptography 0.9.1 fixes a double free in the OpenSSL backend when using DSA  to verify signatures. Note that this only affects PyPy 2.6.0 and (presently unreleased) CFFI versions greater than 1.1.0.",
+            "cve": "PVE-2021-25678",
+            "id": "pyup.io-25678",
             "specs": [
-                ">=1.3,<1.3.6",
-                ">=1.4,<1.4.4",
-                ">=1.5,<1.5.1"
+                "<0.9.1"
             ],
-            "v": ">=1.3,<1.3.6,>=1.4,<1.4.4,>=1.5,<1.5.1"
+            "v": "<0.9.1"
         },
         {
-            "advisory": "The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.",
-            "cve": "CVE-2015-5964",
-            "id": "pyup.io-25728",
+            "advisory": "The OpenSSL backend prior to 1.0.2 made extensive use  of assertions to check response codes where our tests could not trigger a  failure.  However, when Python is run with ``-O`` these asserts are optimized  away.  If a user ran Python with this flag and got an invalid response code  this could result in undefined behavior or worse. Accordingly, all response  checks from the OpenSSL backend have been converted from ``assert``  to a true function call. Credit **Emilia K\u00e4sper (Google Security Team)**  for the report.",
+            "cve": "PVE-2021-25679",
+            "id": "pyup.io-25679",
             "specs": [
-                ">=1.4,<1.4.22",
-                ">=1.7,<1.7.10"
+                "<1.0.2"
             ],
-            "v": ">=1.4,<1.4.22,>=1.7,<1.7.10"
+            "v": "<1.0.2"
         },
         {
-            "advisory": "contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.",
-            "cve": "CVE-2015-5963",
-            "id": "pyup.io-25727",
+            "advisory": "HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.",
+            "cve": "CVE-2016-9243",
+            "id": "pyup.io-25680",
             "specs": [
-                ">=1.4,<1.4.22",
-                ">=1.7,<1.7.10",
-                ">=1.8,<1.8.4"
+                "<1.5.3"
             ],
-            "v": ">=1.4,<1.4.22,>=1.7,<1.7.10,>=1.8,<1.8.4"
+            "v": "<1.5.3"
         },
         {
-            "advisory": "The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by \"the login view in django.contrib.auth.views\" and the javascript: scheme.",
-            "cve": "CVE-2013-6044",
-            "id": "pyup.io-42237",
+            "advisory": "Cryptography 3.3 no longer allows loading of finite field Diffie-Hellman parameters of less than 512 bits in length. This change is to conform with an upcoming OpenSSL release that no longer supports smaller sizes. These keys were already wildly insecure and should not have been used in any application outside of testing.",
+            "cve": "PVE-2021-39252",
+            "id": "pyup.io-39252",
             "specs": [
-                ">=1.4,<1.4.6",
-                ">=1.5,<1.5.2",
-                ">1.6,<1.6b2"
+                "<3.3"
             ],
-            "v": ">=1.4,<1.4.6,>=1.5,<1.5.2,>1.6,<1.6b2"
+            "v": "<3.3"
         },
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField. See: CVE-2013-4249.",
-            "cve": "CVE-2013-4249",
-            "id": "pyup.io-35456",
+            "advisory": "In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class. See: CVE-2020-36242.",
+            "cve": "CVE-2020-36242",
+            "id": "pyup.io-39606",
             "specs": [
-                ">=1.5,<1.5.2",
-                ">=1.6,<1.6b2"
+                "<3.3.2"
             ],
-            "v": ">=1.5,<1.5.2,>=1.6,<1.6b2"
+            "v": "<3.3.2"
         },
         {
-            "advisory": "The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.",
-            "cve": "CVE-2013-1443",
-            "id": "pyup.io-25729",
+            "advisory": "Cryptography 3.2 was released with the warning that its maintainers became aware of a Bleichenbacher vulnerability that they were only partly able to mitigate. See: CVE-2020-25659.",
+            "cve": "CVE-2020-25659",
+            "id": "pyup.io-38932",
             "specs": [
-                ">=1.6,<1.6-beta-4",
-                ">=1.4,<1.4.8",
-                ">=1.5,<1.5.4"
+                "<=3.2"
             ],
-            "v": ">=1.6,<1.6-beta-4,>=1.4,<1.4.8,>=1.5,<1.5.4"
+            "v": "<=3.2"
         },
         {
-            "advisory": "ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.",
-            "cve": "CVE-2015-0222",
-            "id": "pyup.io-25730",
+            "advisory": "A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage. See: CVE-2018-10903.",
+            "cve": "CVE-2018-10903",
+            "id": "pyup.io-36351",
             "specs": [
-                ">=1.7,<1.7.3",
-                ">=1.6,<1.6.10"
+                ">=1.9.0,<2.3"
             ],
-            "v": ">=1.7,<1.7.3,>=1.6,<1.6.10"
-        },
+            "v": ">=1.9.0,<2.3"
+        }
+    ],
+    "cryptography-vectors": [
         {
-            "advisory": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
-            "cve": "CVE-2015-2316",
-            "id": "pyup.io-25731",
+            "advisory": "cryptography-vectors 0.9.1 fixes a double free in the OpenSSL backend when using DSA to verify signatures. Note that this only affects PyPy 2.6.0 and (presently  unreleased) CFFI versions greater than 1.1.0.",
+            "cve": "PVE-2021-25681",
+            "id": "pyup.io-25681",
             "specs": [
-                ">=1.7,<1.7.7",
-                ">=1.6,<1.6.11",
-                ">=1.8a1,<1.8c1"
+                "<0.9.1"
             ],
-            "v": ">=1.7,<1.7.7,>=1.6,<1.6.11,>=1.8a1,<1.8c1"
+            "v": "<0.9.1"
         },
         {
-            "advisory": "The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.",
-            "cve": "CVE-2015-5143",
-            "id": "pyup.io-25725",
+            "advisory": "The OpenSSL backend prior to 1.0.2 made extensive use  of assertions to check response codes where our tests could not trigger a  failure.  However, when Python is run with ``-O`` these asserts are optimized  away.  If a user ran Python with this flag and got an invalid response code  this could result in undefined behavior or worse. Accordingly, all response  checks from the OpenSSL backend have been converted from ``assert``  to a true function call. Credit **Emilia K\u00e4sper (Google Security Team)**  for the report.",
+            "cve": "PVE-2021-25682",
+            "id": "pyup.io-25682",
             "specs": [
-                ">=1.7,<1.7.9",
-                ">=1.5,<1.7",
-                ">=1.4,<1.4.21"
+                "<1.0.2"
             ],
-            "v": ">=1.7,<1.7.9,>=1.5,<1.7,>=1.4,<1.4.21"
+            "v": "<1.0.2"
         },
         {
-            "advisory": "Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.",
-            "cve": "CVE-2016-9014",
+            "advisory": "HKDF in cryptography before 1.5.2 returns an empty byte-string if used with a length less than algorithm.digest_size.",
+            "cve": "CVE-2016-9243",
+            "id": "pyup.io-25683",
+            "specs": [
+                "<1.5.3"
+            ],
+            "v": "<1.5.3"
+        }
+    ],
+    "cssutils": [
+        {
+            "advisory": "In cssutils before 0.9.6a2 comments added by ``cssutils.resolveImports`` only use the import rules' href and not the absolute href of the referenced sheets anymore (might have been a possible security hole when showing a full local path to a sheet in a combined but not minified sheet)",
+            "cve": "PVE-2021-25684",
+            "id": "pyup.io-25684",
+            "specs": [
+                "<0.9.6a2"
+            ],
+            "v": "<0.9.6a2"
+        }
+    ],
+    "cstar": [
+        {
+            "advisory": "Cstar 0.5.0 fixes a security problem in a dependency (spotify). See: <https://github.com/spotify/cstar/pull/8>.",
+            "cve": "PVE-2021-39224",
+            "id": "pyup.io-39224",
+            "specs": [
+                "<0.5.0"
+            ],
+            "v": "<0.5.0"
+        }
+    ],
+    "cumin": [
+        {
+            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in Cumin before r5238 allow remote attackers to inject arbitrary web script or HTML via vectors involving (1) widgets or (2) pages.",
+            "cve": "CVE-2012-1575",
+            "id": "pyup.io-35357",
+            "specs": [
+                "<r5238"
+            ],
+            "v": "<r5238"
+        }
+    ],
+    "cupy": [
+        {
+            "advisory": "`cupy.load` in cupy 7.0.0b2 specifies `allow_pickle=False` by default to follow the security fix made in NumPy 1.16.3 (see https://github.com/numpy/numpy/pull/13359 and https://github.com/cupy/cupy/pull/2290). Most users should not be affected by this change; users loading `ndarray` serialized using pickle may need to explicitly specify `allow_pickle=True`.",
+            "cve": "PVE-2021-37395",
+            "id": "pyup.io-37395",
+            "specs": [
+                "<7.0.0b2"
+            ],
+            "v": "<7.0.0b2"
+        }
+    ],
+    "cutty": [
+        {
+            "advisory": "Cutty 0.14.0 updates its dependency 'babel' to v2.9.1 to include a security fix.",
+            "cve": "CVE-2021-42771",
+            "id": "pyup.io-42219",
+            "specs": [
+                "<0.14.0"
+            ],
+            "v": "<0.14.0"
+        },
+        {
+            "advisory": "Cutty version 0.3.0 updates its dependency \"actions/cache\" to v2.1.5 to include a security fix.\r\nhttps://github.com/cjolowicz/cutty/commit/427fc30d81d7ade397004f92719ffd121b4a4c28",
+            "cve": "CVE-2020-15228",
+            "id": "pyup.io-41993",
+            "specs": [
+                "<0.3.0"
+            ],
+            "v": "<0.3.0"
+        }
+    ],
+    "dact": [
+        {
+            "advisory": "Dact 1.1.1 includes a few security patches.",
+            "cve": "PVE-2021-39403",
+            "id": "pyup.io-39403",
+            "specs": [
+                "<1.1.1"
+            ],
+            "v": "<1.1.1"
+        }
+    ],
+    "dash": [
+        {
+            "advisory": "Dash 1.20.0 starts to validate callback request 'outputs' vs. 'output' to avoid a perceived security issue.",
+            "cve": "PVE-2021-40183",
+            "id": "pyup.io-40183",
+            "specs": [
+                "<1.20.0"
+            ],
+            "v": "<1.20.0"
+        },
+        {
+            "advisory": "Dash 1.21.0 updates its dependency 'Plotly.js' to v2.2.1 to include a security fix.",
+            "cve": "PVE-2021-40962",
+            "id": "pyup.io-40962",
+            "specs": [
+                "<1.21.0"
+            ],
+            "v": "<1.21.0"
+        }
+    ],
+    "dash-bio": [
+        {
+            "advisory": "Dash-bio 0.5.1 fixes an abandoned resource vulnerability with CircosJS fork.",
+            "cve": "PVE-2021-39411",
+            "id": "pyup.io-39411",
+            "specs": [
+                "<0.5.1"
+            ],
+            "v": "<0.5.1"
+        }
+    ],
+    "dash-io": [
+        {
+            "advisory": "Dash-io 0.0.1.post1 removes the 'Pickle' library for security reason.",
+            "cve": "PVE-2021-40961",
+            "id": "pyup.io-40961",
+            "specs": [
+                "<0.0.1.post1"
+            ],
+            "v": "<0.0.1.post1"
+        }
+    ],
+    "dash-jbrowse": [
+        {
+            "advisory": "Dash-jbrowse 1.0.1 updates its NPM dependency 'follow-redirects' to v1.14.7 to include a security fix.",
+            "cve": "CVE-2022-0155",
+            "id": "pyup.io-44687",
+            "specs": [
+                "<1.0.1"
+            ],
+            "v": "<1.0.1"
+        },
+        {
+            "advisory": "Dash-jbrowse 1.0.1 updates its NPM dependency 'object-path' to v0.11.8 to include security fixes.",
+            "cve": "CVE-2021-3805",
+            "id": "pyup.io-44693",
+            "specs": [
+                "<1.0.1"
+            ],
+            "v": "<1.0.1"
+        },
+        {
+            "advisory": "Dash-jbrowse 1.0.1 updates its NPM dependency 'object-path' to v0.11.8 to include security fixes.",
+            "cve": "CVE-2021-23434",
+            "id": "pyup.io-44694",
+            "specs": [
+                "<1.0.1"
+            ],
+            "v": "<1.0.1"
+        }
+    ],
+    "dash-table": [
+        {
+            "advisory": "Dash-table 4.7.0 sanitizes table \"id\" for stylesheet injection.\r\nhttps://github.com/plotly/dash-table/pull/766",
+            "cve": "PVE-2021-41222",
+            "id": "pyup.io-41222",
+            "specs": [
+                "<4.7.0"
+            ],
+            "v": "<4.7.0"
+        }
+    ],
+    "dask": [
+        {
+            "advisory": "Dask 2021.10.0 includes a fix for CVE-2021-42343: An issue was discovered in the Dask distributed package before 2021.10.0 for Python. Single machine Dask clusters starting with dask.distributed.LocalCluster or dask.distributed.Client (which defaults to using LocalCluster) would mistakenly configure their respective Dask workers to listen on external interfaces (typically with a randomly selected high port) rather than only on localhost. A Dask cluster created using this method (when running on a machine that has an applicable port exposed) could be used by a sophisticated attacker to achieve remote code execution.",
+            "cve": "CVE-2021-42343",
+            "id": "pyup.io-42345",
+            "specs": [
+                "<2021.10.0"
+            ],
+            "v": "<2021.10.0"
+        }
+    ],
+    "database-sanitizer": [
+        {
+            "advisory": "Database-sanitizer version 1.1.0 includes a security patch for the function 'from_file' in 'database_sanitizer/config.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/andersinno/python-database-sanitizer/commit/ace4e0823d7b81c6f3bf683eb97193b36cc6c040#diff-6090be0559642595d2ff5ff2e9d265c6d152a75ef98845380436d0f06e0b3c19",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41314",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        }
+    ],
+    "datacube": [
+        {
+            "advisory": "datacube 1.6.2 is a Patch release to build a new Docker container, to resolve an upstream security bug.",
+            "cve": "PVE-2021-36835",
+            "id": "pyup.io-36835",
+            "specs": [
+                "<1.6.2"
+            ],
+            "v": "<1.6.2"
+        }
+    ],
+    "datacube-ows": [
+        {
+            "advisory": "Datacube-ows 1.8.8 removes the CodeCov token from ows to fix a security breach.\r\nhttps://github.com/opendatacube/datacube-ows/pull/585",
+            "cve": "PVE-2021-42558",
+            "id": "pyup.io-42558",
+            "specs": [
+                "<1.8.8"
+            ],
+            "v": "<1.8.8"
+        }
+    ],
+    "datagristle": [
+        {
+            "advisory": "Datagristle 0.1.7 bumps versions on dependent modules to eliminate vulnerabilities.",
+            "cve": "PVE-2021-40237",
+            "id": "pyup.io-40237",
+            "specs": [
+                "<0.1.7"
+            ],
+            "v": "<0.1.7"
+        }
+    ],
+    "datajob": [
+        {
+            "advisory": "Datajob 0.6.0 includes a patch to shell out commands more securely.",
+            "cve": "PVE-2021-40144",
+            "id": "pyup.io-40144",
+            "specs": [
+                "<0.6.0"
+            ],
+            "v": "<0.6.0"
+        }
+    ],
+    "datasette": [
+        {
+            "advisory": "Datasette 0.29.1 fixes a bug where static mounts used relative paths, which could lead to traversal exploits.\r\nhttps://github.com/simonw/datasette/commit/82889507cafa4b823e89af90b6674fd76653fb86",
+            "cve": "PVE-2021-42226",
+            "id": "pyup.io-42226",
+            "specs": [
+                "<0.29.1"
+            ],
+            "v": "<0.29.1"
+        },
+        {
+            "advisory": "Datasette 0.44 adds CSRF protection for /-/messages tool and writable canned queries.\r\nhttps://github.com/simonw/datasette/issues/793",
+            "cve": "PVE-2021-42225",
+            "id": "pyup.io-42225",
+            "specs": [
+                "<0.44"
+            ],
+            "v": "<0.44"
+        },
+        {
+            "advisory": "Datasette 0.46 contains a security fix related to authenticated writable canned queries. CSRF tokens were incorrectly included in read-only canned query forms, which could allow them to be leaked to a sophisticated attacker.",
+            "cve": "PVE-2021-38671",
+            "id": "pyup.io-38671",
+            "specs": [
+                "<0.46"
+            ],
+            "v": "<0.46"
+        },
+        {
+            "advisory": "Datasette 0.55 starts to use Python 3.7.10 in official Docker image, applying the latest security fix.",
+            "cve": "PVE-2021-40541",
+            "id": "pyup.io-40541",
+            "specs": [
+                "<0.55"
+            ],
+            "v": "<0.55"
+        },
+        {
+            "advisory": "Datasette 0.56.1 fixes a reflected cross-site scripting security hole with the '?_trace=1' feature. You should upgrade to this version, or to the 'Datasette' 0.57, as soon as possible.",
+            "cve": "PVE-2021-40619",
+            "id": "pyup.io-40619",
+            "specs": [
+                "<0.56.1"
+            ],
+            "v": "<0.56.1"
+        },
+        {
+            "advisory": "Datasette is an open source multi-tool for exploring and publishing data. The `?_trace=1` debugging feature in Datasette does not correctly escape generated HTML, resulting in a [reflected cross-site scripting](https://owasp.org/www-community/attacks/xss/#reflected-xss-attacks) vulnerability. This vulnerability is particularly relevant if your Datasette installation includes authenticated features using plugins such as [datasette-auth-passwords](https://datasette.io/plugins/datasette-auth-passwords) as an attacker could use the vulnerability to access protected data. Datasette 0.57 and 0.56.1 both include patches for this issue. If you run Datasette behind a proxy you can workaround this issue by rejecting any incoming requests with `?_trace=` or `&_trace=` in their query string parameters.",
+            "cve": "CVE-2021-32670",
+            "id": "pyup.io-42314",
+            "specs": [
+                "<0.57"
+            ],
+            "v": "<0.57"
+        },
+        {
+            "advisory": "Datasette 0.57 fixes a reflected cross-site scripting security hole with the '?_trace=1' feature. You should upgrade to this version, or to the 'Datasette' 0.56.1, as soon as possible.",
+            "cve": "PVE-2021-40618",
+            "id": "pyup.io-40618",
+            "specs": [
+                "<0.57"
+            ],
+            "v": "<0.57"
+        }
+    ],
+    "datasette-auth-passwords": [
+        {
+            "advisory": "Datasette-auth-passwords 0.4.1 now depends on the 'datasette' >=0.56.1, to avoid a security vulnerability.",
+            "cve": "PVE-2021-40620",
+            "id": "pyup.io-40620",
+            "specs": [
+                "<0.4.1"
+            ],
+            "v": "<0.4.1"
+        }
+    ],
+    "datasette-css-properties": [
+        {
+            "advisory": "Datasette-css-properties 0.2 makes the '.css' pages send the 'x-content-type-options: nosniff' header to protect against browsers incorrectly rendering the CSS as HTML which could be an XSS security hole.\r\nhttps://github.com/simonw/datasette-css-properties/commit/faf181430667af0e4f4954163fefcc32e8fdbd9c",
+            "cve": "PVE-2021-39422",
+            "id": "pyup.io-39422",
+            "specs": [
+                "<0.2"
+            ],
+            "v": "<0.2"
+        }
+    ],
+    "datasette-graphql": [
+        {
+            "advisory": "Satasette-graphql before 1.2 included a plugin that could expose schema details of databases that should not be visible, though not their actual row content. See: <https://github.com/simonw/datasette-graphql/security/advisories/GHSA-74hv-qjjq-h7g5>.",
+            "cve": "PVE-2021-39174",
+            "id": "pyup.io-39174",
+            "specs": [
+                "<1.2"
+            ],
+            "v": "<1.2"
+        }
+    ],
+    "datasette-indieauth": [
+        {
+            "advisory": "Datasette-indieauth before 1.1 trusts the \"me\" field returned by the authorization server without verifying it.",
+            "cve": "PVE-2021-39164",
+            "id": "pyup.io-39164",
+            "specs": [
+                "<1.1"
+            ],
+            "v": "<1.1"
+        }
+    ],
+    "datasette-insert": [
+        {
+            "advisory": "Datasette-insert 0.6 is locked down by default. This plugin no longer defaults to allowing all, reducing the risk that someone may deploy it without sufficient security.",
+            "cve": "PVE-2021-38644",
+            "id": "pyup.io-38644",
+            "specs": [
+                "<0.6"
+            ],
+            "v": "<0.6"
+        }
+    ],
+    "datasette-query-links": [
+        {
+            "advisory": "Datasette-query-links 0.1.1 fixes an XSS security bug.\r\nhttps://github.com/simonw/datasette-query-links/issues/2",
+            "cve": "PVE-2021-41092",
+            "id": "pyup.io-41092",
+            "specs": [
+                "<0.1.1"
+            ],
+            "v": "<0.1.1"
+        }
+    ],
+    "datasette-seaborn": [
+        {
+            "advisory": "The maintainers or the datasette-seaborn package acknowledge that version 0.1a0 is buggy and probably not secure.",
+            "cve": "PVE-2021-38782",
+            "id": "pyup.io-38782",
+            "specs": [
+                "==0.1a0"
+            ],
+            "v": "==0.1a0"
+        }
+    ],
+    "dateable-chronos": [
+        {
+            "advisory": "Dateable-chronos 0.8 includes a  fix for a XSS vulnerability in the get_view_day method.\r\nhttps://github.com/collective/dateable.chronos/commit/fd91af02186e61b3e161a2f620da9422eb228c71",
+            "cve": "PVE-2021-35988",
+            "id": "pyup.io-35988",
+            "specs": [
+                "<0.8"
+            ],
+            "v": "<0.8"
+        }
+    ],
+    "dateable.chronos": [
+        {
+            "advisory": "Dateable.chronos 0.8 includes a  fix for a XSS vulnerability in the get_view_day method.\r\nhttps://github.com/collective/dateable.chronos/commit/fd91af02186e61b3e161a2f620da9422eb228c71",
+            "cve": "PVE-2021-25685",
+            "id": "pyup.io-25685",
+            "specs": [
+                "<0.8"
+            ],
+            "v": "<0.8"
+        }
+    ],
+    "datera-cinder": [
+        {
+            "advisory": "Datera-cinder 2018.10.30.0 updates the required 'requests' version to >=2.20.0 to include a fix for CVE-2018-18074.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-37204",
+            "specs": [
+                "<2018.10.30.0"
+            ],
+            "v": "<2018.10.30.0"
+        }
+    ],
+    "datumaro": [
+        {
+            "advisory": "Datumaro version 0.1.10 includes a fix for an arbitrary code execution vulnerability: Cifar implementation is based on pickle, which can run arbitrary code on unpickling.\r\nhttps://github.com/openvinotoolkit/datumaro/issues/327",
+            "cve": "PVE-2021-41817",
+            "id": "pyup.io-41817",
+            "specs": [
+                "<0.1.10"
+            ],
+            "v": "<0.1.10"
+        }
+    ],
+    "dawgie": [
+        {
+            "advisory": "Dawgie 1.2.3 includes a vulnerability fix.",
+            "cve": "PVE-2021-40122",
+            "id": "pyup.io-40122",
+            "specs": [
+                "<1.2.3"
+            ],
+            "v": "<1.2.3"
+        },
+        {
+            "advisory": "Dawgie 1.2.9 adds clean methods to limit malicious code.",
+            "cve": "PVE-2021-40121",
+            "id": "pyup.io-40121",
+            "specs": [
+                "<1.2.9"
+            ],
+            "v": "<1.2.9"
+        }
+    ],
+    "db-able": [
+        {
+            "advisory": "Db-able 2.1.4 updates its NPM dependency 'shelljs' to v0.8.5 to include a security fix.",
+            "cve": "CVE-2022-0144",
+            "id": "pyup.io-44568",
+            "specs": [
+                "<2.1.4"
+            ],
+            "v": "<2.1.4"
+        }
+    ],
+    "dbcat": [
+        {
+            "advisory": "Dbcat 0.3.1 updates its dependency 'cryptography' to v3.4.4 to include a security fix.",
+            "cve": "CVE-2020-36242",
+            "id": "pyup.io-42696",
+            "specs": [
+                "<0.3.1"
+            ],
+            "v": "<0.3.1"
+        }
+    ],
+    "dbt-core": [
+        {
+            "advisory": "Dbt-core 0.20.0rc1 updates its dependency 'jinja2' to v2.11.3 to include a security fix.",
+            "cve": "CVE-2020-28493",
+            "id": "pyup.io-42229",
+            "specs": [
+                "<0.20.0rc1"
+            ],
+            "v": "<0.20.0rc1"
+        }
+    ],
+    "dbtos3": [
+        {
+            "advisory": "Dbtos3 version 0.0.2a0 includes security fixes related to dependencies' updates.",
+            "cve": "PVE-2021-42017",
+            "id": "pyup.io-42017",
+            "specs": [
+                "<0.0.2a0"
+            ],
+            "v": "<0.0.2a0"
+        }
+    ],
+    "ddtrace": [
+        {
+            "advisory": "ddtrace  0.11.0 removes the `sql.query` tag from SQL spans, so that the content is properly obfuscated in the Agent. This security fix is required to prevent wrong data collection of reported SQL queries. This issue impacts only MySQL integrations and NOT `psycopg2` or `sqlalchemy` while using the PostgreSQL driver.",
+            "cve": "PVE-2021-35790",
+            "id": "pyup.io-35790",
+            "specs": [
+                "<0.11.0"
+            ],
+            "v": "<0.11.0"
+        }
+    ],
+    "debianized-jupyterhub": [
+        {
+            "advisory": "Debianized-jupyterhub 0.9.5.1 updates its dependency 'notebook' to 5.7.7 to include a security fix.",
+            "cve": "CVE-2019-10255",
+            "id": "pyup.io-37002",
+            "specs": [
+                "<0.9.5.1"
+            ],
+            "v": "<0.9.5.1"
+        }
+    ],
+    "debops": [
+        {
+            "advisory": "Debops 0.8.0 installs upstream NodeSource APT packages by default. This is due to `no security support in Debian Stable`__, therefore an upstream packages should be considered more secure. The upstream NodeJS packages include a compatible NPM release, therefore it won't be separately installed from GitHub.",
+            "cve": "PVE-2021-36371",
+            "id": "pyup.io-36371",
+            "specs": [
+                "<0.8.0"
+            ],
+            "v": "<0.8.0"
+        },
+        {
+            "advisory": "Debops 1.0.0:\r\n\r\n- The :command:`lxc-prepare-ssh` script will read the public SSH keys from specific files (``root`` key file, and the ``$SUDO_USER`` key file) and will not accept any custom files to read from, to avoid possible security issues. Each public SSH key listed in the key files is validated before being added to the container's ``root`` account.\r\n\r\n- The :command:`lxc-new-unprivileged` script will similarly not accept any custom files as initial LXC container configuration to fix any potential security holes when used via :command:`sudo`. The default LXC configuration file used by the script can be configured in :file:`/etc/lxc/lxc.conf` configuration file.\r\n\r\n- (:ref:`debops.php` role) New APT signing keys` have been created for his Debian APT repository with PHP packages, due to security concerns. The :ref:`debops.php` role will remove the old APT GPG key and add the new one automatically. See: <https://www.patreon.com/posts/dpa-new-signing-25451165>.",
+            "cve": "PVE-2021-37159",
+            "id": "pyup.io-37159",
+            "specs": [
+                "<1.0.0"
+            ],
+            "v": "<1.0.0"
+        },
+        {
+            "advisory": "The :command:\"lxc-prepare-ssh\" script in debops 1.1.0 will no longer install SSH keys from the LXC host \"root\" account on the LXC container \"root\" account. That could cause confusion and unintended security breaches when other services (for example backup scripts or remote command execution tools) install their own SSH keys on the LXC host and they are subsequently copied inside of the LXC containers created on that host.\r\nhttps://github.com/debops/debops/commit/6dd088e413ef4c5dac23d94bb338ae19398985e2",
+            "cve": "PVE-2021-37404",
+            "id": "pyup.io-37404",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Debops 1.2.0 includes a security patch for CVE-2019-11043: In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.",
+            "cve": "CVE-2019-11043",
+            "id": "pyup.io-37733",
+            "specs": [
+                "<1.2.0"
+            ],
+            "v": "<1.2.0"
+        },
+        {
+            "advisory": "Debops 1.7.0 includes a change in its RoundCube configuration. RoundCube will use the user login and password credentials to authenticate to the SMTP (submission) service before sending e-mail messages. This allows the SMTP server to check the message details, block mail with forged sender address, etc. The default configuration uses encrypted connections to the IMAP and SMTP services to ensure confidentiality and security.",
+            "cve": "PVE-2021-37732",
+            "id": "pyup.io-37732",
+            "specs": [
+                "<1.7.0"
+            ],
+            "v": "<1.7.0"
+        },
+        {
+            "advisory": "RoundCube in debops 2.0.0 uses the user login and password credentials to authenticate to the SMTP (submission) service before sending e-mail messages. This allows the SMTP server to check the message details, block mail with forged sender address, etc. The default configuration uses encrypted connections to the IMAP and SMTP services to ensure confidentiality and security.",
+            "cve": "PVE-2021-26403",
+            "id": "pyup.io-26403",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        }
+    ],
+    "decaptcha": [
+        {
+            "advisory": "decaptcha 1.0.0 includes a patch for security vulnerability: pin pillow>=6.2.0",
+            "cve": "PVE-2021-37892",
+            "id": "pyup.io-37892",
+            "specs": [
+                "<1.0.0"
+            ],
+            "v": "<1.0.0"
+        },
+        {
+            "advisory": "decaptcha 1.0.1 includes a patch for security vulnerability: tensorflow==1.15.0",
+            "cve": "PVE-2021-37891",
+            "id": "pyup.io-37891",
+            "specs": [
+                "<1.0.1"
+            ],
+            "v": "<1.0.1"
+        }
+    ],
+    "deeposlandia": [
+        {
+            "advisory": "Deeposlandia 0.6 updates its dependency 'Tensorflow' to v1.15 to include security fixes.",
+            "cve": "CVE-2019-16778",
+            "id": "pyup.io-38133",
+            "specs": [
+                "<0.6"
+            ],
+            "v": "<0.6"
+        },
+        {
+            "advisory": "Deeposlandia 0.6 updates its dependency 'Tensorflow' to v1.15 to include security fixes.",
+            "cve": "PVE-2021-37524",
+            "id": "pyup.io-43828",
+            "specs": [
+                "<0.6"
+            ],
+            "v": "<0.6"
+        },
+        {
+            "advisory": "Deeposlandia 0.6.2 updates pillow to 7.1.1 to fix a moderate-severity vulnerability in pillow <6.2.2.",
+            "cve": "PVE-2021-38285",
+            "id": "pyup.io-38285",
+            "specs": [
+                "<0.6.2"
+            ],
+            "v": "<0.6.2"
+        }
+    ],
+    "definitions": [
+        {
+            "advisory": "There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary python commands resulting in command execution.",
+            "cve": "CVE-2018-20325",
+            "id": "pyup.io-36752",
+            "specs": [
+                "<=0.2.0"
+            ],
+            "v": "<=0.2.0"
+        }
+    ],
+    "defusedexpat": [
+        {
+            "advisory": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.",
+            "cve": "CVE-2013-1664",
+            "id": "pyup.io-33054",
+            "specs": [
+                "<0.3"
+            ],
+            "v": "<0.3"
+        },
+        {
+            "advisory": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.",
+            "cve": "CVE-2013-1665",
+            "id": "pyup.io-33055",
+            "specs": [
+                "<0.3"
+            ],
+            "v": "<0.3"
+        }
+    ],
+    "defusedxml": [
+        {
+            "advisory": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex, Folsom, and Grizzly; Compute (Nova) Essex and Folsom; Cinder Folsom; Django; and possibly other products allow remote attackers to cause a denial of service (resource consumption and crash) via an XML Entity Expansion (XEE) attack.",
+            "cve": "CVE-2013-1664",
+            "id": "pyup.io-33056",
+            "specs": [
+                "<0.4"
+            ],
+            "v": "<0.4"
+        },
+        {
+            "advisory": "The XML libraries for Python 3.4, 3.3, 3.2, 3.1, 2.7, and 2.6, as used in OpenStack Keystone Essex and Folsom, Django, and possibly other products allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, aka an XML External Entity (XXE) attack.",
+            "cve": "CVE-2013-1665",
+            "id": "pyup.io-33057",
+            "specs": [
+                "<0.4"
+            ],
+            "v": "<0.4"
+        }
+    ],
+    "deis": [
+        {
+            "advisory": "Deis 1.4.0 disables SSLv3 in its router module to handle CVE-2014-3566.\r\nhttps://github.com/deis/deis/commit/93bb0fd9cb33e5b8bdcfdc277d15d61b938a88d4",
+            "cve": "CVE-2014-3566",
+            "id": "pyup.io-25691",
+            "specs": [
+                "<1.4.0"
+            ],
+            "v": "<1.4.0"
+        }
+    ],
+    "deltachat": [
+        {
+            "advisory": "Deltachat 1.0.0b17 fixes SQL/injection malformed Chat-Group-Name breakage.",
+            "cve": "PVE-2021-40086",
+            "id": "pyup.io-40086",
+            "specs": [
+                "<1.0.0b17"
+            ],
+            "v": "<1.0.0b17"
+        },
+        {
+            "advisory": "deltachat 1.0.0beta.2 has several security fixes",
+            "cve": "PVE-2021-37922",
+            "id": "pyup.io-37922",
+            "specs": [
+                "<1.0.0beta.2"
+            ],
+            "v": "<1.0.0beta.2"
+        },
+        {
+            "advisory": "Deltachat 1.51.0 improves and harden secure join feature.",
+            "cve": "PVE-2021-40084",
+            "id": "pyup.io-40084",
+            "specs": [
+                "<1.51.0"
+            ],
+            "v": "<1.51.0"
+        }
+    ],
+    "deluge": [
+        {
+            "advisory": "Deluge 2.0.0 updates SSL/TLS Protocol parameters for better security.",
+            "cve": "PVE-2021-37155",
+            "id": "pyup.io-37155",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        }
+    ],
+    "descarteslabs": [
+        {
+            "advisory": "Descarteslabs 1.8.1 upgrades the 'requests' dependency (>=2.25.1, <3) to fix a security issue.",
+            "cve": "PVE-2021-40827",
+            "id": "pyup.io-40827",
+            "specs": [
+                "<1.8.1"
+            ],
+            "v": "<1.8.1"
+        }
+    ],
+    "destringcare": [
+        {
+            "advisory": "Destringcare 0.0.4 removes its dependency 'pycrypto' to fix security vulnerabilities.",
+            "cve": "CVE-2013-7459",
+            "id": "pyup.io-37228",
+            "specs": [
+                "<0.0.4"
+            ],
+            "v": "<0.0.4"
+        },
+        {
+            "advisory": "Destringcare 0.0.4 removes its dependency 'pycrypto' to fix security vulnerabilities.",
+            "cve": "CVE-2018-6594",
+            "id": "pyup.io-42205",
+            "specs": [
+                "<0.0.4"
+            ],
+            "v": "<0.0.4"
+        }
+    ],
+    "determined": [
+        {
+            "advisory": "Determined 0.12.12rc0 upgrades lodash to fix a vulnerability.",
+            "cve": "PVE-2021-38656",
+            "id": "pyup.io-38656",
+            "specs": [
+                "<0.12.12rc0"
+            ],
+            "v": "<0.12.12rc0"
+        },
+        {
+            "advisory": "Determined 0.12.7 resolves new node security vulnerabilities (fd34fec) and updates link to support secure blank targets (d1146d3).",
+            "cve": "PVE-2021-38415",
+            "id": "pyup.io-38415",
+            "specs": [
+                "<0.12.7"
+            ],
+            "v": "<0.12.7"
+        },
+        {
+            "advisory": "Determined 0.14.0 updates the 'storybook' dependency to resolve a GitHub security vulnerability for 'highlight.js'.",
+            "cve": "PVE-2021-39625",
+            "id": "pyup.io-39625",
+            "specs": [
+                "<0.14.0"
+            ],
+            "v": "<0.14.0"
+        },
+        {
+            "advisory": "Determined 0.16.0.dev0 upgrades the 'ws' dependency to patch a security vulnerability.",
+            "cve": "PVE-2021-40670",
+            "id": "pyup.io-40670",
+            "specs": [
+                "<0.16.0.dev0"
+            ],
+            "v": "<0.16.0.dev0"
+        },
+        {
+            "advisory": "Determined 0.16.4 includes a fix to prevent log html injection via unicode.",
+            "cve": "PVE-2021-41255",
+            "id": "pyup.io-41255",
+            "specs": [
+                "<0.16.4"
+            ],
+            "v": "<0.16.4"
+        },
+        {
+            "advisory": "Determined 0.17.0rc0 switches from debian:10.3-slim to ubuntu:20.04 and unattended-upgrades, to get better security upgrades.\r\nhttps://github.com/determined-ai/determined/pull/2914",
+            "cve": "PVE-2021-42148",
+            "id": "pyup.io-42148",
+            "specs": [
+                "<0.17.0rc0"
+            ],
+            "v": "<0.17.0rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41218",
+            "id": "pyup.io-43331",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41210",
+            "id": "pyup.io-43338",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41198",
+            "id": "pyup.io-43344",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41199",
+            "id": "pyup.io-42944",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41196",
+            "id": "pyup.io-43315",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41203",
+            "id": "pyup.io-43316",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41200",
+            "id": "pyup.io-43317",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41217",
+            "id": "pyup.io-43318",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41214",
+            "id": "pyup.io-43319",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41219",
+            "id": "pyup.io-43320",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41225",
+            "id": "pyup.io-43321",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41226",
+            "id": "pyup.io-43322",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41221",
+            "id": "pyup.io-43324",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41209",
+            "id": "pyup.io-43325",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41213",
+            "id": "pyup.io-43326",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41204",
+            "id": "pyup.io-43327",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41228",
+            "id": "pyup.io-43328",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41222",
+            "id": "pyup.io-43329",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41224",
+            "id": "pyup.io-43330",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41216",
+            "id": "pyup.io-43332",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41227",
+            "id": "pyup.io-43323",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41208",
+            "id": "pyup.io-43334",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41206",
+            "id": "pyup.io-43335",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41205",
+            "id": "pyup.io-43336",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41212",
+            "id": "pyup.io-43337",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41207",
+            "id": "pyup.io-43339",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41202",
+            "id": "pyup.io-43340",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41201",
+            "id": "pyup.io-43341",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41197",
+            "id": "pyup.io-43342",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41195",
+            "id": "pyup.io-43343",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.4rc0 includes images updates (to Tensorflow v2.4.4, v2.5.2 and v2.6.2) to include security fixes.",
+            "cve": "CVE-2021-41215",
+            "id": "pyup.io-43333",
+            "specs": [
+                "<0.17.4rc0"
+            ],
+            "v": "<0.17.4rc0"
+        },
+        {
+            "advisory": "Determined 0.17.5 updates its dependency 'swagger-ui' to v4.1.0 to include a fix for a XSS vulnerability.\r\nhttps://github.com/determined-ai/determined/pull/3234",
+            "cve": "PVE-2021-43348",
+            "id": "pyup.io-43348",
+            "specs": [
+                "<0.17.5"
+            ],
+            "v": "<0.17.5"
+        },
+        {
+            "advisory": "Determined 0.17.6 updates env images for security reasons.\r\nhttps://github.com/determined-ai/determined/pull/3415/commits/18fc5278cd589089dd753f687ec606499117029d",
+            "cve": "PVE-2022-44642",
+            "id": "pyup.io-44642",
+            "specs": [
+                "<0.17.6"
+            ],
+            "v": "<0.17.6"
+        }
+    ],
+    "devito": [
+        {
+            "advisory": "Devito version 4.3-beta includes a fix to handle ARM processors vulnerabilities.\r\nhttps://github.com/devitocodes/devito/pull/1515",
+            "cve": "PVE-2021-42102",
+            "id": "pyup.io-42102",
+            "specs": [
+                "<4.3-beta"
+            ],
+            "v": "<4.3-beta"
+        }
+    ],
+    "devpi-ldap": [
+        {
+            "advisory": "Devpi-ldap version 2.0.0 includes a security patch for the function 'init' in 'devpi_ldap/main.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\n https://github.com/devpi/devpi-ldap/commit/8da2b3c1ed44e8223ce006a3737dc6a8446e945d#diff-ecbfd22333fa5942c9fe7a999189222d1ca71d72a1a89d7a1f55d559671eb200",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41316",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        }
+    ],
+    "diffpriv": [
+        {
+            "advisory": "Diffpriv 1.0.0rc1 includes a security fix: with the 'diff' and 'enc' modules, parameters were stored in Python memory, and never removed. This commit deletes these parameters and helps prevent attackers from gaining access to these parameters, which can help them gain access to the original text and/or data.",
+            "cve": "PVE-2021-40539",
+            "id": "pyup.io-40539",
+            "specs": [
+                "<1.0.0rc1"
+            ],
+            "v": "<1.0.0rc1"
+        }
+    ],
+    "diffsync": [
+        {
+            "advisory": "Diffsync 1.4.0 updates its dependency 'pydantic' minimum version to v1.7.4 to include a security fix.",
+            "cve": "CVE-2021-29510",
+            "id": "pyup.io-44673",
+            "specs": [
+                "<1.4.0"
+            ],
+            "v": "<1.4.0"
+        }
+    ],
+    "digitalmarketplace-utils": [
+        {
+            "advisory": "Digitalmarketplace-utils versions before v22.0.0 included vulnerabilities where untrusted input might result in susceptibility to a cross-site scripting (XSS) exploit.\r\nhttps://github.com/Crown-Commercial-Service/digitalmarketplace-utils/pull/286",
+            "cve": "PVE-2021-39653",
+            "id": "pyup.io-39653",
+            "specs": [
+                "<22.0.0"
+            ],
+            "v": "<22.0.0"
+        }
+    ],
+    "dirac": [
+        {
+            "advisory": "The OpenSSL public API function X509_issuer_and_serial_hash() attempts to create a unique hash value based on the issuer and serial number data contained within an X509 certificate. However it fails to correctly handle any errors that may occur while parsing the issuer field (which might occur if the issuer field is maliciously constructed). This may subsequently result in a NULL pointer deref and a crash leading to a potential denial of service attack. The function X509_issuer_and_serial_hash() is never directly called by OpenSSL itself so applications are only vulnerable if they use this function directly and they use it on certificates that may have been obtained from untrusted sources. OpenSSL versions 1.1.1i and below are affected by this issue. Users of these versions should upgrade to OpenSSL 1.1.1j. OpenSSL versions 1.0.2x and below are affected by this issue. However OpenSSL 1.0.2 is out of support and no longer receiving public updates. Premium support customers of OpenSSL 1.0.2 should upgrade to 1.0.2y. Other users should upgrade to 1.1.1j. Fixed in OpenSSL 1.1.1j (Affected 1.1.1-1.1.1i). Fixed in OpenSSL 1.0.2y (Affected 1.0.2-1.0.2x).",
+            "cve": "CVE-2021-23841",
+            "id": "pyup.io-42328",
+            "specs": [
+                "<2.1"
+            ],
+            "v": "<2.1"
+        },
+        {
+            "advisory": "Dirac 8.0.0a13 fixes an arbitrary code execution vulnerability in JEncode.\r\nhttps://github.com/DIRACGrid/DIRAC/pull/5810",
+            "cve": "PVE-2022-44691",
+            "id": "pyup.io-44691",
+            "specs": [
+                "<8.0.0a13"
+            ],
+            "v": "<8.0.0a13"
+        }
+    ],
+    "directory-client-core": [
+        {
+            "advisory": "Directory-client-core 5.1.1 upgrades a vulnerable Django version to Django 1.11.22.",
+            "cve": "PVE-2021-38689",
+            "id": "pyup.io-38689",
+            "specs": [
+                "<5.1.1"
+            ],
+            "v": "<5.1.1"
+        }
+    ],
+    "directory-components": [
+        {
+            "advisory": "Directory-components 25.0.1 includes an update to fix the lodash vulnerability.",
+            "cve": "PVE-2021-37298",
+            "id": "pyup.io-37298",
+            "specs": [
+                "<25.0.1"
+            ],
+            "v": "<25.0.1"
+        },
+        {
+            "advisory": "The `django_language` and `country` cookies in directory-components 33.0.0 set as secure and http-only.",
+            "cve": "PVE-2021-37475",
+            "id": "pyup.io-37475",
+            "specs": [
+                "<33.0.0"
+            ],
+            "v": "<33.0.0"
+        }
+    ],
+    "dirsearch": [
+        {
+            "advisory": "Dirsearch 0.4.2 fixes a CSV Injection vulnerability. See also: <https://www.exploit-db.com/exploits/49370>.",
+            "cve": "PVE-2021-40799",
+            "id": "pyup.io-40799",
+            "specs": [
+                "<0.4.2"
+            ],
+            "v": "<0.4.2"
+        }
+    ],
+    "discogs-client": [
+        {
+            "advisory": "Discogs-client 2.2.2 updates dependency 'PyYAML' to v4.2b1 to resolve security vulnerabilities.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-42495",
+            "specs": [
+                "<2.2.2"
+            ],
+            "v": "<2.2.2"
+        },
+        {
+            "advisory": "Discogs-client 2.2.2 updates dependency 'requests' to v2.20.0 to resolve security vulnerabilities.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36787",
+            "specs": [
+                "<2.2.2"
+            ],
+            "v": "<2.2.2"
+        },
+        {
+            "advisory": "Discogs-client 2.2.2 updates dependency 'requests' to v2.20.0 to resolve security vulnerabilities.",
+            "cve": "CVE-2014-1829",
+            "id": "pyup.io-42494",
+            "specs": [
+                "<2.2.2"
+            ],
+            "v": "<2.2.2"
+        }
+    ],
+    "discord-ext-slash": [
+        {
+            "advisory": "For some extra security, Discord-ext-slash 0.2.3 looks up commands by both their name and guild ID if their command ID fails to return any results (it returns a warning with 'SlashWarning' both times, and returns an error if still no command is found.)",
+            "cve": "PVE-2021-39641",
+            "id": "pyup.io-39641",
+            "specs": [
+                "<0.2.3"
+            ],
+            "v": "<0.2.3"
+        }
+    ],
+    "discordpie": [
+        {
+            "advisory": "Discordpie 0.5.1 includes a security patch. No details are given.",
+            "cve": "PVE-2021-38343",
+            "id": "pyup.io-38343",
+            "specs": [
+                "<0.5.1"
+            ],
+            "v": "<0.5.1"
+        }
+    ],
+    "dispatch": [
+        {
+            "advisory": "Dispatch 1.3.16 updates its dependency 'Django' to v3.1.8 to include security fixes.",
+            "cve": "CVE-2021-23336",
+            "id": "pyup.io-40402",
+            "specs": [
+                "<1.3.16"
+            ],
+            "v": "<1.3.16"
+        },
+        {
+            "advisory": "Dispatch 1.3.16 updates its dependency 'Django' to v3.1.8 to include security fixes.",
+            "cve": "CVE-2021-28658",
+            "id": "pyup.io-43729",
+            "specs": [
+                "<1.3.16"
+            ],
+            "v": "<1.3.16"
+        }
+    ],
+    "divina": [
+        {
+            "advisory": "Divina 0.1 adds a security group with ssh access enabled on partitioning EC2.",
+            "cve": "PVE-2021-41294",
+            "id": "pyup.io-41294",
+            "specs": [
+                "<0.1"
+            ],
+            "v": "<0.1"
+        },
+        {
+            "advisory": "Divina 2021.8.1 adds a security group with ssh access enabled for the EC2 partitioning.",
+            "cve": "PVE-2021-41237",
+            "id": "pyup.io-41237",
+            "specs": [
+                "<2021.8.1"
+            ],
+            "v": "<2021.8.1"
+        }
+    ],
+    "diycrate": [
+        {
+            "advisory": "Diycrate version 0.2.11.0 includes a security patch for the function 'oauth_dance' in 'diycrate/oauth_utils.py'. It contained requests calls with verify=False, disabling SSL certificate checks.\r\nhttps://github.com/jheld/diycrate/commit/40e51a586f16da215a3ff8096cfa64e23b0fa5cb#diff-7772b99d74abcfaa2bf013c9a4647b2b42cec23f84a79a5d4de0ef6973720971",
+            "cve": "PVE-2021-41317",
+            "id": "pyup.io-41317",
+            "specs": [
+                "<0.2.11.0"
+            ],
+            "v": "<0.2.11.0"
+        }
+    ],
+    "djangae": [
+        {
+            "advisory": "djangae before 0.9.4 uses Django 1.7 which is no longer supported (EOL, with known security issues).",
+            "cve": "PVE-2021-25693",
+            "id": "pyup.io-25693",
+            "specs": [
+                "<0.9.4"
+            ],
+            "v": "<0.9.4"
+        }
+    ],
+    "django": [
+        {
+            "advisory": "The Admin media handler in core/servers/basehttp.py in Django 1.0 and 0.96 does not properly map URL requests to expected \"static media files,\" which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a crafted URL.",
+            "cve": "CVE-2009-2659",
+            "id": "pyup.io-25694",
+            "specs": [
+                "<1.0"
+            ],
+            "v": "<1.0"
+        },
+        {
+            "advisory": "Algorithmic complexity vulnerability in the forms library in Django 1.0 before 1.0.4 and 1.1 before 1.1.1 allows remote attackers to cause a denial of service (CPU consumption) via a crafted (1) EmailField (email address) or (2) URLField (URL) that triggers a large amount of backtracking in a regular expression.",
+            "cve": "CVE-2009-3695",
+            "id": "pyup.io-25695",
+            "specs": [
+                "<1.0.4",
+                ">=1.1,<1.1.1"
+            ],
+            "v": "<1.0.4,>=1.1,<1.1.1"
+        },
+        {
+            "advisory": "The password reset functionality in django.contrib.auth in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not validate the length of a string representing a base36 timestamp, which allows remote attackers to cause a denial of service (resource consumption) via a URL that specifies a large base36 integer.",
+            "cve": "CVE-2010-4535",
+            "id": "pyup.io-33059",
+            "specs": [
+                "<1.1.3",
+                ">=1.2,<1.2.4"
+            ],
+            "v": "<1.1.3,>=1.2,<1.2.4"
+        },
+        {
+            "advisory": "The administrative interface in django.contrib.admin in Django before 1.1.3, 1.2.x before 1.2.4, and 1.3.x before 1.3 beta 1 does not properly restrict use of the query string to perform certain object filtering, which allows remote authenticated users to obtain sensitive information via a series of requests containing regular expressions, as demonstrated by a created_by__password__regex parameter.",
+            "cve": "CVE-2010-4534",
+            "id": "pyup.io-33058",
+            "specs": [
+                "<1.1.3",
+                ">=1.2,<1.2.4"
+            ],
+            "v": "<1.1.3,>=1.2,<1.2.4"
+        },
+        {
+            "advisory": "Cross-site scripting (XSS) vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 might allow remote attackers to inject arbitrary web script or HTML via a filename associated with a file upload.",
+            "cve": "CVE-2011-0697",
+            "id": "pyup.io-33061",
+            "specs": [
+                "<1.1.4"
+            ],
+            "v": "<1.1.4"
+        },
+        {
+            "advisory": "Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged AJAX requests that leverage a \"combination of browser plugins and redirects,\" a related issue to CVE-2011-0447.",
+            "cve": "CVE-2011-0696",
+            "id": "pyup.io-33060",
+            "specs": [
+                "<1.1.4",
+                ">=1.2,<1.2.5"
+            ],
+            "v": "<1.1.4,>=1.2,<1.2.5"
+        },
+        {
+            "advisory": "Directory traversal vulnerability in Django 1.1.x before 1.1.4 and 1.2.x before 1.2.5 on Windows might allow remote attackers to read or execute files via a / (slash) character in a key in a session cookie, related to session replays.",
+            "cve": "CVE-2011-0698",
+            "id": "pyup.io-33062",
+            "specs": [
+                "<1.1.4",
+                ">=1.2,<1.2.5"
+            ],
+            "v": "<1.1.4,>=1.2,<1.2.5"
+        },
+        {
+            "advisory": "Django 1.11.x before 1.11.19 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.",
+            "cve": "CVE-2019-6975",
+            "id": "pyup.io-36885",
+            "specs": [
+                "<1.11.19,>=1.11.0"
+            ],
+            "v": "<1.11.19,>=1.11.0"
+        },
+        {
+            "advisory": "An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3. An HTTP request is not redirected to HTTPS when the SECURE_PROXY_SSL_HEADER and SECURE_SSL_REDIRECT settings are used, and the proxy connects to Django via HTTPS. In other words, django.http.HttpRequest.scheme has incorrect behavior when a client uses HTTP.",
+            "cve": "CVE-2019-12781",
+            "id": "pyup.io-37261",
+            "specs": [
+                "<1.11.22,>1.11",
+                "<2.1.10,>2.1",
+                "<2.2.3,>2.2"
+            ],
+            "v": "<1.11.22,>1.11,<2.1.10,>2.1,<2.2.3,>2.2"
+        },
+        {
+            "advisory": "Django 1.11.22 fixes a security issue in 1.11.21.",
+            "cve": "PVE-2021-37259",
+            "id": "pyup.io-37259",
+            "specs": [
+                "<1.11.22,>1.11.21"
+            ],
+            "v": "<1.11.22,>1.11.21"
+        },
+        {
+            "advisory": "Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a password reset token for the matched user account. (One mitigation in the new releases is to send password reset tokens only to the registered user email address.) See CVE-2019-19844.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-37771",
+            "specs": [
+                "<1.11.27",
+                ">=2.0a1,<2.2.9",
+                ">=3.0a1,<3.0.1"
+            ],
+            "v": "<1.11.27,>=2.0a1,<2.2.9,>=3.0a1,<3.0.1"
+        },
+        {
+            "advisory": "Cross-site scripting (XSS) vulnerability in Django 1.2.x before 1.2.2 allows remote attackers to inject arbitrary web script or HTML via a csrfmiddlewaretoken (aka csrf_token) cookie.",
+            "cve": "CVE-2010-3082",
+            "id": "pyup.io-25701",
+            "specs": [
+                "<1.2.2"
+            ],
+            "v": "<1.2.2"
+        },
+        {
+            "advisory": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 originally tests a URL's validity through a HEAD request, but then uses a GET request for the new target URL in the case of a redirect, which might allow remote attackers to trigger arbitrary GET requests with an unintended source IP address via a crafted Location header.",
+            "cve": "CVE-2011-4138",
+            "id": "pyup.io-33065",
+            "specs": [
+                "<1.2.7",
+                ">=1.3,<1.3.1"
+            ],
+            "v": "<1.2.7,>=1.3,<1.3.1"
+        },
+        {
+            "advisory": "The CSRF protection mechanism in Django through 1.2.7 and 1.3.x through 1.3.1 does not properly handle web-server configurations supporting arbitrary HTTP Host headers, which allows remote attackers to trigger unauthenticated forged requests via vectors involving a DNS CNAME record and a web page containing JavaScript code.",
+            "cve": "CVE-2011-4140",
+            "id": "pyup.io-33066",
+            "specs": [
+                "<1.2.7",
+                ">=1.3,<1.3.1"
+            ],
+            "v": "<1.2.7,>=1.3,<1.3.1"
+        },
+        {
+            "advisory": "django.contrib.sessions in Django before 1.2.7 and 1.3.x before 1.3.1, when session data is stored in the cache, uses the root namespace for both session identifiers and application-data keys, which allows remote attackers to modify a session by triggering use of a key that is equal to that session's identifier.",
+            "cve": "CVE-2011-4136",
+            "id": "pyup.io-33063",
+            "specs": [
+                "<1.2.7",
+                ">=1.3,<1.3.1"
+            ],
+            "v": "<1.2.7,>=1.3,<1.3.1"
+        },
+        {
+            "advisory": "The verify_exists functionality in the URLField implementation in Django before 1.2.7 and 1.3.x before 1.3.1 relies on Python libraries that attempt access to an arbitrary URL with no timeout, which allows remote attackers to cause a denial of service (resource consumption) via a URL associated with (1) a slow response, (2) a completed TCP connection with no application data sent, or (3) a large amount of application data, a related issue to CVE-2011-1521.",
+            "cve": "CVE-2011-4137",
+            "id": "pyup.io-33064",
+            "specs": [
+                "<1.2.7",
+                ">=1.3,<1.3.1"
+            ],
+            "v": "<1.2.7,>=1.3,<1.3.1"
+        },
+        {
+            "advisory": "The (1) django.http.HttpResponseRedirect and (2) django.http.HttpResponsePermanentRedirect classes in Django before 1.3.2 and 1.4.x before 1.4.1 do not validate the scheme of a redirect target, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via a data: URL.",
+            "cve": "CVE-2012-3442",
+            "id": "pyup.io-33067",
+            "specs": [
+                "<1.3.2",
+                ">=1.4,<1.4.1"
+            ],
+            "v": "<1.3.2,>=1.4,<1.4.1"
+        },
+        {
+            "advisory": "The django.forms.ImageField class in the form system in Django before 1.3.2 and 1.4.x before 1.4.1 completely decompresses image data during image validation, which allows remote attackers to cause a denial of service (memory consumption) by uploading an image file.",
+            "cve": "CVE-2012-3443",
+            "id": "pyup.io-33068",
+            "specs": [
+                "<1.3.2",
+                ">=1.4,<1.4.1"
+            ],
+            "v": "<1.3.2,>=1.4,<1.4.1"
+        },
+        {
+            "advisory": "The get_image_dimensions function in the image-handling functionality in Django before 1.3.2 and 1.4.x before 1.4.1 uses a constant chunk size in all attempts to determine dimensions, which allows remote attackers to cause a denial of service (process or thread consumption) via a large TIFF image.",
+            "cve": "CVE-2012-3444",
+            "id": "pyup.io-33069",
+            "specs": [
+                "<1.3.2",
+                ">=1.4,<1.4.1"
+            ],
+            "v": "<1.3.2,>=1.4,<1.4.1"
+        },
+        {
+            "advisory": "The django.http.HttpRequest.get_host function in Django 1.3.x before 1.3.4 and 1.4.x before 1.4.2 allows remote attackers to generate and display arbitrary URLs via crafted username and password Host header values.",
+            "cve": "CVE-2012-4520",
+            "id": "pyup.io-25709",
+            "specs": [
+                "<1.3.4",
+                ">=1.4,<1.4.2"
+            ],
+            "v": "<1.3.4,>=1.4,<1.4.2"
+        },
+        {
+            "advisory": "The administrative interface (contrib.admin) in Django before 1.4.14, 1.5.x before 1.5.9, 1.6.x before 1.6.6, and 1.7 before release candidate 3 does not check if a field represents a relationship between models, which allows remote authenticated users to obtain sensitive information via a to_field parameter in a popup action to an admin change form page, as demonstrated by a /admin/auth/user/?pop=1&t=password URI. See: CVE-2014-0483.",
+            "cve": "CVE-2014-0483",
+            "id": "pyup.io-35516",
+            "specs": [
+                "<1.4.14",
+                ">=1.5,<1.5.9",
+                ">=1.6,<1.6.6",
+                ">=1.7,<1.7rc3"
+            ],
+            "v": "<1.4.14,>=1.5,<1.5.9,>=1.6,<1.6.6,>=1.7,<1.7rc3"
+        },
+        {
+            "advisory": "The django.util.http.is_safe_url function in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 does not properly handle leading whitespaces, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL, related to redirect URLs, as demonstrated by a \"\\njavascript:\" URL.",
+            "cve": "CVE-2015-0220",
+            "id": "pyup.io-33071",
+            "specs": [
+                "<1.4.18",
+                ">=1.6,<1.6.10",
+                ">=1.7,<1.7.3"
+            ],
+            "v": "<1.4.18,>=1.6,<1.6.10,>=1.7,<1.7.3"
+        },
+        {
+            "advisory": "The django.views.static.serve view in Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 reads files an entire line at a time, which allows remote attackers to cause a denial of service (memory consumption) via a long line in a file.",
+            "cve": "CVE-2015-0221",
+            "id": "pyup.io-33072",
+            "specs": [
+                "<1.4.18",
+                ">=1.6,<1.6.10",
+                ">=1.7,<1.7.3"
+            ],
+            "v": "<1.4.18,>=1.6,<1.6.10,>=1.7,<1.7.3"
+        },
+        {
+            "advisory": "Django before 1.4.18, 1.6.x before 1.6.10, and 1.7.x before 1.7.3 allows remote attackers to spoof WSGI headers by using an _ (underscore) character instead of a - (dash) character in an HTTP header, as demonstrated by an X-Auth_User header.",
+            "cve": "CVE-2015-0219",
+            "id": "pyup.io-33070",
+            "specs": [
+                "<1.4.18",
+                ">=1.7,<1.7.3",
+                ">=1.6,<1.6.10"
+            ],
+            "v": "<1.4.18,>=1.7,<1.7.3,>=1.6,<1.6.10"
+        },
+        {
+            "advisory": "The utils.http.is_safe_url function in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks or possibly conduct cross-site scripting (XSS) attacks via a URL containing basic authentication, as demonstrated by http://mysite.example.com\\@attacker.com.",
+            "cve": "CVE-2016-2512",
+            "id": "pyup.io-33073",
+            "specs": [
+                "<1.8.10",
+                ">=1.9,<1.9.3"
+            ],
+            "v": "<1.8.10,>=1.9,<1.9.3"
+        },
+        {
+            "advisory": "The password hasher in contrib/auth/hashers.py in Django before 1.8.10 and 1.9.x before 1.9.3 allows remote attackers to enumerate users via a timing attack involving login requests.",
+            "cve": "CVE-2016-2513",
+            "id": "pyup.io-33074",
+            "specs": [
+                "<1.8.10",
+                ">=1.9,<1.9.3"
+            ],
+            "v": "<1.8.10,>=1.9,<1.9.3"
+        },
+        {
+            "advisory": "An issue was discovered in Django 2.1 before 2.1.2, in which unprivileged users can read the password hashes of arbitrary accounts. The read-only password widget used by the Django Admin to display an obfuscated password hash was bypassed if a user has only the \"view\" permission (new in Django 2.1), resulting in display of the entire password hash to those users. This may result in a vulnerability for sites with legacy user accounts using insecure hashes.",
+            "cve": "CVE-2018-16984",
+            "id": "pyup.io-36522",
+            "specs": [
+                "<2.1.2,>=2.1"
+            ],
+            "v": "<2.1.2,>=2.1"
+        },
+        {
+            "advisory": "django before 2.1.2 fixes a security bug in 2.1.x. \r\nIf an admin user has the change permission to the user model, only part of the\r\npassword hash is displayed in the change form. Admin users with the view (but\r\nnot change) permission to the user model were displayed the entire hash.",
+            "cve": "CVE-2018-16984",
+            "id": "pyup.io-36517",
+            "specs": [
+                "<2.1.2,>=2.1.0"
+            ],
+            "v": "<2.1.2,>=2.1.0"
+        },
+        {
+            "advisory": "Django 2.1.x before 2.1.6  allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.",
+            "cve": "CVE-2019-6975",
+            "id": "pyup.io-36883",
+            "specs": [
+                "<2.1.6,>=2.1.0"
+            ],
+            "v": "<2.1.6,>=2.1.0"
+        },
+        {
+            "advisory": "Django versions 2.2.24, 3.1.12, and 3.2.4 include a fix for CVE-2021-33203: Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs. Staff members could use the TemplateDetailView view to check the existence of arbitrary files. Additionally, if (and only if) the default admindocs templates have been customized by application developers to also show file contents, then not only the existence but also the file contents would have been exposed. In other words, there is directory traversal outside of the template root directories. See CVE-2021-33203.\r\nhttps://www.djangoproject.com/weblog/2021/jun/02/security-releases/\r\nhttps://docs.djangoproject.com/en/3.2/releases/security/\r\nhttps://groups.google.com/forum/#%21forum/django-announce",
+            "cve": "CVE-2021-33203",
+            "id": "pyup.io-40637",
+            "specs": [
+                "<2.2.24",
+                ">=3.0a1,<3.1.12",
+                ">=3.2a1,<3.2.4"
+            ],
+            "v": "<2.2.24,>=3.0a1,<3.1.12,>=3.2a1,<3.2.4"
+        },
+        {
+            "advisory": "Django versions 2.2.25, 3.1.14 and 3.2.10 include a fix for CVE-2021-44420: In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream access control based on URL paths.\r\nhttps://www.djangoproject.com/weblog/2021/dec/07/security-releases/",
+            "cve": "CVE-2021-44420",
+            "id": "pyup.io-43041",
+            "specs": [
+                "<2.2.25",
+                ">=3.2a1,<3.2.10",
+                ">=3.1a1,<3.1.14"
+            ],
+            "v": "<2.2.25,>=3.2a1,<3.2.10,>=3.1a1,<3.1.14"
+        },
+        {
+            "advisory": "Django 2.2.26, 3.2.11 and 4.0.1 include a fix for CVE-2021-45116: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. Due to leveraging the Django Template Language's variable resolution logic, the dictsort template filter was potentially vulnerable to information disclosure, or an unintended method call, if passed a suitably crafted key.\r\nhttps://www.djangoproject.com/weblog/2022/jan/04/security-releases/",
+            "cve": "CVE-2021-45116",
+            "id": "pyup.io-44427",
+            "specs": [
+                "<2.2.26",
+                ">=3.0a1,<3.2.11",
+                ">=4.0a1,<4.0.1"
+            ],
+            "v": "<2.2.26,>=3.0a1,<3.2.11,>=4.0a1,<4.0.1"
+        },
+        {
+            "advisory": "Django 2.2.26, 3.2.11 and 4.0.1 include a fix for CVE-2021-45115: An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1. UserAttributeSimilarityValidator incurred significant overhead in evaluating a submitted password that was artificially large in relation to the comparison values. In a situation where access to user registration was unrestricted, this provided a potential vector for a denial-of-service attack.\r\nhttps://www.djangoproject.com/weblog/2022/jan/04/security-releases/",
+            "cve": "CVE-2021-45115",
+            "id": "pyup.io-44423",
+            "specs": [
+                "<2.2.26",
+                ">=3.0a1,<3.2.11",
+                ">=4.0a1,<4.0.1"
+            ],
+            "v": "<2.2.26,>=3.0a1,<3.2.11,>=4.0a1,<4.0.1"
+        },
+        {
+            "advisory": "Django 2.2.26, 3.2.11 and 4.0.1 include a fix for CVE-2021-45452: Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directly passed to it.\r\nhttps://www.djangoproject.com/weblog/2022/jan/04/security-releases/",
+            "cve": "CVE-2021-45452",
+            "id": "pyup.io-44426",
+            "specs": [
+                "<2.2.26",
+                ">=3.0a1,<3.2.11",
+                ">=4.0a1,<4.0.1"
+            ],
+            "v": "<2.2.26,>=3.0a1,<3.2.11,>=4.0a1,<4.0.1"
+        },
+        {
+            "advisory": "django 1.11.15 fixes a phishing security issue in 1.11.14 if the :class:`~django.middleware.common.CommonMiddleware` and the :setting:`APPEND_SLASH` setting are both enabled, and if the project has a URL pattern that accepts any path ending in a slash. See: CVE-2018-14574.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-36359",
+            "specs": [
+                "==1.11.14"
+            ],
+            "v": "==1.11.14"
+        },
+        {
+            "advisory": "Django 1.11.21 fixes a security issue in 1.11.20: CVE-2019-12308 (AdminURLFieldWidget XSS).",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-37186",
+            "specs": [
+                "==1.11.20"
+            ],
+            "v": "==1.11.20"
+        },
+        {
+            "advisory": "Django 1.11.23 fixes CVE-2019-14233 in 1.11.22.",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-39601",
+            "specs": [
+                "==1.11.22"
+            ],
+            "v": "==1.11.22"
+        },
+        {
+            "advisory": "Django 1.11.23 fixes CVE-2019-14235 in 1.11.22.",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-39599",
+            "specs": [
+                "==1.11.22"
+            ],
+            "v": "==1.11.22"
+        },
+        {
+            "advisory": "Django 1.11.23 fixes CVE-2019-14234 in 1.11.22.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-39600",
+            "specs": [
+                "==1.11.22"
+            ],
+            "v": "==1.11.22"
+        },
+        {
+            "advisory": "Django 1.11.23 fixes the following security issue in 1.11.22: CVE-2019-14232.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-37326",
+            "specs": [
+                "==1.11.22"
+            ],
+            "v": "==1.11.22"
+        },
+        {
+            "advisory": "Django 1.11.27 fixes CVE-2019-19844 in 1.11.26: potential account hijack via password reset form.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-37663",
+            "specs": [
+                "==1.11.26"
+            ],
+            "v": "==1.11.26"
+        },
+        {
+            "advisory": "Django 1.11.28 fixes a security issue in 1.11.27. Potential SQL injection via `StringAgg(delimiter)`. See: CVE-2020-7471.",
+            "cve": "CVE-2020-7471",
+            "id": "pyup.io-37817",
+            "specs": [
+                "==1.11.27"
+            ],
+            "v": "==1.11.27"
+        },
+        {
+            "advisory": "django 2.0.8 fixes a security issue and several bugs in 2.0.7 if the :class:`~django.middleware.common.CommonMiddleware` and the\r\n:setting:`APPEND_SLASH` setting are both enabled, and if the project has a\r\nURL pattern that accepts any path ending in a slash. See: CVE-2018-14574.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-36358",
+            "specs": [
+                "==2.0.7"
+            ],
+            "v": "==2.0.7"
+        },
+        {
+            "advisory": "Django 2.1.11 fixes a security issue in 2.1.10:\r\n- CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-37325",
+            "specs": [
+                "==2.1.10"
+            ],
+            "v": "==2.1.10"
+        },
+        {
+            "advisory": "Django 2.1.11 fixes security issues in 2.1.10:\r\n- CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-39598",
+            "specs": [
+                "==2.1.10"
+            ],
+            "v": "==2.1.10"
+        },
+        {
+            "advisory": "Django 2.1.11 fixes security issues in 2.1.10:\r\n- CVE-2019-14235: Potential memory exhaustion in ``django.utils.encoding.uri_to_iri()``",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-39596",
+            "specs": [
+                "==2.1.10"
+            ],
+            "v": "==2.1.10"
+        },
+        {
+            "advisory": "Django 2.1.11 fixes security issues in 2.1.10:\r\n- CVE-2019-14234: SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField``",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-39597",
+            "specs": [
+                "==2.1.10"
+            ],
+            "v": "==2.1.10"
+        },
+        {
+            "advisory": "Django 2.1.15 fixes CVE-2019-19118 in 2.1.14: Privilege escalation in the Django admin.",
+            "cve": "CVE-2019-19118",
+            "id": "pyup.io-37657",
+            "specs": [
+                "==2.1.14"
+            ],
+            "v": "==2.1.14"
+        },
+        {
+            "advisory": "Django 2.1.9 fixes security issues in 2.1.8: CVE-2019-12308 (AdminURLFieldWidget XSS).",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-37185",
+            "specs": [
+                "==2.1.8"
+            ],
+            "v": "==2.1.8"
+        },
+        {
+            "advisory": "Django 2.2.2 fixes security issues in 2.2.1: CVE-2019-12308 (AdminURLFieldWidget XSS).",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-37184",
+            "specs": [
+                "==2.2.1"
+            ],
+            "v": "==2.2.1"
+        },
+        {
+            "advisory": "Django 2.2.18 fixes a security issue with severity \"low\" in 2.2.17 (CVE-2021-3281).",
+            "cve": "CVE-2021-3281",
+            "id": "pyup.io-39523",
+            "specs": [
+                "==2.2.17"
+            ],
+            "v": "==2.2.17"
+        },
+        {
+            "advisory": "Django 2.2.3 fixes CVE-2019-12781 in 2.2.2: incorrect HTTP detection with reverse-proxy connecting via HTTPS.",
+            "cve": "CVE-2019-12781",
+            "id": "pyup.io-37324",
+            "specs": [
+                "==2.2.2"
+            ],
+            "v": "==2.2.2"
+        },
+        {
+            "advisory": "Django 2.2.24 fixes security issue in 2.2.23 (CVE-2021-33571).",
+            "cve": "PVE-2021-40597",
+            "id": "pyup.io-40597",
+            "specs": [
+                "==2.2.23"
+            ],
+            "v": "==2.2.23"
+        },
+        {
+            "advisory": "Django 2.2.24 fixes security issue in 2.2.23 (CVE-2021-33203).",
+            "cve": "PVE-2021-40586",
+            "id": "pyup.io-40586",
+            "specs": [
+                "==2.2.23"
+            ],
+            "v": "==2.2.23"
+        },
+        {
+            "advisory": "Django 2.2.4 fixes security issues in 2.2.3:\r\n- CVE-2019-14233: Denial-of-service possibility in ``strip_tags()``",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-39593",
+            "specs": [
+                "==2.2.3"
+            ],
+            "v": "==2.2.3"
+        },
+        {
+            "advisory": "Django 2.2.4 fixes security issues in 2.2.3:\r\n- CVE-2019-14234: SQL injection possibility in key and index lookups for ``JSONField``/``HStoreField``",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-39592",
+            "specs": [
+                "==2.2.3"
+            ],
+            "v": "==2.2.3"
+        },
+        {
+            "advisory": "Django 2.2.4 fixes security issues in 2.2.3:\r\n- CVE-2019-14235: Potential memory exhaustion in ``django.utils.encoding.uri_to_iri()``",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-39591",
+            "specs": [
+                "==2.2.3"
+            ],
+            "v": "==2.2.3"
+        },
+        {
+            "advisory": "Django 2.2.4 fixes a security issue in 2.2.3:\r\n- CVE-2019-14232: Denial-of-service possibility in ``django.utils.text.Truncator``",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-37323",
+            "specs": [
+                "==2.2.3"
+            ],
+            "v": "==2.2.3"
+        },
+        {
+            "advisory": "Django 2.2.8 fixes CVE-2019-19118 in 2.2.7: Privilege escalation in the Django admin.",
+            "cve": "CVE-2019-19118",
+            "id": "pyup.io-37656",
+            "specs": [
+                "==2.2.7"
+            ],
+            "v": "==2.2.7"
+        },
+        {
+            "advisory": "Django 2.2.9 fixes CVE-2019-19844 in 2.2.8: potential account hijack via password reset form.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-37662",
+            "specs": [
+                "==2.2.8"
+            ],
+            "v": "==2.2.8"
+        },
+        {
+            "advisory": "Django 2.2.10 fixes a security issue in 2.2.9. Potential SQL injection via `StringAgg(delimiter)`. See CVE-2020-7471.",
+            "cve": "CVE-2020-7471",
+            "id": "pyup.io-37816",
+            "specs": [
+                "==2.2.9"
+            ],
+            "v": "==2.2.9"
+        },
+        {
+            "advisory": "Django 3.0.1 fixes CVE-2019-19844 in 3.0: potential account hijack via password reset form.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-37661",
+            "specs": [
+                "==3.0"
+            ],
+            "v": "==3.0"
+        },
+        {
+            "advisory": "Django 3.0.12 fixes a security issue with severity \"low\" in 3.0.11 (CVE-2021-3281).",
+            "cve": "CVE-2021-3281",
+            "id": "pyup.io-39522",
+            "specs": [
+                "==3.0.11"
+            ],
+            "v": "==3.0.11"
+        },
+        {
+            "advisory": "Django 3.0.3 fixes a security issue and several bugs in 3.0.2. Potential SQL injection via `StringAgg(delimiter)`. See: CVE-2020-7471.",
+            "cve": "CVE-2020-7471",
+            "id": "pyup.io-37815",
+            "specs": [
+                "==3.0.2"
+            ],
+            "v": "==3.0.2"
+        },
+        {
+            "advisory": "Django 3.1.12 fixes two security issues in 3.1.11 (CVE-2021-33571).",
+            "cve": "PVE-2021-40598",
+            "id": "pyup.io-40598",
+            "specs": [
+                "==3.1.11"
+            ],
+            "v": "==3.1.11"
+        },
+        {
+            "advisory": "Django 3.1.12 fixes two security issues in 3.1.11 (CVE-2021-33203).",
+            "cve": "PVE-2021-40585",
+            "id": "pyup.io-40585",
+            "specs": [
+                "==3.1.11"
+            ],
+            "v": "==3.1.11"
+        },
+        {
+            "advisory": "Django 3.1.6 fixes a security issue with severity \"low\" and a bug in 3.1.5 (CVE-2021-3281).",
+            "cve": "CVE-2021-3281",
+            "id": "pyup.io-39521",
+            "specs": [
+                "==3.1.5"
+            ],
+            "v": "==3.1.5"
+        },
+        {
+            "advisory": "Django 3.2.4 fixes two security issues and several bugs in 3.2.3 (CVE-2021-33203).",
+            "cve": "PVE-2021-40584",
+            "id": "pyup.io-40584",
+            "specs": [
+                "==3.2.3"
+            ],
+            "v": "==3.2.3"
+        },
+        {
+            "advisory": "Django 3.2.4 fixes two security issues and several bugs in 3.2.3 (CVE-2021-3357).",
+            "cve": "PVE-2021-40599",
+            "id": "pyup.io-40599",
+            "specs": [
+                "==3.2.3"
+            ],
+            "v": "==3.2.3"
+        },
+        {
+            "advisory": "Django 1.10.3 fixes two security issues and several bugs in 1.10.2.\r\n\r\nUser with hardcoded password created when running tests on Oracle\r\n=================================================================\r\n\r\nWhen running tests with an Oracle database, Django creates a temporary database\r\nuser. In older versions, if a password isn't manually specified in the database\r\nsettings ``TEST`` dictionary, a hardcoded password is used. This could allow\r\nan attacker with network access to the database server to connect.\r\n\r\nThis user is usually dropped after the test suite completes, but not when using\r\nthe ``manage.py test --keepdb`` option or if the user has an active session\r\n(such as an attacker's connection).\r\n\r\nA randomly generated password is now used for each test run.\r\n\r\nDNS rebinding vulnerability when ``DEBUG=True``\r\n===============================================",
+            "cve": "PVE-2021-25722",
+            "id": "pyup.io-25722",
+            "specs": [
+                ">=1.10,<1.10.3"
+            ],
+            "v": ">=1.10,<1.10.3"
+        },
+        {
+            "advisory": "Django version 1.10.7, 1.9.13 and 1.8.18 include a fix for CVE-2017-7233: Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an \"on success\" URL. The security check for these redirects (namely 'django.utils.http.is_safe_url()') considered some numeric URLs \"safe\" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on 'is_safe_url()' to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.\r\nhttps://www.djangoproject.com/weblog/2017/apr/04/security-releases/",
+            "cve": "CVE-2017-7233",
+            "id": "pyup.io-33300",
+            "specs": [
+                ">=1.10,<1.10.7",
+                ">=1.9.0,<1.9.13",
+                ">=1.8.0,<1.8.18"
+            ],
+            "v": ">=1.10,<1.10.7,>=1.9.0,<1.9.13,>=1.8.0,<1.8.18"
+        },
+        {
+            "advisory": "Django 1.10.8 fixes a security issue in 1.10.7.  In older versions, HTML autoescaping was disabled in a portion of the template for the technical 500 debug page. Given the right circumstances, this allowed a cross-site scripting attack. This vulnerability shouldn't affect most production sites since you shouldn't run with 'DEBUG = True' (which makes this page accessible) in your production settings. See also: CVE-2017-12794, described as \"Possible XSS in traceback section of technical 500 debug page\".",
+            "cve": "CVE-2017-12794",
+            "id": "pyup.io-34918",
+            "specs": [
+                ">=1.10.7,<1.10.8"
+            ],
+            "v": ">=1.10.7,<1.10.8"
+        },
+        {
+            "advisory": "Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter). By passing a suitably crafted delimiter to a contrib.postgres.aggregates.StringAgg instance, it was possible to break escaping and inject malicious SQL.",
+            "cve": "CVE-2020-7471",
+            "id": "pyup.io-37970",
+            "specs": [
+                ">=1.11,<1.11.28",
+                ">=2.2,<2.2.10",
+                ">=3.0,<3.0.3"
+            ],
+            "v": ">=1.11,<1.11.28,>=2.2,<2.2.10,>=3.0,<3.0.3"
+        },
+        {
+            "advisory": "Django 1.11.5 fixes a security issue and several bugs in 1.11.4.\r\n\r\nCVE-2017-12794: Possible XSS in traceback section of technical 500 debug page\r\n=============================================================================\r\n\r\nIn older versions, HTML autoescaping was disabled in a portion of the template\r\nfor the technical 500 debug page. Given the right circumstances, this allowed\r\na cross-site scripting attack. This vulnerability shouldn't affect most\r\nproduction sites since you shouldn't run with ``DEBUG = True`` (which makes\r\nthis page accessible) in your production settings.",
+            "cve": "CVE-2017-12794",
+            "id": "pyup.io-34917",
+            "specs": [
+                ">=1.11,<1.11.5"
+            ],
+            "v": ">=1.11,<1.11.5"
+        },
+        {
+            "advisory": "An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-37191",
+            "specs": [
+                ">=1.11.0,<1.11.21",
+                ">=2.1,<2.1.9",
+                ">=2.2,<2.2.2"
+            ],
+            "v": ">=1.11.0,<1.11.21,>=2.1,<2.1.9,>=2.2,<2.2.2"
+        },
+        {
+            "advisory": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-37329",
+            "specs": [
+                ">=1.11.0,<1.11.23",
+                ">=2.1.0,<2.1.11",
+                ">=2.2.0,<2.2.4"
+            ],
+            "v": ">=1.11.0,<1.11.23,>=2.1.0,<2.1.11,>=2.2.0,<2.2.4"
+        },
+        {
+            "advisory": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgres.fields.HStoreField, were subject to SQL injection. This could, for example, be exploited via crafted use of \"OR 1=1\" in a key or index name to return all records, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed to the QuerySet.filter() function.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-37357",
+            "specs": [
+                ">=1.11.0,<1.11.23",
+                ">=2.1.0,<2.1.11",
+                ">=2.2.0,<2.2.4"
+            ],
+            "v": ">=1.11.0,<1.11.23,>=2.1.0,<2.1.11,>=2.2.0,<2.2.4"
+        },
+        {
+            "advisory": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to the behaviour of the underlying HTMLParser, django.utils.html.strip_tags would be extremely slow to evaluate certain inputs containing large sequences of nested incomplete HTML entities.",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-37330",
+            "specs": [
+                ">=1.11.0,<1.11.23",
+                ">=2.1.0,<2.1.11",
+                ">=2.2.0,<2.2.4"
+            ],
+            "v": ">=1.11.0,<1.11.23,>=2.1.0,<2.1.11,>=2.2.0,<2.2.4"
+        },
+        {
+            "advisory": "An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. If passed certain inputs, django.utils.encoding.uri_to_iri could lead to significant memory usage due to a recursion when repercent-encoding invalid UTF-8 octet sequences.",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-37331",
+            "specs": [
+                ">=1.11.0,<1.11.23",
+                ">=2.1.0,<2.1.11",
+                ">=2.2.0,<2.2.4"
+            ],
+            "v": ">=1.11.0,<1.11.23,>=2.1.0,<2.1.11,>=2.2.0,<2.2.4"
+        },
+        {
+            "advisory": "Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allow SQL Injections if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL. See: CVE-2020-9402.",
+            "cve": "CVE-2020-9402",
+            "id": "pyup.io-38010",
+            "specs": [
+                ">=1.11.0,<1.11.29",
+                ">=2.2.0,<2.2.11",
+                ">=3.0.0,<3.0.4"
+            ],
+            "v": ">=1.11.0,<1.11.29,>=2.2.0,<2.2.11,>=3.0.0,<3.0.4"
+        },
+        {
+            "advisory": "CVE-2018-6188: Information leakage in ``AuthenticationForm``\r\n============================================================\r\n\r\nA regression in Django 1.11.8 made\r\n:class:`~django.contrib.auth.forms.AuthenticationForm` run its\r\n``confirm_login_allowed()`` method even if an incorrect password is entered.\r\nThis can leak information about a user, depending on what messages\r\n``confirm_login_allowed()`` raises. If ``confirm_login_allowed()`` isn't\r\noverridden, an attacker enter an arbitrary username and see if that user has\r\nbeen set to ``is_active=False``. If ``confirm_login_allowed()`` is overridden,\r\nmore sensitive details could be leaked.\r\n\r\nThis issue is fixed with the caveat that ``AuthenticationForm`` can no longer\r\nraise the \"This account is inactive.\" error if the authentication backend\r\nrejects inactive users (the default authentication backend, ``ModelBackend``,\r\nhas done that since Django 1.10). This issue will be revisited for Django 2.1\r\nas a fix to address the caveat will likely be too invasive for inclusion in\r\nolder versions.",
+            "cve": "CVE-2018-6188",
+            "id": "pyup.io-35174",
+            "specs": [
+                ">=1.11.8,<1.11.10"
+            ],
+            "v": ">=1.11.8,<1.11.10"
+        },
+        {
+            "advisory": "django.middleware.common.CommonMiddleware in Django 1.11.x before 1.11.15 and 2.0.x before 2.0.8 has an Open Redirect. A remote user can redirect the target user's browser to an arbitrary site.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-36368",
+            "specs": [
+                ">=1.11a1,<1.11.15",
+                ">=2.0a1,<2.0.8"
+            ],
+            "v": ">=1.11a1,<1.11.15,>=2.0a1,<2.0.8"
+        },
+        {
+            "advisory": "In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. See: CVE-2019-3498.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-36771",
+            "specs": [
+                ">=1.11a1,<1.11.18"
+            ],
+            "v": ">=1.11a1,<1.11.18"
+        },
+        {
+            "advisory": "The administrative interface for Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 does not check permissions for the history view, which allows remote authenticated administrators to obtain sensitive object history information.",
+            "cve": "CVE-2013-0305",
+            "id": "pyup.io-33111",
+            "specs": [
+                ">=1.3,<1.3.6",
+                ">=1.4,<1.4.4",
+                ">=1.5,<1.5.1"
+            ],
+            "v": ">=1.3,<1.3.6,>=1.4,<1.4.4,>=1.5,<1.5.1"
+        },
+        {
+            "advisory": "The form library in Django 1.3.x before 1.3.6, 1.4.x before 1.4.4, and 1.5 before release candidate 2 allows remote attackers to bypass intended resource limits for formsets and cause a denial of service (memory consumption) or trigger server errors via a modified max_num parameter.",
+            "cve": "CVE-2013-0306",
+            "id": "pyup.io-33112",
+            "specs": [
+                ">=1.3,<1.3.6",
+                ">=1.4,<1.4.4",
+                ">=1.5,<1.5.1"
+            ],
+            "v": ">=1.3,<1.3.6,>=1.4,<1.4.4,>=1.5,<1.5.1"
+        },
+        {
+            "advisory": "The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions create empty sessions in certain circumstances, which allows remote attackers to cause a denial of service (session store consumption) via unspecified vectors.",
+            "cve": "CVE-2015-5964",
+            "id": "pyup.io-25728",
+            "specs": [
+                ">=1.4,<1.4.22",
+                ">=1.7,<1.7.10"
+            ],
+            "v": ">=1.4,<1.4.22,>=1.7,<1.7.10"
+        },
+        {
+            "advisory": "contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other versions allows remote attackers to cause a denial of service (session store consumption or session record removal) via a large number of requests to contrib.auth.views.logout, which triggers the creation of an empty session record.",
+            "cve": "CVE-2015-5963",
+            "id": "pyup.io-25727",
+            "specs": [
+                ">=1.4,<1.4.22",
+                ">=1.7,<1.7.10",
+                ">=1.8,<1.8.4"
+            ],
+            "v": ">=1.4,<1.4.22,>=1.7,<1.7.10,>=1.8,<1.8.4"
+        },
+        {
+            "advisory": "The is_safe_url function in utils/http.py in Django 1.4.x before 1.4.6, 1.5.x before 1.5.2, and 1.6 before beta 2 treats a URL's scheme as safe even if it is not HTTP or HTTPS, which might introduce cross-site scripting (XSS) or other vulnerabilities into Django applications that use this function, as demonstrated by \"the login view in django.contrib.auth.views\" and the javascript: scheme.",
+            "cve": "CVE-2013-6044",
+            "id": "pyup.io-42237",
+            "specs": [
+                ">=1.4,<1.4.6",
+                ">=1.5,<1.5.2",
+                ">1.6,<1.6b2"
+            ],
+            "v": ">=1.4,<1.4.6,>=1.5,<1.5.2,>1.6,<1.6b2"
+        },
+        {
+            "advisory": "Cross-site scripting (XSS) vulnerability in the AdminURLFieldWidget widget in contrib/admin/widgets.py in Django 1.5.x before 1.5.2 and 1.6.x before 1.6 beta 2 allows remote attackers to inject arbitrary web script or HTML via a URLField. See: CVE-2013-4249.",
+            "cve": "CVE-2013-4249",
+            "id": "pyup.io-35456",
+            "specs": [
+                ">=1.5,<1.5.2",
+                ">=1.6,<1.6b2"
+            ],
+            "v": ">=1.5,<1.5.2,>=1.6,<1.6b2"
+        },
+        {
+            "advisory": "The authentication framework (django.contrib.auth) in Django 1.4.x before 1.4.8, 1.5.x before 1.5.4, and 1.6.x before 1.6 beta 4 allows remote attackers to cause a denial of service (CPU consumption) via a long password which is then hashed.",
+            "cve": "CVE-2013-1443",
+            "id": "pyup.io-25729",
+            "specs": [
+                ">=1.6,<1.6-beta-4",
+                ">=1.4,<1.4.8",
+                ">=1.5,<1.5.4"
+            ],
+            "v": ">=1.6,<1.6-beta-4,>=1.4,<1.4.8,>=1.5,<1.5.4"
+        },
+        {
+            "advisory": "ModelMultipleChoiceField in Django 1.6.x before 1.6.10 and 1.7.x before 1.7.3, when show_hidden_initial is set to True, allows remote attackers to cause a denial of service by submitting duplicate values, which triggers a large number of SQL queries.",
+            "cve": "CVE-2015-0222",
+            "id": "pyup.io-25730",
+            "specs": [
+                ">=1.7,<1.7.3",
+                ">=1.6,<1.6.10"
+            ],
+            "v": ">=1.7,<1.7.3,>=1.6,<1.6.10"
+        },
+        {
+            "advisory": "The utils.html.strip_tags function in Django 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1, when using certain versions of Python, allows remote attackers to cause a denial of service (infinite loop) by increasing the length of the input string.",
+            "cve": "CVE-2015-2316",
+            "id": "pyup.io-25731",
+            "specs": [
+                ">=1.7,<1.7.7",
+                ">=1.6,<1.6.11",
+                ">=1.8a1,<1.8c1"
+            ],
+            "v": ">=1.7,<1.7.7,>=1.6,<1.6.11,>=1.8a1,<1.8c1"
+        },
+        {
+            "advisory": "The session backends in Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (session store consumption) via multiple requests with unique session keys.",
+            "cve": "CVE-2015-5143",
+            "id": "pyup.io-25725",
+            "specs": [
+                ">=1.7,<1.7.9",
+                ">=1.5,<1.7",
+                ">=1.4,<1.4.21"
+            ],
+            "v": ">=1.7,<1.7.9,>=1.5,<1.7,>=1.4,<1.4.21"
+        },
+        {
+            "advisory": "Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to conduct DNS rebinding attacks by leveraging failure to validate the HTTP Host header against settings.ALLOWED_HOSTS.",
+            "cve": "CVE-2016-9014",
             "id": "pyup.io-33075",
             "specs": [
-                ">=1.8,<1.8.16",
-                ">=1.9,<1.9.11",
-                ">=1.10,<1.10.3"
+                ">=1.8,<1.8.16",
+                ">=1.9,<1.9.11",
+                ">=1.10,<1.10.3"
+            ],
+            "v": ">=1.8,<1.8.16,>=1.9,<1.9.11,>=1.10,<1.10.3"
+        },
+        {
+            "advisory": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.",
+            "cve": "CVE-2016-9013",
+            "id": "pyup.io-33076",
+            "specs": [
+                ">=1.8,<1.8.16",
+                ">=1.9,<1.9.11",
+                ">=1.10,<1.10.3"
+            ],
+            "v": ">=1.8,<1.8.16,>=1.9,<1.9.11,>=1.10,<1.10.3"
+        },
+        {
+            "advisory": "The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.",
+            "cve": "CVE-2015-3982",
+            "id": "pyup.io-25732",
+            "specs": [
+                ">=1.8,<1.8.2"
+            ],
+            "v": ">=1.8,<1.8.2"
+        },
+        {
+            "advisory": "validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.",
+            "cve": "CVE-2015-5145",
+            "id": "pyup.io-25733",
+            "specs": [
+                ">=1.8,<1.8.3"
+            ],
+            "v": ">=1.8,<1.8.3"
+        },
+        {
+            "advisory": "Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.",
+            "cve": "CVE-2015-5144",
+            "id": "pyup.io-25726",
+            "specs": [
+                ">=1.8,<1.8.3",
+                ">=1.7,<1.7.9",
+                ">=1.5,<1.6",
+                ">=1.4,<1.4.21"
+            ],
+            "v": ">=1.8,<1.8.3,>=1.7,<1.7.9,>=1.5,<1.6,>=1.4,<1.4.21"
+        },
+        {
+            "advisory": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.",
+            "cve": "CVE-2015-8213",
+            "id": "pyup.io-25714",
+            "specs": [
+                ">=1.8,<1.8.7",
+                "<1.7.11",
+                ">=1.9,<1.9rc2"
+            ],
+            "v": ">=1.8,<1.8.7,<1.7.11,>=1.9,<1.9rc2"
+        },
+        {
+            "advisory": "Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.",
+            "cve": "CVE-2015-2241",
+            "id": "pyup.io-25715",
+            "specs": [
+                ">=1.8,<1.8b2",
+                "<1.7.6"
+            ],
+            "v": ">=1.8,<1.8b2,<1.7.6"
+        },
+        {
+            "advisory": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
+            "cve": "CVE-2015-2317",
+            "id": "pyup.io-25713",
+            "specs": [
+                ">=1.8,<1.8c1",
+                "<1.4.20",
+                ">=1.5,<1.6",
+                ">=1.6,<1.6.11",
+                ">=1.7,<1.7.7"
+            ],
+            "v": ">=1.8,<1.8c1,<1.4.20,>=1.5,<1.6,>=1.6,<1.6.11,>=1.7,<1.7.7"
+        },
+        {
+            "advisory": "Django versions 1.10.7, 1.9.13 and 1.8.18 include a fix for CVE-2017-7234: A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the 'django.views.static.serve()' view could redirect to any other domain, aka an open redirect vulnerability.\r\nhttps://www.djangoproject.com/weblog/2017/apr/04/security-releases/\r\nhttp://www.debian.org/security/2017/dsa-3835\r\nhttp://www.securityfocus.com/bid/97401\r\nhttp://www.securitytracker.com/id/1038177",
+            "cve": "CVE-2017-7234",
+            "id": "pyup.io-35740",
+            "specs": [
+                ">=1.8.0a1,<1.8.18",
+                ">=1.9.0a1,<1.9.13",
+                ">=1.10.0a1,<1.10.7"
+            ],
+            "v": ">=1.8.0a1,<1.8.18,>=1.9.0a1,<1.9.13,>=1.10.0a1,<1.10.7"
+        },
+        {
+            "advisory": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.",
+            "cve": "CVE-2016-7401",
+            "id": "pyup.io-25718",
+            "specs": [
+                ">=1.9,<1.9.10",
+                "<1.8.15"
+            ],
+            "v": ">=1.9,<1.9.10,<1.8.15"
+        },
+        {
+            "advisory": "Django 1.9.11 fixes two security issues in 1.9.10.\r\n\r\nUser with hardcoded password created when running tests on Oracle\r\n=================================================================\r\n\r\nWhen running tests with an Oracle database, Django creates a temporary database\r\nuser. In older versions, if a password isn't manually specified in the database\r\nsettings ``TEST`` dictionary, a hardcoded password is used. This could allow\r\nan attacker with network access to the database server to connect.\r\n\r\nThis user is usually dropped after the test suite completes, but not when using\r\nthe ``manage.py test --keepdb`` option or if the user has an active session\r\n(such as an attacker's connection).\r\n\r\nA randomly generated password is now used for each test run.\r\n\r\nDNS rebinding vulnerability when ``DEBUG=True``\r\n===============================================",
+            "cve": "PVE-2021-25734",
+            "id": "pyup.io-25734",
+            "specs": [
+                ">=1.9,<1.9.11"
+            ],
+            "v": ">=1.9,<1.9.11"
+        },
+        {
+            "advisory": "Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the \"Save as New\" option when editing objects and leveraging the \"change\" permission.",
+            "cve": "CVE-2016-2048",
+            "id": "pyup.io-25735",
+            "specs": [
+                ">=1.9,<1.9.2"
+            ],
+            "v": ">=1.9,<1.9.2"
+        },
+        {
+            "advisory": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.",
+            "cve": "CVE-2016-6186",
+            "id": "pyup.io-25721",
+            "specs": [
+                ">=1.9,<1.9.8",
+                "==1.8.14",
+                ">=1.10,<1.10rc1"
+            ],
+            "v": ">=1.9,<1.9.8,==1.8.14,>=1.10,<1.10rc1"
+        },
+        {
+            "advisory": "In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. See: CVE-2019-3498.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-36770",
+            "specs": [
+                ">=2.0a1,<2.0.10"
+            ],
+            "v": ">=2.0a1,<2.0.10"
+        },
+        {
+            "advisory": "Django 2.0.x before 2.0.11 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.",
+            "cve": "CVE-2019-6975",
+            "id": "pyup.io-36884",
+            "specs": [
+                ">=2.0a1,<2.0.11"
+            ],
+            "v": ">=2.0a1,<2.0.11"
+        },
+        {
+            "advisory": "CVE-2018-6188: Information leakage in ``AuthenticationForm``\r\n============================================================\r\n\r\nA regression in Django 1.11.8 made\r\n:class:`~django.contrib.auth.forms.AuthenticationForm` run its\r\n``confirm_login_allowed()`` method even if an incorrect password is entered.\r\nThis can leak information about a user, depending on what messages\r\n``confirm_login_allowed()`` raises. If ``confirm_login_allowed()`` isn't\r\noverridden, an attacker enter an arbitrary username and see if that user has\r\nbeen set to ``is_active=False``. If ``confirm_login_allowed()`` is overridden,\r\nmore sensitive details could be leaked.\r\n\r\nThis issue is fixed with the caveat that ``AuthenticationForm`` can no longer\r\nraise the \"This account is inactive.\" error if the authentication backend\r\nrejects inactive users (the default authentication backend, ``ModelBackend``,\r\nhas done that since Django 1.10). This issue will be revisited for Django 2.1\r\nas a fix to address the caveat will likely be too invasive for inclusion in\r\nolder versions.",
+            "cve": "CVE-2018-6188",
+            "id": "pyup.io-35173",
+            "specs": [
+                ">=2.0a1,<2.0.2",
+                "==1.11.8",
+                "==1.11.9"
+            ],
+            "v": ">=2.0a1,<2.0.2,==1.11.8,==1.11.9"
+        },
+        {
+            "advisory": "If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were\r\npassed the ``html=True`` argument, they were extremely slow to evaluate certain\r\ninputs due to a catastrophic backtracking vulnerability in a regular\r\nexpression. The ``chars()`` and ``words()`` methods are used to implement the\r\n``truncatechars_html`` and ``truncatewords_html`` template filters, which were\r\nthus vulnerable.",
+            "cve": "CVE-2018-7537",
+            "id": "pyup.io-35796",
+            "specs": [
+                ">=2.0a1,<2.0.3",
+                ">=1.8a1 ,<1.8.19",
+                ">=1.11a1,<1.11.11"
+            ],
+            "v": ">=2.0a1,<2.0.3,>=1.8a1 ,<1.8.19,>=1.11a1,<1.11.11"
+        },
+        {
+            "advisory": "An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. See: CVE-2018-7536.",
+            "cve": "CVE-2018-7536",
+            "id": "pyup.io-35797",
+            "specs": [
+                ">=2.0a1,<2.0.3",
+                ">=1.8a1 ,<1.8.19",
+                ">=1.11a1,<1.11.11"
+            ],
+            "v": ">=2.0a1,<2.0.3,>=1.8a1 ,<1.8.19,>=1.11a1,<1.11.11"
+        },
+        {
+            "advisory": "Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.) See: CVE-2019-19118.",
+            "cve": "CVE-2019-19118",
+            "id": "pyup.io-37766",
+            "specs": [
+                ">=2.1,<2.1.15",
+                ">=2.2,<2.2.8"
+            ],
+            "v": ">=2.1,<2.1.15,>=2.2,<2.2.8"
+        },
+        {
+            "advisory": "Django versions 2.1.9 and 2.2.2 apply a patch to fix a vulnerability in its dependency 'jQuery'.\r\nhttps://github.com/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee6e6ad",
+            "cve": "CVE-2019-11358",
+            "id": "pyup.io-39594",
+            "specs": [
+                ">=2.1a0,<2.1.9",
+                ">=2.2a0,<2.2.2"
+            ],
+            "v": ">=2.1a0,<2.1.9,>=2.2a0,<2.2.2"
+        },
+        {
+            "advisory": "In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. See: CVE-2019-3498.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-36769",
+            "specs": [
+                ">=2.1a1,<2.1.5"
+            ],
+            "v": ">=2.1a1,<2.1.5"
+        },
+        {
+            "advisory": "In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments. See CVE-2021-3281.",
+            "cve": "CVE-2021-3281",
+            "id": "pyup.io-39526",
+            "specs": [
+                ">=2.2,<2.2.18",
+                ">=3.1,<3.1.6",
+                ">=3.0,<3.0.12"
+            ],
+            "v": ">=2.2,<2.2.18,>=3.1,<3.1.6,>=3.0,<3.0.12"
+        },
+        {
+            "advisory": "Django versions 3.2.1, 3.1.9 and 2.2.21 include a fix for CVE-2021-31542: In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.\r\nhttps://www.djangoproject.com/weblog/2021/may/04/security-releases/",
+            "cve": "CVE-2021-31542",
+            "id": "pyup.io-40404",
+            "specs": [
+                ">=2.2,<2.2.21",
+                ">=3.1a1,<3.1.9",
+                ">=3.2,<3.2.1"
+            ],
+            "v": ">=2.2,<2.2.21,>=3.1a1,<3.1.9,>=3.2,<3.2.1"
+        },
+        {
+            "advisory": "Django 2.2.24, 3.1.12, and 3.2.4 includes a fix for CVE-2021-33571: In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+).\r\nhttps://www.djangoproject.com/weblog/2021/jun/02/security-releases/",
+            "cve": "CVE-2021-33571",
+            "id": "pyup.io-40638",
+            "specs": [
+                ">=2.2.0a1,<2.2.24",
+                ">=3.0.0a1,<3.1.12",
+                ">=3.2.0a1,<3.2.4"
+            ],
+            "v": ">=2.2.0a1,<2.2.24,>=3.0.0a1,<3.1.12,>=3.2.0a1,<3.2.4"
+        },
+        {
+            "advisory": "Django 2.2.19, 3.0.13 and 3.1.7 include a fix for CVE-2021-23336: Web cache poisoning via 'django.utils.http.limited_parse_qsl()'.",
+            "cve": "CVE-2021-23336",
+            "id": "pyup.io-39646",
+            "specs": [
+                ">=2.2a1,<2.2.19",
+                ">=3.0a1,<3.0.13",
+                ">=3.1a1,<3.1.7"
+            ],
+            "v": ">=2.2a1,<2.2.19,>=3.0a1,<3.0.13,>=3.1a1,<3.1.7"
+        },
+        {
+            "advisory": "In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.",
+            "cve": "CVE-2021-28658",
+            "id": "pyup.io-40163",
+            "specs": [
+                ">=2.2a1,<2.2.20",
+                ">=3.0a1,<3.0.14",
+                ">=3.1a1,<3.1.8"
+            ],
+            "v": ">=2.2a1,<2.2.20,>=3.0a1,<3.0.14,>=3.1a1,<3.1.8"
+        },
+        {
+            "advisory": "CVE-2020-13254: Potential data leakage via malformed memcached keys. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. In order to avoid this vulnerability, key validation is added to the memcached cache backends.\r\n\r\nAdditionally, Django 2.2.13 and 3.0.7 upgrade the version of jQuery used by the admin to 3.5.1 for security reasons.",
+            "cve": "CVE-2020-13254",
+            "id": "pyup.io-38373",
+            "specs": [
+                ">=3.0a1,<3.0.7",
+                ">=2.2a1,<2.2.13"
+            ],
+            "v": ">=3.0a1,<3.0.7,>=2.2a1,<2.2.13"
+        },
+        {
+            "advisory": "CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget. Query parameters for the admin ForeignKeyRawIdWidget were not properly URL encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query parameters are correctly URL encoded.\r\n\r\nAdditionally, Django 2.2.13 and 3.0.7 upgrade the version of jQuery used by the admin to 3.5.1 for security reasons.",
+            "cve": "CVE-2020-13596",
+            "id": "pyup.io-38372",
+            "specs": [
+                ">=3.0a1,<3.0.7",
+                ">=2.2a1,<2.2.13"
+            ],
+            "v": ">=3.0a1,<3.0.7,>=2.2a1,<2.2.13"
+        },
+        {
+            "advisory": "Django versions 3.1.13 and 3.2.5 include a fix for CVE-2021-35042: Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.\r\nhttps://www.djangoproject.com/weblog/2021/jul/01/security-releases/\r\nhttps://www.openwall.com/lists/oss-security/2021/07/02/2\r\nhttps://docs.djangoproject.com/en/3.2/releases/security/\r\nhttps://groups.google.com/forum/#%21forum/django-announce",
+            "cve": "CVE-2021-35042",
+            "id": "pyup.io-40899",
+            "specs": [
+                ">=3.1,<3.1.13",
+                ">=3.2,<3.2.5"
+            ],
+            "v": ">=3.1,<3.1.13,>=3.2,<3.2.5"
+        },
+        {
+            "advisory": "Django versions 3.2.2, 3.1.10 and 2.2.22 include a fix for CVE-2021-32052: In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.\r\nhttps://www.djangoproject.com/weblog/2021/may/06/security-releases",
+            "cve": "CVE-2021-32052",
+            "id": "pyup.io-40414",
+            "specs": [
+                ">=3.1a1,<3.1.10",
+                ">=2.2a1,<2.2.22",
+                ">=3.2a1,<3.2.2"
+            ],
+            "v": ">=3.1a1,<3.1.10,>=2.2a1,<2.2.22,>=3.2a1,<3.2.2"
+        }
+    ],
+    "django-access-tokens": [
+        {
+            "advisory": "django-access-tokens 0.9.2 fixes scoping of permissions where the token provides a smaller subset of the required permissions. As an extreme case, an access token granting no permissions could be used to access any permissions on the site.",
+            "cve": "PVE-2021-25736",
+            "id": "pyup.io-25736",
+            "specs": [
+                "<0.9.2"
+            ],
+            "v": "<0.9.2"
+        }
+    ],
+    "django-access-tokens-py3": [
+        {
+            "advisory": "Fixing scoping of permissions where the token provides a\r\nsmaller subset of the required permissions. As an extreme case, an access token\r\ngranting no permissions could be used to access any permissions on the site.",
+            "cve": "PVE-2021-34892",
+            "id": "pyup.io-34892",
+            "specs": [
+                "<0.9.2"
+            ],
+            "v": "<0.9.2"
+        }
+    ],
+    "django-afip": [
+        {
+            "advisory": "Django-afip 7.1.1 overrides the TLS configuration for AFIP's servers (and only those). They have worsened their security configuration, and it's now seen as insecure by default on many environments.",
+            "cve": "PVE-2021-38705",
+            "id": "pyup.io-38705",
+            "specs": [
+                "<7.1.1"
+            ],
+            "v": "<7.1.1"
+        }
+    ],
+    "django-airplane": [
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2021-33203",
+            "id": "pyup.io-43713",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2021-33571",
+            "id": "pyup.io-43714",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior includes a vulnerable version of 'Django' (3.1.7).",
+            "cve": "CVE-2021-32052",
+            "id": "pyup.io-43715",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior includes a vulnerable version of 'Django' (3.1.7).",
+            "cve": "CVE-2021-31542",
+            "id": "pyup.io-43716",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2021-28658",
+            "id": "pyup.io-43717",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior uses a version of Django (>=2.2.10) potentially insecure.",
+            "cve": "CVE-2021-44420",
+            "id": "pyup.io-43712",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2021-23336",
+            "id": "pyup.io-43718",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2021-3281",
+            "id": "pyup.io-43719",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2020-24584",
+            "id": "pyup.io-43720",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2020-24583",
+            "id": "pyup.io-43721",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2020-13254",
+            "id": "pyup.io-43722",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2020-13596",
+            "id": "pyup.io-43723",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        },
+        {
+            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
+            "cve": "CVE-2020-9402",
+            "id": "pyup.io-43724",
+            "specs": [
+                "<=1.1.0"
+            ],
+            "v": "<=1.1.0"
+        }
+    ],
+    "django-ajax-datatable": [
+        {
+            "advisory": "Django-ajax-datatable version 4.1.4 adds missing CSRF token header in the first POST call (initialize_table()).",
+            "cve": "PVE-2021-41834",
+            "id": "pyup.io-41834",
+            "specs": [
+                "<4.1.4"
+            ],
+            "v": "<4.1.4"
+        },
+        {
+            "advisory": "Django-ajax-datatable 4.4.0 strips HTML tags by default in the rendered table for security reasons.\r\nhttps://github.com/morlandi/django-ajax-datatable/commit/702d2acfc953c2e9a2deb098e10c124cefb2bfc3",
+            "cve": "PVE-2021-43640",
+            "id": "pyup.io-43640",
+            "specs": [
+                "<4.4.0"
+            ],
+            "v": "<4.4.0"
+        }
+    ],
+    "django-allauth": [
+        {
+            "advisory": "django-allauth before 0.28.0 previous versions contained a vulnerability allowing an attacker to alter the provider specific settings for ``SCOPE`` and/or ``AUTH_PARAMS`` (part of the  larger ``SOCIALACCOUNT_PROVIDERS`` setting). The changes would persist across subsequent requests for all users, provided these settings were explicitly set within your project. These settings translate directly into request parameters, giving the attacker undesirable control over the OAuth(2) handshake. You are not affected if you did not explicitly configure these settings.",
+            "cve": "PVE-2021-25737",
+            "id": "pyup.io-25737",
+            "specs": [
+                "<0.28.0"
+            ],
+            "v": "<0.28.0"
+        },
+        {
+            "advisory": "On django-allauth before 0.34.0 the \"Set Password\" view did not properly check whether or not the user already had a usable password set. This allowed an attacker to set the password without providing the current password, but only in case the attacker already gained control over the victim's session.",
+            "cve": "PVE-2021-35034",
+            "id": "pyup.io-35034",
+            "specs": [
+                "<0.34.0"
+            ],
+            "v": "<0.34.0"
+        },
+        {
+            "advisory": "Django-allauth 0.41.0 conforms to the general Django 3.0.1, 2.2.9, and 1.11.27 security release. See CVE-2019-19844 and <https://www.djangoproject.com/weblog/2019/dec/18/security-releases/>.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-37664",
+            "specs": [
+                "<0.41.0"
+            ],
+            "v": "<0.41.0"
+        },
+        {
+            "advisory": "Django-allauth 0.47.0 adds a new setting 'SOCIALACCOUNT_LOGIN_ON_GET' that controls whether or not the endpoints for initiating a social login (for example, \"/accounts/google/login/\") require a POST request to initiate the handshake. As requiring a POST is more secure, the default of this new setting is 'False'. This is useful to prevent redirect attacks.",
+            "cve": "PVE-2021-43274",
+            "id": "pyup.io-43274",
+            "specs": [
+                "<0.47.0"
+            ],
+            "v": "<0.47.0"
+        }
+    ],
+    "django-allauth-underground": [
+        {
+            "advisory": "django-allauth-underground before 0.28.0 contained a vulnerability allowing an attacker to alter the\r\n  provider specific settings for ``SCOPE`` and/or ``AUTH_PARAMS`` (part of the\r\n  larger ``SOCIALACCOUNT_PROVIDERS`` setting).",
+            "cve": "PVE-2021-36394",
+            "id": "pyup.io-36394",
+            "specs": [
+                "<0.28.0"
+            ],
+            "v": "<0.28.0"
+        }
+    ],
+    "django-anonymizer": [
+        {
+            "advisory": "Django-anonymizer 0.4 changes 'Anonymizer.attributes' to require every field to be listed.  This deals with the common security problem when a model is updated, but the Anonymizer is not updated.",
+            "cve": "PVE-2021-25738",
+            "id": "pyup.io-25738",
+            "specs": [
+                "<0.4"
+            ],
+            "v": "<0.4"
+        }
+    ],
+    "django-anymail": [
+        {
+            "advisory": "In django-anymail before 1.4 the webhook validation was vulnerable to a timing attack. An attacker could have used this to obtain the WEBHOOK_AUTHORIZATION shared secret, potentially allowing them to post fabricated or malicious email tracking events to the app.",
+            "cve": "CVE-2018-6596",
+            "id": "pyup.io-35178",
+            "specs": [
+                "<1.4"
+            ],
+            "v": "<1.4"
+        },
+        {
+            "advisory": "Django-anymail version 1.4 includes a fix for CVE-2018-1000089: Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in an attacker with access to error logs could fabricate email tracking events. If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app.\r\nhttps://github.com/anymail/django-anymail/commit/1a6086f2b58478d71f89bf27eb034ed81aefe5ef",
+            "cve": "CVE-2018-1000089",
+            "id": "pyup.io-35198",
+            "specs": [
+                ">=0.2,<1.4"
+            ],
+            "v": ">=0.2,<1.4"
+        }
+    ],
+    "django-autocomplete-light": [
+        {
+            "advisory": "Django-autocomplete-light before 2.3.0 when updating the queryset from outside the autocomplete class may lead to a security problem, ie. if you don't replicate filters you apply manually on the autocomplete object choices into choices_for_request() then a malicious user could see choices which they shouldn't by querying the autocomplete directly.\r\nhttps://github.com/yourlabs/django-autocomplete-light/pull/494",
+            "cve": "PVE-2021-25740",
+            "id": "pyup.io-25740",
+            "specs": [
+                "<2.3.0"
+            ],
+            "v": "<2.3.0"
+        }
+    ],
+    "django-awl": [
+        {
+            "advisory": "Django-awl 0.23.1 updates minimum requirements for Django to v2.1.2 to include a security fix.",
+            "cve": "CVE-2018-16984",
+            "id": "pyup.io-36588",
+            "specs": [
+                "<0.23.1"
+            ],
+            "v": "<0.23.1"
+        },
+        {
+            "advisory": "Django-awl 1.0 updates the minimum requirements for Django to versions 2.2.10 and 3.0 to include security fixes.",
+            "cve": "CVE-2019-6975",
+            "id": "pyup.io-43689",
+            "specs": [
+                "<1.0"
+            ],
+            "v": "<1.0"
+        },
+        {
+            "advisory": "Django-awl 1.0 updates the minimum requirements for Django to versions 2.2.10 and 3.0 to include security fixes.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-38139",
+            "specs": [
+                "<1.0"
+            ],
+            "v": "<1.0"
+        }
+    ],
+    "django-basic-auth-ip-whitelist": [
+        {
+            "advisory": "In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD is set. Currently the string comparison between configured credentials and the ones provided by users is performed through a character-by-character string comparison. This enables a possibility that attacker may time the time it takes the server to validate different usernames and password, and use this knowledge to work out the valid credentials. This attack is understood not to be realistic over the Internet. However, it may be achieved from within local networks where the website is hosted, e.g. from inside a data centre where a website's server is located. Sites protected by IP address whitelisting only are unaffected by this vulnerability. This vulnerability has been fixed on version 0.3.4 of django-basic-auth-ip-whitelist. Update to version 0.3.4 as soon as possible and change basic authentication username and password configured on a Django project using this package. A workaround without upgrading to version 0.3.4 is to stop using basic authentication and use the IP whitelisting component only. It can be achieved by not setting BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD in Django project settings. See: CVE-2020-4071.",
+            "cve": "CVE-2020-4071",
+            "id": "pyup.io-38443",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Django-basic-auth-ip-whitelist 0.3.4 fixes a potential timing attack if basic authentication is enabled.",
+            "cve": "PVE-2021-38438",
+            "id": "pyup.io-38438",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        }
+    ],
+    "django-basicauth": [
+        {
+            "advisory": "django-basicauth before 0.4.2 is vulnerable to undisclosed timing attacks.",
+            "cve": "PVE-2021-35076",
+            "id": "pyup.io-35076",
+            "specs": [
+                "<0.4.2"
+            ],
+            "v": "<0.4.2"
+        }
+    ],
+    "django-bootstrap4": [
+        {
+            "advisory": "Django-bootstrap4 2.3.0 updates its dependency 'Django' to v3.1.2 to include security fixes.",
+            "cve": "CVE-2020-24583",
+            "id": "pyup.io-38870",
+            "specs": [
+                "<2.3.0"
+            ],
+            "v": "<2.3.0"
+        },
+        {
+            "advisory": "Django-bootstrap4 2.3.0 updates its dependency 'Django' to v3.1.2 to include security fixes.",
+            "cve": "CVE-2020-24584",
+            "id": "pyup.io-43711",
+            "specs": [
+                "<2.3.0"
+            ],
+            "v": "<2.3.0"
+        }
+    ],
+    "django-ca": [
+        {
+            "advisory": "django-ca 1.10.0 stores CA private keys in the more secure PKCS8 format.",
+            "cve": "PVE-2021-37015",
+            "id": "pyup.io-37015",
+            "specs": [
+                "<1.10.0"
+            ],
+            "v": "<1.10.0"
+        },
+        {
+            "advisory": "Django-ca 1.17.0 secures CSRF and session cookies using Djangos `SESSION_COOKIE_SECURE`, `CSRF_COOKIE_HTTPONLY` and `CSRF_COOKIE_SECURE` settings. It also adds several security related headers to the admin interface (CSP, etc).",
+            "cve": "PVE-2021-39375",
+            "id": "pyup.io-39375",
+            "specs": [
+                "<1.17.0"
+            ],
+            "v": "<1.17.0"
+        },
+        {
+            "advisory": "Django-ca version 1.19.0 fetches only the expected number of bytes when validating ACME challenges via HTTP to prevent DOS attacks.",
+            "cve": "PVE-2021-42088",
+            "id": "pyup.io-42088",
+            "specs": [
+                "<1.19.0"
+            ],
+            "v": "<1.19.0"
+        },
+        {
+            "advisory": "django-ca before 1.9.0 did not properly escape x509 extensions, allowing for potential injection attacks.",
+            "cve": "PVE-2021-36405",
+            "id": "pyup.io-36405",
+            "specs": [
+                "<1.9.0"
+            ],
+            "v": "<1.9.0"
+        }
+    ],
+    "django-celery-results": [
+        {
+            "advisory": "Django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database. See CVE-2020-17495.",
+            "cve": "CVE-2020-17495",
+            "id": "pyup.io-38678",
+            "specs": [
+                "<=1.2.1"
+            ],
+            "v": "<=1.2.1"
+        }
+    ],
+    "django-cms": [
+        {
+            "advisory": "django-cms 2.1.3 fixes a serious security issue in PlaceholderAdmin",
+            "cve": "PVE-2021-25741",
+            "id": "pyup.io-25741",
+            "specs": [
+                "<2.1.3"
+            ],
+            "v": "<2.1.3"
+        },
+        {
+            "advisory": "Django-cms before 2.1.4 fixes a XSS issue in Text Plugins.\r\nhttps://github.com/django-cms/django-cms/commit/9ca7738bc1cef827765589c5b254810370a0fc0b",
+            "cve": "PVE-2021-25742",
+            "id": "pyup.io-25742",
+            "specs": [
+                "<2.1.4"
+            ],
+            "v": "<2.1.4"
+        },
+        {
+            "advisory": "django-cms 3.0.14 fixes an issue where privileged users could be tricked into performing actions without their knowledge via a CSRF vulnerability",
+            "cve": "PVE-2021-25743",
+            "id": "pyup.io-25743",
+            "specs": [
+                "<3.0.14"
+            ],
+            "v": "<3.0.14"
+        },
+        {
+            "advisory": "Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.",
+            "cve": "CVE-2015-5081",
+            "id": "pyup.io-35628",
+            "specs": [
+                "<3.0.14",
+                ">3.1,<3.1.1"
+            ],
+            "v": "<3.0.14,>3.1,<3.1.1"
+        },
+        {
+            "advisory": "django-cms  3.2.4 addresses security vulnerabilities in the `render_model` template tag that could lead to escalation of privileges or other security issues. It also addresses a security vulnerability in the cms' usage of the messages framework. Furthermore it fixes security vulnerabilities in custom FormFields that could lead to escalation of privileges or other security issue",
+            "cve": "PVE-2021-25746",
+            "id": "pyup.io-25746",
+            "specs": [
+                "<3.2.4"
+            ],
+            "v": "<3.2.4"
+        },
+        {
+            "advisory": "django-cms 3.4.3 fixes a security vulnerability in the page redirect field which allowed users to insert JavaScript code and a vulnerability where the next parameter for the toolbar login was not sanitised and could point to another domain.",
+            "cve": "PVE-2021-34226",
+            "id": "pyup.io-34226",
+            "specs": [
+                "<3.4.3"
+            ],
+            "v": "<3.4.3"
+        },
+        {
+            "advisory": "Django-cms versions 3.7.4, 3.6.1, 3.5.4 and 3.4.7 include a fix for CVE-2021-44649: Django CMS 3.7.3 and prior does not validate the plugin_type parameter while generating error messages for an invalid plugin type, resulting in a Cross Site Scripting (XSS) vulnerability. The vulnerability allows an attacker to execute arbitrary JavaScript code in the web browser of the affected user.\r\nhttps://sahildhar.github.io/blogpost/Django-CMS-Reflected-XSS-Vulnerability\r\nhttps://www.django-cms.org/en/blog/2020/07/22/django-cms-security-updates-1",
+            "cve": "CVE-2021-44649",
+            "id": "pyup.io-44516",
+            "specs": [
+                "<3.4.7",
+                ">=3.5.0a0,<3.5.4",
+                ">=3.6.0a0,<3.6.1",
+                ">=3.7.0a0,<3.7.4"
+            ],
+            "v": "<3.4.7,>=3.5.0a0,<3.5.4,>=3.6.0a0,<3.6.1,>=3.7.0a0,<3.7.4"
+        },
+        {
+            "advisory": "Django-cms 3.4.7 fixes a security vulnerability in the plugin_type url parameter to insert JavaScript code.",
+            "cve": "PVE-2021-38791",
+            "id": "pyup.io-38791",
+            "specs": [
+                ">=3.4.0,<3.4.7"
+            ],
+            "v": ">=3.4.0,<3.4.7"
+        },
+        {
+            "advisory": "Django-cms 3.5.4 fixes a security vulnerability in the plugin_type url parameter to insert JavaScript code.",
+            "cve": "PVE-2021-38790",
+            "id": "pyup.io-38790",
+            "specs": [
+                ">=3.5.0,<3.5.4"
+            ],
+            "v": ">=3.5.0,<3.5.4"
+        },
+        {
+            "advisory": "django-cms before 3.6.1\r\nDjango-cms 3.6.1 fixes a security vulnerability in the plugin_type url parameter to insert JavaScript code.",
+            "cve": "PVE-2021-38789",
+            "id": "pyup.io-38789",
+            "specs": [
+                ">=3.6.0,<3.6.1"
+            ],
+            "v": ">=3.6.0,<3.6.1"
+        },
+        {
+            "advisory": "Django-cms 3.7.4 fixes a security vulnerability in the plugin_type url parameter to insert JavaScript code.",
+            "cve": "PVE-2021-38788",
+            "id": "pyup.io-38788",
+            "specs": [
+                ">=3.7.0,<3.7.4"
+            ],
+            "v": ">=3.7.0,<3.7.4"
+        }
+    ],
+    "django-cms-patched": [
+        {
+            "advisory": "django-cms-patched before 3.0.17 has security vulnerabilities in the `render_model` template tag that could\r\n  lead to escalation of privileges or other security issues.",
+            "cve": "PVE-2021-34123",
+            "id": "pyup.io-34123",
+            "specs": [
+                "<3.0.17"
+            ],
+            "v": "<3.0.17"
+        },
+        {
+            "advisory": "django-cms-patched 3.4.3 fixes a security vulnerability in the page redirect field which allowed users to insert JavaScript code.",
+            "cve": "PVE-2021-34121",
+            "id": "pyup.io-34121",
+            "specs": [
+                "<3.4.3"
+            ],
+            "v": "<3.4.3"
+        }
+    ],
+    "django-cors-headers": [
+        {
+            "advisory": "Django-cors-headers version 3.0.0 fixes a security issue where the CORS middleware would allow requests between schemes, for example from insecure 'http://' origins to a secure 'https://' site. Now you will need to update your whitelist to include schemes, for example from this:\r\nCORS_ORIGIN_WHITELIST = ['example.com']\r\nto this:\r\nCORS_ORIGIN_WHITELIST = ['https://example.com']\r\nhttps://github.com/adamchainz/django-cors-headers/issues/259",
+            "cve": "PVE-2021-37132",
+            "id": "pyup.io-37132",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        }
+    ],
+    "django-councilmatic": [
+        {
+            "advisory": "Django-councilmatic 2.5.9 patches a XSS vulnerability when using filter options. \r\nhttps://github.com/datamade/django-councilmatic/issues/270\r\nhttps://github.com/datamade/django-councilmatic/pull/271",
+            "cve": "PVE-2021-38708",
+            "id": "pyup.io-38708",
+            "specs": [
+                "<2.5.9"
+            ],
+            "v": "<2.5.9"
+        }
+    ],
+    "django-countries": [
+        {
+            "advisory": "Django-countries 3.4 fixes a escaping issue in CountrySelectWidget that could lead to XSS.\r\nhttps://github.com/SmileyChris/django-countries/commit/1ed7c6763d890d00f32242202b424709e8668d5a",
+            "cve": "PVE-2021-25747",
+            "id": "pyup.io-25747",
+            "specs": [
+                "<3.4"
+            ],
+            "v": "<3.4"
+        }
+    ],
+    "django-crispy-forms": [
+        {
+            "advisory": "django-crispy-forms 1.1.4 contains a security fix: Thread safety fixes to `CrispyFieldNode` thanks to Paul Oswald. This avoids leaking information between requests in multithreaded WSGI servers.",
+            "cve": "PVE-2021-25751",
+            "id": "pyup.io-25751",
+            "specs": [
+                "<1.1.4"
+            ],
+            "v": "<1.1.4"
+        }
+    ],
+    "django-crm": [
+        {
+            "advisory": "MicroPyramid Django-CRM 0.2 does not use CSRF token for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.",
+            "cve": "CVE-2018-16552",
+            "id": "pyup.io-36440",
+            "specs": [
+                "<=0.2"
+            ],
+            "v": "<=0.2"
+        },
+        {
+            "advisory": "Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/. See: CVE-2019-11457.",
+            "cve": "CVE-2019-11457",
+            "id": "pyup.io-37416",
+            "specs": [
+                "==0.2.1"
+            ],
+            "v": "==0.2.1"
+        }
+    ],
+    "django-dajaxice-ng": [
+        {
+            "advisory": "Django-dajaxice-ng  0.1.7 fixes the dajaxice callback model to improve security against XSS attacks.\r\nhttps://github.com/ifanrx/django-dajaxice/commit/cd56cde9d9f4f0bea56e97fe86513553669ad187",
+            "cve": "PVE-2021-25753",
+            "id": "pyup.io-25753",
+            "specs": [
+                "<0.1.7"
+            ],
+            "v": "<0.1.7"
+        }
+    ],
+    "django-debug-toolbar": [
+        {
+            "advisory": "A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form. See CVE-2021-30459.",
+            "cve": "CVE-2021-30459",
+            "id": "pyup.io-40207",
+            "specs": [
+                "<1.11.1",
+                ">2,<2.2.1",
+                ">3,<3.2.1"
+            ],
+            "v": "<1.11.1,>2,<2.2.1,>3,<3.2.1"
+        }
+    ],
+    "django-discord-bind": [
+        {
+            "advisory": "django-discord-bind  0.2.0 added state validation to prevent CSRF attacks.",
+            "cve": "PVE-2021-25754",
+            "id": "pyup.io-25754",
+            "specs": [
+                "<0.2.0"
+            ],
+            "v": "<0.2.0"
+        }
+    ],
+    "django-embed-video": [
+        {
+            "advisory": "django-embed-video  0.3 has a security fix: faked urls are treated as invalid.",
+            "cve": "PVE-2021-25755",
+            "id": "pyup.io-25755",
+            "specs": [
+                "<0.3"
+            ],
+            "v": "<0.3"
+        }
+    ],
+    "django-envelope": [
+        {
+            "advisory": "django-envelope  0.4.1 contains a security bugfix regarding initial form values.",
+            "cve": "PVE-2021-25756",
+            "id": "pyup.io-25756",
+            "specs": [
+                "<0.4.1"
+            ],
+            "v": "<0.4.1"
+        }
+    ],
+    "django-epiced": [
+        {
+            "advisory": "django-epiced before 0.3.0 does not escape HTML output by default.",
+            "cve": "PVE-2021-34269",
+            "id": "pyup.io-34269",
+            "specs": [
+                "<0.3.0"
+            ],
+            "v": "<0.3.0"
+        }
+    ],
+    "django-epiceditor": [
+        {
+            "advisory": "There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.",
+            "cve": "CVE-2017-6591",
+            "id": "pyup.io-35735",
+            "specs": [
+                "<=0.2.3"
+            ],
+            "v": "<=0.2.3"
+        }
+    ],
+    "django-fernet-fields": [
+        {
+            "advisory": "django-fernet-fields before 0.3 has DualField and HashField. The only cases where they are useful, they aren't secure.",
+            "cve": "PVE-2021-34331",
+            "id": "pyup.io-34331",
+            "specs": [
+                "<0.3"
+            ],
+            "v": "<0.3"
+        },
+        {
+            "advisory": "django-fernet-fields 0.3 removes DualField and HashField. The only cases where they are useful, they aren't secure.",
+            "cve": "PVE-2021-25757",
+            "id": "pyup.io-25757",
+            "specs": [
+                "<0.3"
+            ],
+            "v": "<0.3"
+        }
+    ],
+    "django-fiber": [
+        {
+            "advisory": "django-fiber  0.9.9.1 contains a security bugfix: Changed permission check in API from IsAuthenticated to IsAdminUser",
+            "cve": "PVE-2021-25758",
+            "id": "pyup.io-25758",
+            "specs": [
+                "<0.9.9.1"
+            ],
+            "v": "<0.9.9.1"
+        }
+    ],
+    "django-filter": [
+        {
+            "advisory": "Django-filter 2.4.0 added a MaxValueValidator to the form field for NumberFilter. This prevents a potential DoS attack if numbers with very large exponents were subsequently converted to integers.",
+            "cve": "PVE-2021-38825",
+            "id": "pyup.io-38825",
+            "specs": [
+                "<2.4.0"
+            ],
+            "v": "<2.4.0"
+        },
+        {
+            "advisory": "Django-filter 2.4.0 includes a fix for CVE-2020-15225: In django-filter before version 2.4.0, automatically generated 'NumberFilter' instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a 'MaxValueValidator' with a default 'limit_value' of 1e50 to the form field used by 'NumberFilter' instances. In addition, 'NumberFilter' implements the new 'get_max_validator()' which should return a configured validator instance to customise the limit, or else 'None' to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.\r\nhttps://github.com/carltongibson/django-filter/security/advisories/GHSA-x7gm-rfgv-w973",
+            "cve": "CVE-2020-15225",
+            "id": "pyup.io-40317",
+            "specs": [
+                "<2.4.0"
+            ],
+            "v": "<2.4.0"
+        }
+    ],
+    "django-fluent-comments": [
+        {
+            "advisory": "django-fluent-comments  1.0.1 fixes security hash formatting errors on bad requests..",
+            "cve": "PVE-2021-25761",
+            "id": "pyup.io-25761",
+            "specs": [
+                "<1.0.1"
+            ],
+            "v": "<1.0.1"
+        }
+    ],
+    "django-formidable": [
+        {
+            "advisory": "Django-formidable 4.0.0 adds an XSS prevention mechanism.\r\nhttps://github.com/peopledoc/django-formidable/pull/378/commits/e6e5392823e78bb17259b1d4ed45182e34c13dd7",
+            "cve": "PVE-2021-37875",
+            "id": "pyup.io-37875",
+            "specs": [
+                "<4.0.0"
+            ],
+            "v": "<4.0.0"
+        }
+    ],
+    "django-friendship": [
+        {
+            "advisory": "django-friendship 1.2.0 fixes a security issue where the library was not checking the owner of a FriendRequest during accept and cancelation.",
+            "cve": "PVE-2021-25762",
+            "id": "pyup.io-25762",
+            "specs": [
+                "<1.2.0"
+            ],
+            "v": "<1.2.0"
+        }
+    ],
+    "django-froala-editor": [
+        {
+            "advisory": "Django-froala-editor 4.0.8 fixed high level security vulnerability in dependent packages for Node.",
+            "cve": "PVE-2021-43580",
+            "id": "pyup.io-43580",
+            "specs": [
+                "<4.0.8"
+            ],
+            "v": "<4.0.8"
+        }
+    ],
+    "django-guts": [
+        {
+            "advisory": "django-guts 0.1.1 fixes a security issue, allowing anyone to read any file.",
+            "cve": "PVE-2021-25763",
+            "id": "pyup.io-25763",
+            "specs": [
+                "<0.1.1"
+            ],
+            "v": "<0.1.1"
+        }
+    ],
+    "django-hashedfilenamestorage": [
+        {
+            "advisory": "Django-hashedfilenamestorage 2.4 updates Django dependency requirement to >=2.0.8 to include security fixes.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-36802",
+            "specs": [
+                "<2.4"
+            ],
+            "v": "<2.4"
+        },
+        {
+            "advisory": "Django-hashedfilenamestorage 2.4 updates Django dependency requirement to >=2.0.8 to include security fixes.",
+            "cve": "CVE-2018-7537",
+            "id": "pyup.io-43734",
+            "specs": [
+                "<2.4"
+            ],
+            "v": "<2.4"
+        }
+    ],
+    "django-hashid-field": [
+        {
+            "advisory": "Django-hashid-field v1.0.0 \r\n\r\nIf you already specified `salt` in fields, like `id = HashidField(salt=\"something\")` everywhere then you're already set, and can upgrade worry-free.\r\n\r\nIf you instead let the module fallback to `salt=settings.SECRET_KEY` (default behavior) then this upgrade will change all of your existing fields. It has been pointed out that it's possible to discover the salt used when encoding Hashids, and thus it is very dangerous to use settings.SECRET_KEY, as an attacker may be able to get your SECRET_KEY from your HashidFields.\r\n\r\nIf you absolutely MUST maintain backwards-compatibility and continue to support your old hashed values, then you can set `HASHID_FIELD_SALT = SECRET_KEY` in your settings. But this is *VERY DISCOURAGED*.",
+            "cve": "PVE-2021-38508",
+            "id": "pyup.io-38508",
+            "specs": [
+                "<1.0.0"
+            ],
+            "v": "<1.0.0"
+        },
+        {
+            "advisory": "Django-hashid-field 3.1.1 fixes a security bug where comparison operators (gt, gte, lt, lte) would allow integer lookups regardless of ALLOW_INT_LOOKUP setting.",
+            "cve": "PVE-2021-37680",
+            "id": "pyup.io-37680",
+            "specs": [
+                "<3.1.1"
+            ],
+            "v": "<3.1.1"
+        }
+    ],
+    "django-haystack": [
+        {
+            "advisory": "Django-haystack 1.1 removes insecure use of 'eval' from the Whoosh backend.\r\nhttps://github.com/django-haystack/django-haystack/commit/e0dc369cc12621df51bc8f807ff5ef728131e6ea",
+            "cve": "PVE-2021-25764",
+            "id": "pyup.io-25764",
+            "specs": [
+                "<1.1"
+            ],
+            "v": "<1.1"
+        }
+    ],
+    "django-heartbeat": [
+        {
+            "advisory": "Django-heartbeat 2.0.3 fixes its dependency to an insecure psutil package.",
+            "cve": "PVE-2021-38604",
+            "id": "pyup.io-38604",
+            "specs": [
+                "<2.0.3"
+            ],
+            "v": "<2.0.3"
+        }
+    ],
+    "django-helpdesk": [
+        {
+            "advisory": "Django-helpdesk 0.3.1 includes a fix for CVE-2021-3945: Django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').\r\nhttps://github.com/django-helpdesk/django-helpdesk/commit/2c7065e0c4296e0c692fb4a7ee19c7357583af30\r\nhttps://huntr.dev/bounties/745f483c-70ed-441f-ab2e-7ac1305439a4",
+            "cve": "CVE-2021-3945",
+            "id": "pyup.io-42683",
+            "specs": [
+                "<0.3.1"
+            ],
+            "v": "<0.3.1"
+        },
+        {
+            "advisory": "Django-helpdesk 0.3.1 includes a fix for CVE-2021-3950: Django-helpdesk is vulnerable to improper neutralization of input during web page generation ('Cross-site Scripting').\r\nhttps://huntr.dev/bounties/4d7a5fdd-b2de-467a-ade0-3f2fb386638e\r\nhttps://github.com/django-helpdesk/django-helpdesk/commit/04483bdac3b5196737516398b5ce0383875a5c60",
+            "cve": "CVE-2021-3950",
+            "id": "pyup.io-42743",
+            "specs": [
+                "<0.3.1"
+            ],
+            "v": "<0.3.1"
+        },
+        {
+            "advisory": "Django-helpdesk 0.3.2 includes a fix for CVE-2021-3994: Django-helpdesk is vulnerable to improper neutralization of input during web page generation ('Cross-site Scripting').\r\nhttps://huntr.dev/bounties/be7f211d-4bfd-44fd-91e8-682329906fbd",
+            "cve": "CVE-2021-3994",
+            "id": "pyup.io-42766",
+            "specs": [
+                "<0.3.2"
+            ],
+            "v": "<0.3.2"
+        }
+    ],
+    "django-hijack": [
+        {
+            "advisory": "django-hijack before 1.0.7 has a unspecified security issue and is vulnerable via unknown vectors.",
+            "cve": "PVE-2021-25765",
+            "id": "pyup.io-25765",
+            "specs": [
+                "<1.0.7"
+            ],
+            "v": "<1.0.7"
+        }
+    ],
+    "django-howl": [
+        {
+            "advisory": "Django-howl 1.0.4 updates Django to v2.2.2 to include a security fix.",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-37240",
+            "specs": [
+                "<1.0.4"
+            ],
+            "v": "<1.0.4"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-43654",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2020-7471",
+            "id": "pyup.io-43651",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-43656",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-43652",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2019-19118",
+            "id": "pyup.io-43653",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-43655",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-43657",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2019-12781",
+            "id": "pyup.io-43658",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'urllib3' to v1.25.8 to include a security fix.",
+            "cve": "CVE-2020-7212",
+            "id": "pyup.io-43659",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        },
+        {
+            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
+            "cve": "CVE-2020-9402",
+            "id": "pyup.io-38069",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        }
+    ],
+    "django-html5-appcache": [
+        {
+            "advisory": "django-html5-appcache 0.3.0 added a security check for sensitive views.",
+            "cve": "PVE-2021-25766",
+            "id": "pyup.io-25766",
+            "specs": [
+                "<0.3.0"
+            ],
+            "v": "<0.3.0"
+        }
+    ],
+    "django-idempotency-key": [
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2020-7471",
+            "id": "pyup.io-42977",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-42978",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-42979",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-42980",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-42981",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-42982",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2019-12781",
+            "id": "pyup.io-42983",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-42984",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2020-9402",
+            "id": "pyup.io-42985",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
+            "cve": "CVE-2021-33203",
+            "id": "pyup.io-38162",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 updates the minimum version of its dependency 'bleach' to v3.1.4 to include a security fix.",
+            "cve": "CVE-2020-6817",
+            "id": "pyup.io-42975",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        },
+        {
+            "advisory": "Django-idempotency-key 1.1.0 updates the minimum version of its dependency 'urllib3' to v1.24.2 to include a security fix.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-42976",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        }
+    ],
+    "django-initial-avatars": [
+        {
+            "advisory": "django-initial-avatars before 0.4 has a unspecified security issue and is vulnerable via unknown vectors.",
+            "cve": "PVE-2021-25767",
+            "id": "pyup.io-25767",
+            "specs": [
+                "<0.4"
+            ],
+            "v": "<0.4"
+        },
+        {
+            "advisory": "django-initial-avatars before 0.5.0 has a unspecified security issue and is vulnerable via unknown vectors.",
+            "cve": "PVE-2021-25768",
+            "id": "pyup.io-25768",
+            "specs": [
+                "<0.5.0"
+            ],
+            "v": "<0.5.0"
+        }
+    ],
+    "django-jet": [
+        {
+            "advisory": "Django-jet 1.0.4 fixes a security issue with accessing model_lookup_view (when using RelatedFieldAjaxListFilter) without permissions.\r\nhttps://github.com/geex-arts/django-jet/commit/734f3521d8290f6162847ad0b5c33d8ab5e119a9",
+            "cve": "PVE-2021-25769",
+            "id": "pyup.io-25769",
+            "specs": [
+                "<1.0.4"
+            ],
+            "v": "<1.0.4"
+        }
+    ],
+    "django-jet-reboot": [
+        {
+            "advisory": "Django-jet-reboot 1.0.4 fixes a security issue with accessing model_lookup_view (when using RelatedFieldAjaxListFilter) without permissions.\r\nhttps://github.com/assem-ch/django-jet-reboot/commit/734f3521d8290f6162847ad0b5c33d8ab5e119a9",
+            "cve": "PVE-2021-39370",
+            "id": "pyup.io-39370",
+            "specs": [
+                "<1.0.4"
+            ],
+            "v": "<1.0.4"
+        }
+    ],
+    "django-jinja-knockout": [
+        {
+            "advisory": "'TemplateContext' class is used in Django-jinja-knockout 0.9.0 to manage client-side data injection.",
+            "cve": "PVE-2021-39610",
+            "id": "pyup.io-39610",
+            "specs": [
+                "<0.9.0"
+            ],
+            "v": "<0.9.0"
+        }
+    ],
+    "django-js-reverse": [
+        {
+            "advisory": "django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline. See: CVE-2019-15486.",
+            "cve": "CVE-2019-15486",
+            "id": "pyup.io-37399",
+            "specs": [
+                "<0.9.1"
+            ],
+            "v": "<0.9.1"
+        }
+    ],
+    "django-lazysignup": [
+        {
+            "advisory": "Django-lazysignup before 0.4.0 fixes a security issue: Generated usernames are now based on the session key, rather than actually being the session key. This is to avoid a potential security issue where an app might simply display a username, giving away a significant part of the user's session key. The username is now generated from a SHA1 hash of the session key. This change means that existing generated users will become invalid.\r\nhttps://github.com/danfairs/django-lazysignup/commit/ea27d50ea222063de81f005565dfbb7f83d8759f",
+            "cve": "PVE-2021-25770",
+            "id": "pyup.io-25770",
+            "specs": [
+                "<0.4.0"
+            ],
+            "v": "<0.4.0"
+        }
+    ],
+    "django-lazysignup-redux": [
+        {
+            "advisory": "django-lazysignup-redux 0.4.0 fixes a security issue: Generated usernames are now based on the session key, rather than actually being the session key. This is to avoid a potential security issue where an app might simply display a username, giving away a significant part of the user's session key. The username is now generated from a SHA1 hash of the session key. This change means that existing generated users will become invalid.",
+            "cve": "PVE-2021-25771",
+            "id": "pyup.io-25771",
+            "specs": [
+                "<0.4.0"
+            ],
+            "v": "<0.4.0"
+        }
+    ],
+    "django-lfs": [
+        {
+            "advisory": "django-lfs before 0.6.9 has a unspecified security issue and is vulnerable via unknown vectors.",
+            "cve": "PVE-2021-25772",
+            "id": "pyup.io-25772",
+            "specs": [
+                "<0.6.9"
+            ],
+            "v": "<0.6.9"
+        }
+    ],
+    "django-magiclink": [
+        {
+            "advisory": "Django-magiclink 1.0.4 adds csrf_protect decorator for POST requests by default to improve security.",
+            "cve": "PVE-2021-41829",
+            "id": "pyup.io-41829",
+            "specs": [
+                "<1.0.4"
+            ],
+            "v": "<1.0.4"
+        }
+    ],
+    "django-mail-auth": [
+        {
+            "advisory": "Django-mail-auth 0.1.3 fixes session key security issues.",
+            "cve": "PVE-2021-37171",
+            "id": "pyup.io-37171",
+            "specs": [
+                "<0.1.3"
+            ],
+            "v": "<0.1.3"
+        }
+    ],
+    "django-make-app": [
+        {
+            "advisory": "An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.",
+            "cve": "CVE-2017-16764",
+            "id": "pyup.io-35722",
+            "specs": [
+                "<0.1.3"
+            ],
+            "v": "<0.1.3"
+        }
+    ],
+    "django-mapstore-adapter": [
+        {
+            "advisory": "Django-mapstore-adapter 1.0.4 fixes an unescaped \"ms2_config\" which may cause JS injection.",
+            "cve": "PVE-2021-38936",
+            "id": "pyup.io-38936",
+            "specs": [
+                "<1.0.4"
+            ],
+            "v": "<1.0.4"
+        }
+    ],
+    "django-markupfield": [
+        {
+            "advisory": "django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.",
+            "cve": "CVE-2015-0846",
+            "id": "pyup.io-25773",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.",
+            "cve": "CVE-2015-0846",
+            "id": "pyup.io-25774",
+            "specs": [
+                "<1.3.3"
+            ],
+            "v": "<1.3.3"
+        }
+    ],
+    "django-material": [
+        {
+            "advisory": "Django-material 0.9.0 fixes a XSS vulnerability in input fields.\r\nhttps://github.com/viewflow/django-material/issues/139",
+            "cve": "PVE-2021-25775",
+            "id": "pyup.io-25775",
+            "specs": [
+                "<0.9.0"
+            ],
+            "v": "<0.9.0"
+        },
+        {
+            "advisory": "Django-material before 1.5.1 included a js injection vulnerability in a list view.\r\nhttps://github.com/viewflow/django-material/commit/778ad3e170a59e750ed7a86b83beebe5eccc39ee",
+            "cve": "PVE-2021-36950",
+            "id": "pyup.io-36950",
+            "specs": [
+                "<1.5.1"
+            ],
+            "v": "<1.5.1"
+        }
+    ],
+    "django-modern-rpc": [
+        {
+            "advisory": "django-modern-rpc before 0.8.1 isn't correctly checking the authentication backend when executing 'system.multicall()'.",
+            "cve": "PVE-2021-34991",
+            "id": "pyup.io-34991",
+            "specs": [
+                "<0.8.1"
+            ],
+            "v": "<0.8.1"
+        }
+    ],
+    "django-mptt": [
+        {
+            "advisory": "Django-mptt <0.8.0 uses versions of python/django that no longer receive security patches. You should upgrade to Python 2.7 and Django 1.8+.",
+            "cve": "PVE-2021-41205",
+            "id": "pyup.io-41205",
+            "specs": [
+                "<0.8.0"
+            ],
+            "v": "<0.8.0"
+        }
+    ],
+    "django-music-publisher": [
+        {
+            "advisory": "Django 2.1 had a minor security issue, so 2.1.2 was promptly released.. django-music-publisher before 18.9.1 included this issue.",
+            "cve": "PVE-2021-36523",
+            "id": "pyup.io-36523",
+            "specs": [
+                "<18.9.1"
+            ],
+            "v": "<18.9.1"
+        },
+        {
+            "advisory": "Django-music-publisher 18.9.3 updates its dependency 'requests' to v2.20.0 to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36608",
+            "specs": [
+                "<18.9.3"
+            ],
+            "v": "<18.9.3"
+        }
+    ],
+    "django-nameko-standalone": [
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-43702",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-43703",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-43706",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-6975",
+            "id": "pyup.io-43707",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-43709",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2018-7537",
+            "id": "pyup.io-38565",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-43700",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-43701",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-43704",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-12781",
+            "id": "pyup.io-43705",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-43708",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        }
+    ],
+    "django-newsletter": [
+        {
+            "advisory": "django-newsletter before 0.7 allowed a user to subscribe others to the newsletter without authorization.",
+            "cve": "PVE-2021-36318",
+            "id": "pyup.io-36318",
+            "specs": [
+                "<0.7"
+            ],
+            "v": "<0.7"
+        },
+        {
+            "advisory": "Django-newsletter 0.9 updates its dependency 'Waitress' to v1.4.3 to include a security fix.",
+            "cve": "CVE-2020-5236",
+            "id": "pyup.io-43671",
+            "specs": [
+                "<0.9"
+            ],
+            "v": "<0.9"
+        },
+        {
+            "advisory": "Django-newsletter 0.9 updates its dependency 'Django' to v3.0.3 to include a security fix.",
+            "cve": "CVE-2020-7471",
+            "id": "pyup.io-37916",
+            "specs": [
+                "<0.9"
+            ],
+            "v": "<0.9"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'waitress' to v1.4.2 to include security fixes.",
+            "cve": "CVE-2019-16789",
+            "id": "pyup.io-43673",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'waitress' to v1.4.2 to include security fixes.",
+            "cve": "CVE-2019-16792",
+            "id": "pyup.io-43674",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
+            "cve": "CVE-2019-19911",
+            "id": "pyup.io-43675",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-43687",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'waitress' to v1.4.2 to include security fixes.",
+            "cve": "CVE-2019-16785",
+            "id": "pyup.io-43672",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
+            "cve": "CVE-2020-5310",
+            "id": "pyup.io-43676",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
+            "cve": "CVE-2020-5311",
+            "id": "pyup.io-43677",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
+            "cve": "CVE-2020-5312",
+            "id": "pyup.io-43678",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
+            "cve": "CVE-2020-5313",
+            "id": "pyup.io-43679",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-43680",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-19118",
+            "id": "pyup.io-43681",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-43682",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-43683",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-43684",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-43685",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-12781",
+            "id": "pyup.io-43686",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
+            "cve": "CVE-2019-6975",
+            "id": "pyup.io-43688",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        },
+        {
+            "advisory": "Django-newsletter 0.9b1 updates its dependency 'waitress' to v1.4.2 to include security fixes.",
+            "cve": "CVE-2019-16786",
+            "id": "pyup.io-37677",
+            "specs": [
+                "<0.9b1"
+            ],
+            "v": "<0.9b1"
+        }
+    ],
+    "django-ninecms": [
+        {
+            "advisory": "django-ninecms before 0.4.5b has a unknown security issue in its url configuration.",
+            "cve": "PVE-2021-25776",
+            "id": "pyup.io-25776",
+            "specs": [
+                "<0.4.5b"
+            ],
+            "v": "<0.4.5b"
+        }
+    ],
+    "django-nopassword": [
+        {
+            "advisory": "django-nopassword before 5.0.0 stores cleartext secrets in the database. See: CVE-2019-10682.",
+            "cve": "CVE-2019-10682",
+            "id": "pyup.io-38080",
+            "specs": [
+                "<5.0.0"
+            ],
+            "v": "<5.0.0"
+        }
+    ],
+    "django-oauth-toolkit": [
+        {
+            "advisory": "Django-oauth-toolkit 0.8.0 includes fixes for various vulnerabilities on 'Basic' authentication.",
+            "cve": "PVE-2021-39609",
+            "id": "pyup.io-39609",
+            "specs": [
+                "<0.8.0"
+            ],
+            "v": "<0.8.0"
+        }
+    ],
+    "django-orghierarchy": [
+        {
+            "advisory": "Django-orghierarchy 0.1.13 updates its dependency 'Django' to v1.11.15 to include a security fix.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-37039",
+            "specs": [
+                "<0.1.13"
+            ],
+            "v": "<0.1.13"
+        },
+        {
+            "advisory": "Django-orghierarchy 0.1.18 updates its dependency 'requests' to v2.20.0 to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-37038",
+            "specs": [
+                "<0.1.18"
+            ],
+            "v": "<0.1.18"
+        }
+    ],
+    "django-pagetree": [
+        {
+            "advisory": "Django-pagetree version 1.0.4 adds csrf_tokens to several forms where it was missing.",
+            "cve": "PVE-2021-41899",
+            "id": "pyup.io-41899",
+            "specs": [
+                "<1.0.4"
+            ],
+            "v": "<1.0.4"
+        },
+        {
+            "advisory": "Django-pagetree version 1.0.7 adds a csrf token for the import_json form.",
+            "cve": "PVE-2021-41898",
+            "id": "pyup.io-41898",
+            "specs": [
+                "<1.0.7"
+            ],
+            "v": "<1.0.7"
+        },
+        {
+            "advisory": "Django-pagetree 1.1.8 adds a csrf_token to the base clone_hierarchy form.",
+            "cve": "PVE-2021-41897",
+            "id": "pyup.io-41897",
+            "specs": [
+                "<1.1.8"
+            ],
+            "v": "<1.1.8"
+        }
+    ],
+    "django-patchwork": [
+        {
+            "advisory": "A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.",
+            "cve": "CVE-2019-13122",
+            "id": "pyup.io-42262",
+            "specs": [
+                ">=1.1,<2.0.4",
+                ">=2.1.0,<2.1.4",
+                "==2.1.0:rc1",
+                "==2.1.0:rc2"
+            ],
+            "v": ">=1.1,<2.0.4,>=2.1.0,<2.1.4,==2.1.0:rc1,==2.1.0:rc2"
+        }
+    ],
+    "django-perms-provisioner": [
+        {
+            "advisory": "Django-perms-provisioner 0.0.4 updates PyYAML to v5.3.1 to include security fixes.",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-38289",
+            "specs": [
+                "<0.0.4"
+            ],
+            "v": "<0.0.4"
+        },
+        {
+            "advisory": "Django-perms-provisioner updates its dependency 'pyyaml' to v5.3.1 and code to include security fixes.\r\nhttps://github.com/labd/django-perms-provisioner/commit/1e65b781c47f6ba02805283a3ede56276ae14b44",
+            "cve": "CVE-2019-20477",
+            "id": "pyup.io-43456",
+            "specs": [
+                "<0.0.4"
+            ],
+            "v": "<0.0.4"
+        }
+    ],
+    "django-piston": [
+        {
+            "advisory": "emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.",
+            "cve": "CVE-2011-4103",
+            "id": "pyup.io-25777",
+            "specs": [
+                "<0.2.3"
+            ],
+            "v": "<0.2.3"
+        }
+    ],
+    "django-pluggable-filebrowser": [
+        {
+            "advisory": "django-pluggable-filebrowser 3.4.2 fixes a security bug: added staff_member_required decorator to the upload-function.",
+            "cve": "PVE-2021-25778",
+            "id": "pyup.io-25778",
+            "specs": [
+                "<3.4.2"
+            ],
+            "v": "<3.4.2"
+        }
+    ],
+    "django-polaris": [
+        {
+            "advisory": "Improvements in the Multi-signature Asset Distribution Account Support allow anchors since django-polaris version 1.1.0 to improve the security of the account that controls outbound payments.",
+            "cve": "PVE-2021-38837",
+            "id": "pyup.io-38837",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        }
+    ],
+    "django-postman": [
+        {
+            "advisory": "django-postman 3.6.2 fixes issue 101, for security concern, ignore the scheme and domain parts in the 'next' query param.",
+            "cve": "PVE-2021-36667",
+            "id": "pyup.io-36667",
+            "specs": [
+                "<3.6.2"
+            ],
+            "v": "<3.6.2"
+        }
+    ],
+    "django-python3-ldap": [
+        {
+            "advisory": "Django-python3-ldap 0.9.5 fixes a security vulnerability where username and password could be transmitted in plain text before starting TLS.\r\nhttps://github.com/etianen/django-python3-ldap/commit/a250194e2911e270a90b0eec2251343040a75ece",
+            "cve": "PVE-2021-25779",
+            "id": "pyup.io-25779",
+            "specs": [
+                "<0.9.5"
+            ],
+            "v": "<0.9.5"
+        },
+        {
+            "advisory": "django-python3-ldap 0.9.8 fixes a security vulnerability allowing users to authenticate with a valid username but with an empty password if anonymous authentication is allowed on the LDAP server.",
+            "cve": "PVE-2021-25780",
+            "id": "pyup.io-25780",
+            "specs": [
+                "<0.9.8"
+            ],
+            "v": "<0.9.8"
+        }
+    ],
+    "django-rated": [
+        {
+            "advisory": "django-rated before 1.1.2 has a unspecified security issue and is vulnerable via unknown vectors.",
+            "cve": "PVE-2021-25781",
+            "id": "pyup.io-25781",
+            "specs": [
+                "<1.1.2"
+            ],
+            "v": "<1.1.2"
+        }
+    ],
+    "django-registration": [
+        {
+            "advisory": "django-registration before 1.7 leaked password reset token through the Referer\r\nheader.",
+            "cve": "PVE-2021-36431",
+            "id": "pyup.io-36431",
+            "specs": [
+                "<1.7"
+            ],
+            "v": "<1.7"
+        },
+        {
+            "advisory": "django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly apply filters to sensitive data, with the result that sensitive data could be included in error reports rather than removed automatically by Django. Triggering this requires: A site is using django-registration < 3.1.2, The site has detailed error reports (such as Django's emailed error reports to site staff/developers) enabled and a server-side error (HTTP 5xx) occurs during an attempt by a user to register an account. Under these conditions, recipients of the detailed error report will see all submitted data from the account-registration attempt, which may include the user's proposed credentials (such as a password). See CVE-2021-21416.",
+            "cve": "CVE-2021-21416",
+            "id": "pyup.io-40136",
+            "specs": [
+                "<3.1.2"
+            ],
+            "v": "<3.1.2"
+        }
+    ],
+    "django-registration-redux": [
+        {
+            "advisory": "django-registration-redux before 1.7 leaks password reset tokens through the Referer header. For more info, see: https://github.com/macropin/django-registration/pull/268",
+            "cve": "PVE-2021-35199",
+            "id": "pyup.io-35199",
+            "specs": [
+                "<1.7"
+            ],
+            "v": "<1.7"
+        }
+    ],
+    "django-relatives": [
+        {
+            "advisory": "Django-relatives before 0.3.0 is vulnerable to XSS in html tags.\r\nhttps://github.com/treyhunner/django-relatives/commit/6410ae4695389cb377ce23d35883d8b70b789deb",
+            "cve": "PVE-2021-25782",
+            "id": "pyup.io-25782",
+            "specs": [
+                "<0.3.0"
+            ],
+            "v": "<0.3.0"
+        }
+    ],
+    "django-rest-registration": [
+        {
+            "advisory": "verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.",
+            "cve": "CVE-2019-13177",
+            "id": "pyup.io-37266",
+            "specs": [
+                "<0.5.0"
+            ],
+            "v": "<0.5.0"
+        },
+        {
+            "advisory": "Django-rest-registration 0.5.0 fixes a critical security issue with misusing the Django Signer API. See: <https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xh>.",
+            "cve": "PVE-2021-37385",
+            "id": "pyup.io-37385",
+            "specs": [
+                "<0.5.0"
+            ],
+            "v": "<0.5.0"
+        }
+    ],
+    "django-revproxy": [
+        {
+            "advisory": "django-revproxy 0.9.6 fixes a security issue that allowed remote-user header injection.",
+            "cve": "PVE-2021-25783",
+            "id": "pyup.io-25783",
+            "specs": [
+                "<0.9.6"
+            ],
+            "v": "<0.9.6"
+        },
+        {
+            "advisory": "django-revproxy 0.9.7 fixes a security issue: when colon is present at URL path urljoin ignores the upstream and the request is redirected to the path itself allowing content injection.",
+            "cve": "PVE-2021-25784",
+            "id": "pyup.io-25784",
+            "specs": [
+                "<0.9.7"
+            ],
+            "v": "<0.9.7"
+        }
+    ],
+    "django-safedelete": [
+        {
+            "advisory": "Django-safedelete 0.3.3 contains a security fix that prevents an XSS attack in the admin interface.\r\nhttps://github.com/makinacorpus/django-safedelete/commit/317c548c9d53e8983bb9a361c02f658f635ac13e",
+            "cve": "PVE-2021-25785",
+            "id": "pyup.io-25785",
+            "specs": [
+                "<0.3.3"
+            ],
+            "v": "<0.3.3"
+        }
+    ],
+    "django-sage-painless": [
+        {
+            "advisory": "Django-sage-painless 1.10.2 includes fixes for few security bugs.",
+            "cve": "PVE-2021-41101",
+            "id": "pyup.io-41101",
+            "specs": [
+                "<1.10.2"
+            ],
+            "v": "<1.10.2"
+        }
+    ],
+    "django-select2": [
+        {
+            "advisory": "django-select2 5.7.0 contains a security fix that allows a `field_id` to only be used for the intended JSON endpoint.",
+            "cve": "PVE-2021-25787",
+            "id": "pyup.io-25787",
+            "specs": [
+                "<5.7.0"
+            ],
+            "v": "<5.7.0"
+        }
+    ],
+    "django-selectable": [
+        {
+            "advisory": "Django-selectable 0.5.2 fixes a XSS flaw with lookup \"get_item_*\" methods.\r\nhttps://github.com/mlavin/django-selectable/issues/63",
+            "cve": "PVE-2021-25788",
+            "id": "pyup.io-25788",
+            "specs": [
+                "<0.5.2"
+            ],
+            "v": "<0.5.2"
+        }
+    ],
+    "django-server": [
+        {
+            "advisory": "django-server is a package affected by pytosquatting: http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/",
+            "cve": "PVE-2021-34982",
+            "id": "pyup.io-34982",
+            "specs": [
+                ">0",
+                "<0"
+            ],
+            "v": ">0,<0"
+        }
+    ],
+    "django-session-security": [
+        {
+            "advisory": "django-session-security  2.4.0 fixes a vulnerability when SESSION_EXPIRE_AT_BROWSER_CLOSE is off.",
+            "cve": "PVE-2021-25789",
+            "id": "pyup.io-25789",
+            "specs": [
+                "<2.4.0"
+            ],
+            "v": "<2.4.0"
+        }
+    ],
+    "django-silk": [
+        {
+            "advisory": "Django-silk version 0.4 improves user input sanitization.\r\nhttps://github.com/jazzband/django-silk/commit/487bca243e6d68678abfd83423c33684734281ab",
+            "cve": "PVE-2021-42212",
+            "id": "pyup.io-42212",
+            "specs": [
+                "<0.4"
+            ],
+            "v": "<0.4"
+        },
+        {
+            "advisory": "Django-silk version 4.0.0 masks request headers to avoid auth information leaking.\r\nhttps://github.com/jazzband/django-silk/issues/375",
+            "cve": "PVE-2021-42212",
+            "id": "pyup.io-42216",
+            "specs": [
+                "<4.0.0"
+            ],
+            "v": "<4.0.0"
+        }
+    ],
+    "django-smart-lists": [
+        {
+            "advisory": "Django-smart-lists 1.0.26 fixes a XSS vulnerability in the render_function.\r\nhttps://github.com/plecto/django-smart-lists/commit/44314e51b371e01cd9bceb2e0ed6c8d75d7f87c3",
+            "cve": "PVE-2021-38150",
+            "id": "pyup.io-38150",
+            "specs": [
+                "<1.0.26"
+            ],
+            "v": "<1.0.26"
+        }
+    ],
+    "django-smart-selects": [
+        {
+            "advisory": "django-smart-selects before 1.5.0 allowed anybody to list arbitrary objects by tweaking URL parameters. 1.5.0 adds checks to the views to ensure that queries return an HTTP 403 (Permission denied) for models that do not have smart_selects fields defined.",
+            "cve": "PVE-2021-34234",
+            "id": "pyup.io-34234",
+            "specs": [
+                "<1.5.1"
+            ],
+            "v": "<1.5.1"
+        }
+    ],
+    "django-social-auth": [
+        {
+            "advisory": "django-social-auth 0.7.2 fixes a security hole - redirects via the next param are now properly sanitized to disallow redirecting to  external hosts.",
+            "cve": "PVE-2021-25790",
+            "id": "pyup.io-25790",
+            "specs": [
+                "<0.7.2"
+            ],
+            "v": "<0.7.2"
+        }
+    ],
+    "django-social-auth3": [
+        {
+            "advisory": "django-social-auth3 0.7.2 fixes a security hole - redirects via the next param are now properly sanitized to disallow redirecting to  external hosts.",
+            "cve": "PVE-2021-25791",
+            "id": "pyup.io-25791",
+            "specs": [
+                "<0.7.2"
+            ],
+            "v": "<0.7.2"
+        }
+    ],
+    "django-sql-dashboard": [
+        {
+            "advisory": "Django-sql-dashboard 0.14 fixes a security and permissions flaw, where users without the 'execute_sql' permission could still run custom queries by editing saved dashboards using the Django admin interface.",
+            "cve": "PVE-2021-40482",
+            "id": "pyup.io-40482",
+            "specs": [
+                "<0.14"
+            ],
+            "v": "<0.14"
+        }
+    ],
+    "django-sql-explorer": [
+        {
+            "advisory": "Users in django-sql-explorer version 0.5 with view permissions can use query parameters. This results in a potential for SQL injection.",
+            "cve": "PVE-2021-39445",
+            "id": "pyup.io-39445",
+            "specs": [
+                "<0.5"
+            ],
+            "v": "<0.5"
+        },
+        {
+            "advisory": "Django-sql-explorer before 1.1.0 isn't escaping values from the database correctly, making it open for potential XSS-attacks.\r\nhttps://github.com/groveco/django-sql-explorer/pull/286",
+            "cve": "PVE-2021-33293",
+            "id": "pyup.io-33293",
+            "specs": [
+                "<1.1.0"
+            ],
+            "v": "<1.1.0"
+        }
+    ],
+    "django-sticky-uploads": [
+        {
+            "advisory": "django-sticky-uploads 0.2.0 fixes a security issue related to client changing the upload url specified by the widget for the upload.",
+            "cve": "PVE-2021-25793",
+            "id": "pyup.io-25793",
+            "specs": [
+                "<0.2.0"
+            ],
+            "v": "<0.2.0"
+        }
+    ],
+    "django-storages": [
+        {
+            "advisory": "In django-storages before 1.7 - the ``S3BotoStorage`` and ``S3Boto3Storage`` backends have an insecure default ACL of ``public-read``. It is recommended that all current users upgrade to 1.7 and audit their bucket permissions.  Support has been added for setting ``AWS_DEFAULT_ACL = None`` and ``AWS_BUCKET_ACL = None``. V1.7 will raise a warning if ``AWS_DEFAULT_ACL`` or ``AWS_BUCKET_ACL`` is not explicitly set.",
+            "cve": "PVE-2021-36434",
+            "id": "pyup.io-36434",
+            "specs": [
+                "<1.7"
+            ],
+            "v": "<1.7"
+        }
+    ],
+    "django-tastypie": [
+        {
+            "advisory": "The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.",
+            "cve": "CVE-2011-4104",
+            "id": "pyup.io-25794",
+            "specs": [
+                "<0.9.10"
+            ],
+            "v": "<0.9.10"
+        }
+    ],
+    "django-trench": [
+        {
+            "advisory": "Django-trench 0.2.3 updates default backup codes settings to a more secure standard.\r\nhttps://github.com/merixstudio/django-trench/pull/52",
+            "cve": "PVE-2021-42899",
+            "id": "pyup.io-42899",
+            "specs": [
+                "<0.2.3"
+            ],
+            "v": "<0.2.3"
+        }
+    ],
+    "django-triggers": [
+        {
+            "advisory": "Django-triggers 2.0.13 updates its dependency 'Django' to v2.1.5 to include security fixes.",
+            "cve": "CVE-2020-9402",
+            "id": "pyup.io-43667",
+            "specs": [
+                "<2.0.13"
+            ],
+            "v": "<2.0.13"
+        },
+        {
+            "advisory": "Django-triggers 2.0.13 updates its dependency 'Django' to v2.1.5 to include security fixes.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-43669",
+            "specs": [
+                "<2.0.13"
+            ],
+            "v": "<2.0.13"
+        },
+        {
+            "advisory": "Django-triggers 2.0.13 updates its dependency 'Django' to v2.1.5 to include security fixes.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-43668",
+            "specs": [
+                "<2.0.13"
+            ],
+            "v": "<2.0.13"
+        },
+        {
+            "advisory": "Django-triggers 2.0.13 updates its dependency 'Django' to v2.1.5 to include security fixes.",
+            "cve": "CVE-2018-7537",
+            "id": "pyup.io-37072",
+            "specs": [
+                "<2.0.13"
+            ],
+            "v": "<2.0.13"
+        }
+    ],
+    "django-two-factor-auth": [
+        {
+            "advisory": "Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authentication code. This means that the password is stored in clear text in the session for an arbitrary amount of time, and potentially forever if the user begins the login process by entering their username and password and then leaves before entering their two-factor authentication code. The severity of this issue depends on which type of session storage you have configured: in the worst case, if you're using Django's default database session storage, then users' passwords are stored in clear text in your database. In the best case, if you're using Django's signed cookie session, then users' passwords are only stored in clear text within their browser's cookie store. In the common case of using Django's cache session store, the users' passwords are stored in clear text in whatever cache storage you have configured (typically Memcached or Redis). This has been fixed in 1.12. After upgrading, users should be sure to delete any clear text passwords that have been stored. For example, if you're using the database session backend, you'll likely want to delete any session record from the database and purge that data from any database backups or replicas. In addition, affected organizations who have suffered a database breach while using an affected version should inform their users that their clear text passwords have been compromised. All organizations should encourage users whose passwords were insecurely stored to change these passwords on any sites where they were used. As a workaround, wwitching Django's session storage to use signed cookies instead of the database or cache lessens the impact of this issue, but should not be done without a thorough understanding of the security tradeoffs of using signed cookies rather than a server-side session storage. There is no way to fully mitigate the issue without upgrading. See: CVE-2020-15105.",
+            "cve": "CVE-2020-15105",
+            "id": "pyup.io-38562",
+            "specs": [
+                "<1.12"
+            ],
+            "v": "<1.12"
+        }
+    ],
+    "django-ucamlookup": [
+        {
+            "advisory": "django-ucamlookup 1.9 fixes XXS vulnerability in template macros",
+            "cve": "PVE-2021-36744",
+            "id": "pyup.io-36744",
+            "specs": [
+                "<1.9"
+            ],
+            "v": "<1.9"
+        }
+    ],
+    "django-uni-form": [
+        {
+            "advisory": "Django-uni-form 0.9.0 fixes a XSS security issue. Errors weren't rendered safe: field's input was part of the error message, unsanitized.\r\nhttps://github.com/pydanny/django-uni-form/pull/98",
+            "cve": "PVE-2021-25796",
+            "id": "pyup.io-25796",
+            "specs": [
+                "<0.9.0"
+            ],
+            "v": "<0.9.0"
+        }
+    ],
+    "django-unicorn": [
+        {
+            "advisory": "Django-unicorn version 0.29.0 sanitizes initial JSON to prevent XSS.\r\nhttps://github.com/adamghill/django-unicorn/commit/c38e2a8bbb3ec6a8cdba30813282d9159c90f0d2",
+            "cve": "PVE-2021-42099",
+            "id": "pyup.io-42099",
+            "specs": [
+                "<0.29.0"
+            ],
+            "v": "<0.29.0"
+        },
+        {
+            "advisory": "Django-unicorn version 0.36.0 includes a fix for CVE-2021-42053: The Unicorn framework through 0.35.3 for Django allows XSS via component.name.\r\nhttps://github.com/adamghill/django-unicorn/pull/288/files",
+            "cve": "CVE-2021-42053",
+            "id": "pyup.io-42060",
+            "specs": [
+                "<0.36.0"
+            ],
+            "v": "<0.36.0"
+        },
+        {
+            "advisory": "The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.\r\nhttps://github.com/adamghill/django-unicorn/commit/3a832a9e3f6455ddd3b87f646247269918ad10c6\r\nhttps://github.com/adamghill/django-unicorn/compare/0.36.0...0.36.1",
+            "cve": "CVE-2021-42134",
+            "id": "pyup.io-42107",
+            "specs": [
+                "<0.36.1"
+            ],
+            "v": "<0.36.1"
+        }
+    ],
+    "django-urlconf-export": [
+        {
+            "advisory": "Django-urlconf-export 1.1.1 updates Django to v3.0.7 to include security fixes.",
+            "cve": "CVE-2020-13596",
+            "id": "pyup.io-38386",
+            "specs": [
+                "<1.1.1"
+            ],
+            "v": "<1.1.1"
+        },
+        {
+            "advisory": "Django-urlconf-export 1.1.1 updates Django to v3.0.7 to include security fixes.",
+            "cve": "CVE-2020-13254",
+            "id": "pyup.io-43660",
+            "specs": [
+                "<1.1.1"
+            ],
+            "v": "<1.1.1"
+        }
+    ],
+    "django-user-accounts": [
+        {
+            "advisory": "django-user-accounts before 2.0.2 has a potentional security issue with leaking password reset tokens through HTTP Referer header.",
+            "cve": "PVE-2021-34774",
+            "id": "pyup.io-34774",
+            "specs": [
+                "<2.0.2"
+            ],
+            "v": "<2.0.2"
+        }
+    ],
+    "django-user-management": [
+        {
+            "advisory": "Django-user-management 18.0.0 updates its dependency 'djangorestframework' to a version >=3.9.1 to patch an XSS vulnerability.",
+            "cve": "PVE-2021-43472",
+            "id": "pyup.io-38634",
+            "specs": [
+                "<18.0.0"
+            ],
+            "v": "<18.0.0"
+        },
+        {
+            "advisory": "Django-user-management 18.0.0 updates its dependency 'pillow' to a version >3.3.2 to include security fixes.",
+            "cve": "CVE-2016-9189",
+            "id": "pyup.io-43473",
+            "specs": [
+                "<18.0.0"
+            ],
+            "v": "<18.0.0"
+        },
+        {
+            "advisory": "Django-user-management 18.0.0 updates its dependency 'pillow' to a version >3.3.2 to include security fixes.",
+            "cve": "CVE-2016-9190",
+            "id": "pyup.io-43474",
+            "specs": [
+                "<18.0.0"
+            ],
+            "v": "<18.0.0"
+        }
+    ],
+    "django-user-sessions": [
+        {
+            "advisory": "In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen. See: CVE-2020-5224.",
+            "cve": "CVE-2020-5224",
+            "id": "pyup.io-37777",
+            "specs": [
+                "<1.7.1"
+            ],
+            "v": "<1.7.1"
+        }
+    ],
+    "django-watchman": [
+        {
+            "advisory": "django-watchman  0.10.0 improves security by keeping tokens out of logs.",
+            "cve": "PVE-2021-25797",
+            "id": "pyup.io-25797",
+            "specs": [
+                "<0.10.0"
+            ],
+            "v": "<0.10.0"
+        }
+    ],
+    "django-widgy": [
+        {
+            "advisory": "Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page' (https://github.com/fusionbox/django-widgy/issues/387). See CVE-2020-18704.",
+            "cve": "CVE-2020-18704",
+            "id": "pyup.io-41185",
+            "specs": [
+                "==0.8.4"
+            ],
+            "v": "==0.8.4"
+        }
+    ],
+    "django-x509": [
+        {
+            "advisory": "Django-x509 0.9.1 updates the minimum version of 'cryptography' to 3.2 for security reasons.",
+            "cve": "CVE-2020-25659",
+            "id": "pyup.io-39116",
+            "specs": [
+                "<0.9.1"
+            ],
+            "v": "<0.9.1"
+        }
+    ],
+    "djangocms-admin-style": [
+        {
+            "advisory": "djangocms-admin-style 1.2.5 fixes a potential security issue if the ``Site.name`` field contains malicious code.",
+            "cve": "PVE-2021-36834",
+            "id": "pyup.io-36834",
+            "specs": [
+                "<1.2.5"
+            ],
+            "v": "<1.2.5"
+        }
+    ],
+    "djangocms-highlightjs": [
+        {
+            "advisory": "djangocms-highlightjs before 0.3.1 has a unspecified security issue and is vulnerable via unknown vectors.",
+            "cve": "PVE-2021-25798",
+            "id": "pyup.io-25798",
+            "specs": [
+                "<0.3.1"
+            ],
+            "v": "<0.3.1"
+        }
+    ],
+    "djangorestframework": [
+        {
+            "advisory": "djangorestframework 2.2.1 fixes a security issue: Use `defusedxml` package to address XML parsing vulnerabilities.",
+            "cve": "PVE-2021-25799",
+            "id": "pyup.io-25799",
+            "specs": [
+                "<2.2.1"
+            ],
+            "v": "<2.2.1"
+        },
+        {
+            "advisory": "djangorestframework 2.3.12 fixes a security issue: `OrderingField` now only allows ordering on readable serializer fields, or on fields explicitly specified using `ordering_fields`. This prevents users being able to order by fields that are not visible in the API, and exploiting the ordering of sensitive data such as password hashes.",
+            "cve": "PVE-2021-25800",
+            "id": "pyup.io-25800",
+            "specs": [
+                "<2.3.12"
+            ],
+            "v": "<2.3.12"
+        },
+        {
+            "advisory": "djangorestframework 2.3.14 fixes a security issue: Escape request path when it is include as part of the login and logout links in the browsable API.",
+            "cve": "PVE-2021-25801",
+            "id": "pyup.io-25801",
+            "specs": [
+                "<2.3.14"
+            ],
+            "v": "<2.3.14"
+        },
+        {
+            "advisory": "djangorestframework 2.4.4 fixes a security issue: Escape URLs when replacing `format=` query parameter, as used in dropdown on `GET` button in browsable API to allow explicit selection of JSON vs HTML output.",
+            "cve": "PVE-2021-25802",
+            "id": "pyup.io-25802",
+            "specs": [
+                "<2.4.4"
+            ],
+            "v": "<2.4.4"
+        },
+        {
+            "advisory": "djangorestframework  2.4.5 fixes a security issue: Escape tab switching cookie name in browsable API. [Backported from 3.1.1]",
+            "cve": "PVE-2021-25803",
+            "id": "pyup.io-25803",
+            "specs": [
+                "<2.4.5"
+            ],
+            "v": "<2.4.5"
+        },
+        {
+            "advisory": "djangorestframework 3.1.1 fixes a security issue: : Escape tab switching cookie name in browsable API.",
+            "cve": "PVE-2021-25804",
+            "id": "pyup.io-25804",
+            "specs": [
+                "<3.1.1"
+            ],
+            "v": "<3.1.1"
+        },
+        {
+            "advisory": "Djangorestframework 3.12.0 includes a fix for CVE-2020-25626: A flaw was found in Django REST Framework versions before 3.12.0. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1878635",
+            "cve": "CVE-2020-25626",
+            "id": "pyup.io-38841",
+            "specs": [
+                "<3.12.0"
+            ],
+            "v": "<3.12.0"
+        },
+        {
+            "advisory": "Djangorestframework 3.9.1 includes a fix for an XSS vulnerability.\r\nhttps://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8",
+            "cve": "PVE-2021-43472",
+            "id": "pyup.io-43472",
+            "specs": [
+                "<3.9.1"
+            ],
+            "v": "<3.9.1"
+        }
+    ],
+    "djangorestframework-api-key": [
+        {
+            "advisory": "djangorestframework-api-key before 0.2.0 the API key was stored in plaintext in database.",
+            "cve": "PVE-2021-36524",
+            "id": "pyup.io-36524",
+            "specs": [
+                "<0.2.0"
+            ],
+            "v": "<0.2.0"
+        }
+    ],
+    "djangorestframework-simplejwt": [
+        {
+            "advisory": "djangorestframework-simplejwt before 1.5 allowed `__getattr__` access to the underlying JWT through the `rest_framework_simplejwt.module.TokenUser` class.",
+            "cve": "PVE-2021-34792",
+            "id": "pyup.io-34792",
+            "specs": [
+                "<1.5"
+            ],
+            "v": "<1.5"
+        }
+    ],
+    "djangosaml2": [
+        {
+            "advisory": "djangosaml2 0.17.2 upgrades the pysaml2 dependency to version 4.6.0 which fixes a security issue.",
+            "cve": "PVE-2021-36423",
+            "id": "pyup.io-36423",
+            "specs": [
+                "<0.17.2"
+            ],
+            "v": "<0.17.2"
+        },
+        {
+            "advisory": "Djangosaml2 1.0.1 includes a security update for the PySAML2 dependency.",
+            "cve": "CVE-2021-21239",
+            "id": "pyup.io-43661",
+            "specs": [
+                "<1.0.1"
+            ],
+            "v": "<1.0.1"
+        },
+        {
+            "advisory": "Djangosaml2 1.0.1 includes a security update for the PySAML2 dependency.",
+            "cve": "CVE-2021-21238",
+            "id": "pyup.io-39535",
+            "specs": [
+                "<1.0.1"
+            ],
+            "v": "<1.0.1"
+        }
+    ],
+    "djblets": [
+        {
+            "advisory": "Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.",
+            "cve": "CVE-2014-3994",
+            "id": "pyup.io-35571",
+            "specs": [
+                "<0.8.3"
+            ],
+            "v": "<0.8.3"
+        },
+        {
+            "advisory": "Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.",
+            "cve": "CVE-2014-3995",
+            "id": "pyup.io-35572",
+            "specs": [
+                "<0.8.3"
+            ],
+            "v": "<0.8.3"
+        },
+        {
+            "advisory": "An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. See: CVE-2013-4409.",
+            "cve": "CVE-2013-4409",
+            "id": "pyup.io-37636",
+            "specs": [
+                "==0.7.21"
+            ],
+            "v": "==0.7.21"
+        }
+    ],
+    "djedefre": [
+        {
+            "advisory": "djedefre 0.7.0 fixes a security bug in \"djoser.views.UserView\"",
+            "cve": "PVE-2021-37913",
+            "id": "pyup.io-37913",
+            "specs": [
+                "<0.7.0"
+            ],
+            "v": "<0.7.0"
+        },
+        {
+            "advisory": "djedefre 1.3.2 fixes vulnerability of user endpoints.",
+            "cve": "PVE-2021-37912",
+            "id": "pyup.io-37912",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "djedefre 1.5.1 fixes a vulnerability of UserViewSet that allows to create new accounts on wrong endpoint",
+            "cve": "PVE-2021-37911",
+            "id": "pyup.io-37911",
+            "specs": [
+                "<1.5.1"
+            ],
+            "v": "<1.5.1"
+        }
+    ],
+    "djem": [
+        {
+            "advisory": "Djem version 0.6 adds CSRF tokens to outgoing AJAX requests.",
+            "cve": "PVE-2021-42044",
+            "id": "pyup.io-42044",
+            "specs": [
+                "<0.6"
+            ],
+            "v": "<0.6"
+        }
+    ],
+    "djoser": [
+        {
+            "advisory": "djoser 0.7.0 fixes a security bug in djoser.views.UserView. (Missing more information)",
+            "cve": "PVE-2021-34904",
+            "id": "pyup.io-34904",
+            "specs": [
+                "<0.7.0"
+            ],
+            "v": "<0.7.0"
+        },
+        {
+            "advisory": "djoser 1.3.2 fixes vulnerability of user endpoints.",
+            "cve": "PVE-2021-36711",
+            "id": "pyup.io-36711",
+            "specs": [
+                "<1.3.2"
+            ],
+            "v": "<1.3.2"
+        },
+        {
+            "advisory": "djoser 1.5.1 fixes a vulnerability of UserViewSet that allowed to create new accounts on wrong endpoint.",
+            "cve": "PVE-2021-37010",
+            "id": "pyup.io-37010",
+            "specs": [
+                "<1.5.1"
+            ],
+            "v": "<1.5.1"
+        }
+    ],
+    "dlhub-gateway": [
+        {
+            "advisory": "Dlhub-gateway 2.0.0 fixes security requirements in the swagger spec.",
+            "cve": "PVE-2021-37339",
+            "id": "pyup.io-37339",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        }
+    ],
+    "dmoj": [
+        {
+            "advisory": "Dmoj 1.4.0 includes a number of enhancements and security fixes.",
+            "cve": "PVE-2021-37474",
+            "id": "pyup.io-37474",
+            "specs": [
+                "<1.4.0"
+            ],
+            "v": "<1.4.0"
+        },
+        {
+            "advisory": "ANSI HTML-ifying has been moved to the site in dmoj 2.0.0 in order to prevent judges from potentially executing HTML injection attacks.",
+            "cve": "PVE-2021-38276",
+            "id": "pyup.io-38276",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        },
+        {
+            "advisory": "Dmoj 3.0.1 includes two security fixes:\r\n-Wraps JVM-based executors in cptbox rather than relying only on security policies.\r\n-Patches \"int(...)\" to avoid DOS attacks in custom checkers.",
+            "cve": "PVE-2021-41295",
+            "id": "pyup.io-41295",
+            "specs": [
+                "<3.0.1"
+            ],
+            "v": "<3.0.1"
+        }
+    ],
+    "dnsimple": [
+        {
+            "advisory": "Dnsimple 2.1.2 updates its dependency 'pytest' to v6.2.4 to include security fixes.",
+            "cve": "PVE-2021-43015",
+            "id": "pyup.io-43015",
+            "specs": [
+                "<2.1.2"
+            ],
+            "v": "<2.1.2"
+        },
+        {
+            "advisory": "Dnsimple 2.1.2 updates its dependency 'urllib3' to v1.26.4 to include a security fix.",
+            "cve": "CVE-2021-28363",
+            "id": "pyup.io-40425",
+            "specs": [
+                "<2.1.2"
+            ],
+            "v": "<2.1.2"
+        }
+    ],
+    "dnslib": [
+        {
+            "advisory": "Dnslib 0.9.17 includes a fix for CVE-2022-22846: The dnslib package through 0.9.16 for Python does not verify that the ID value in a DNS reply matches an ID value in a query.\r\nhttps://github.com/paulc/dnslib/issues/30",
+            "cve": "CVE-2022-22846",
+            "id": "pyup.io-44488",
+            "specs": [
+                "<0.9.17"
+            ],
+            "v": "<0.9.17"
+        }
+    ],
+    "dnsupdate": [
+        {
+            "advisory": "Dnsupdate version 0.4 includes a security patch for the function '_load_cache' in 'dnsupdate.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/lopsided98/dnsupdate/commit/f708d0b6c7340334199b3a91bdbb626b5da09633#diff-bbb8416d14c72839288c2df5695624f5b1810a9fb4d94ab83750725cddfda472",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41318",
+            "specs": [
+                "<0.4"
+            ],
+            "v": "<0.4"
+        }
+    ],
+    "docassemble": [
+        {
+            "advisory": "Docassemble 0.3.35 includes a more robust code injection detection mechanism.",
+            "cve": "PVE-2021-38925",
+            "id": "pyup.io-38925",
+            "specs": [
+                "<0.3.35"
+            ],
+            "v": "<0.3.35"
+        },
+        {
+            "advisory": "Docassemble 0.5.105 upgrades 'bleach' due to security vulnerability",
+            "cve": "PVE-2021-37941",
+            "id": "pyup.io-37941",
+            "specs": [
+                "<0.5.105"
+            ],
+            "v": "<0.5.105"
+        },
+        {
+            "advisory": "Docassemble 1.0.12 includes an important fix for a security vulnerability.",
+            "cve": "PVE-2021-40418",
+            "id": "pyup.io-40418",
+            "specs": [
+                "<1.0.12"
+            ],
+            "v": "<1.0.12"
+        },
+        {
+            "advisory": "Docassemble 1.1.113 includes an important fix for a security vulnerability.",
+            "cve": "PVE-2021-40417",
+            "id": "pyup.io-40417",
+            "specs": [
+                "<1.1.113"
+            ],
+            "v": "<1.1.113"
+        },
+        {
+            "advisory": "Docassemble 1.2.65 includes a fix for an important security vulnerability.",
+            "cve": "PVE-2021-40397",
+            "id": "pyup.io-40397",
+            "specs": [
+                "<1.2.65"
+            ],
+            "v": "<1.2.65"
+        }
+    ],
+    "doccano": [
+        {
+            "advisory": "Doccano 1.0.1 adds X-Frame-Options header to prevent clickjacking.",
+            "cve": "PVE-2021-42228",
+            "id": "pyup.io-42228",
+            "specs": [
+                "<1.0.1"
+            ],
+            "v": "<1.0.1"
+        },
+        {
+            "advisory": "Doccano 1.0.3updates nginx.conf to enhance security.",
+            "cve": "PVE-2021-39243",
+            "id": "pyup.io-39243",
+            "specs": [
+                "<1.0.3"
+            ],
+            "v": "<1.0.3"
+        }
+    ],
+    "docker": [
+        {
+            "advisory": "docker 3.5.1 bumps version of `pyOpenSSL` in `requirements.txt` and `setup.py` to prevent\r\n  installation of a vulnerable version.",
+            "cve": "PVE-2021-36783",
+            "id": "pyup.io-36783",
+            "specs": [
+                "<3.5.1"
+            ],
+            "v": "<3.5.1"
+        }
+    ],
+    "docker-registry": [
+        {
+            "advisory": "docker-registry 0.8.1 has security fixes (path traversing prevention and token validation).",
+            "cve": "PVE-2021-25805",
+            "id": "pyup.io-25805",
+            "specs": [
+                "<0.8.1"
+            ],
+            "v": "<0.8.1"
+        }
+    ],
+    "docutils-glep": [
+        {
+            "advisory": "Docutils-glep version 1.2 includes a security patch for the function 'parse' in 'docutils_glep/reader.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/mgorny/docutils-glep/commit/d407ea56b1b91a0ac2450fe13306a0be8cffce41",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41319",
+            "specs": [
+                "<1.2"
+            ],
+            "v": "<1.2"
+        }
+    ],
+    "dogtag-pki": [
+        {
+            "advisory": "In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1. See: CVE-2020-15720.",
+            "cve": "CVE-2020-15720",
+            "id": "pyup.io-38574",
+            "specs": [
+                "<=10.8.3"
+            ],
+            "v": "<=10.8.3"
+        }
+    ],
+    "domonic": [
+        {
+            "advisory": "Domonic 0.2.17 includes a security fix pushed by the 'Dependabot'.",
+            "cve": "PVE-2021-40325",
+            "id": "pyup.io-40325",
+            "specs": [
+                "<0.2.17"
+            ],
+            "v": "<0.2.17"
+        }
+    ],
+    "donfig": [
+        {
+            "advisory": "An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, resulting in command execution.",
+            "cve": "CVE-2019-7537",
+            "id": "pyup.io-36976",
+            "specs": [
+                "==0.3.0"
+            ],
+            "v": "==0.3.0"
+        }
+    ],
+    "dosma": [
+        {
+            "advisory": "Dosma version 0.0.13 includes a security patch for the function 'init' in 'dosma/defaults.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/ad12/DOSMA/commit/44457025faac9f09ac0bd26c93185adc612da7dc#",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41320",
+            "specs": [
+                "<0.0.13"
+            ],
+            "v": "<0.0.13"
+        }
+    ],
+    "dparse2": [
+        {
+            "advisory": "Dparse2 0.6.0 fixes a security issue related to Regex parsing.\r\nhttps://github.com/pyupio/dparse/commit/3aecaac9a1bde349418810a320a7e5ec31ee276a",
+            "cve": "PVE-2022-44512",
+            "id": "pyup.io-44512",
+            "specs": [
+                "<0.6.0"
+            ],
+            "v": "<0.6.0"
+        }
+    ],
+    "dpaste": [
+        {
+            "advisory": "Dpaste 2.8 fixes a XSS bug where HTML tags were not properly escaped with the simple  \"code\" lexer.\r\nhttps://github.com/bartTC/dpaste/commit/497e5f0c28d575b3e92ef65b70384314a9e330da",
+            "cve": "PVE-2021-25807",
+            "id": "pyup.io-25807",
+            "specs": [
+                "<2.8"
+            ],
+            "v": "<2.8"
+        }
+    ],
+    "dplib": [
+        {
+            "advisory": "dplib 1.4 fixes some security issues and added support for mapchange and namechange events",
+            "cve": "PVE-2021-35851",
+            "id": "pyup.io-35851",
+            "specs": [
+                "<1.4"
+            ],
+            "v": "<1.4"
+        }
+    ],
+    "dpymenus": [
+        {
+            "advisory": "Dpymenus 2.1.5 fixes a security issue in the 'urllib3' dependency for versions prior to 1.26.5.",
+            "cve": "PVE-2021-40583",
+            "id": "pyup.io-40583",
+            "specs": [
+                "<2.1.5"
+            ],
+            "v": "<2.1.5"
+        }
+    ],
+    "draft-kings": [
+        {
+            "advisory": "Draft-kings 2.0.3 updates its dependency 'urllib3' to v1.25.9 due to security issues.",
+            "cve": "CVE-2020-26137",
+            "id": "pyup.io-39238",
+            "specs": [
+                "<2.0.3"
+            ],
+            "v": "<2.0.3"
+        }
+    ],
+    "drf-api-logger": [
+        {
+            "advisory": "Drf-api-logger 0.0.7 includes the warning that 'allowed hosts protection' is skipped when a RAW_URI value is used for DRF_API_LOGGER_PATH_TYPE. Consequently, an insecure URI may be returned.",
+            "cve": "PVE-2021-39108",
+            "id": "pyup.io-39108",
+            "specs": [
+                "<=0.0.7"
+            ],
+            "v": "<=0.0.7"
+        }
+    ],
+    "drf-extra-fields": [
+        {
+            "advisory": "Drf-extra-fields 2.0.0 upgrades Pillow to 6.2.1 to fix a security vulnerability.\r\nhttps://github.com/Hipo/drf-extra-fields/commit/89131439d4354fb0d587affa639edbdaa588cf30",
+            "cve": "PVE-2021-38809",
+            "id": "pyup.io-38809",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        }
+    ],
+    "drf-jwt": [
+        {
+            "advisory": "An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained. See: CVE-2020-10594.",
+            "cve": "CVE-2020-10594",
+            "id": "pyup.io-38073",
+            "specs": [
+                ">=1.15.0,<1.15.1"
+            ],
+            "v": ">=1.15.0,<1.15.1"
+        }
+    ],
+    "drf-renderer-xlsx": [
+        {
+            "advisory": "Drf-renderer-xlsx 0.4.1 includes proper escaping for possible malicious characters.\r\nhttps://github.com/wharton/drf-renderer-xlsx/pull/34",
+            "cve": "PVE-2021-42526",
+            "id": "pyup.io-42526",
+            "specs": [
+                "<0.4.1"
+            ],
+            "v": "<0.4.1"
+        }
+    ],
+    "drf-tracking": [
+        {
+            "advisory": "drf-tracking before 1.3.0",
+            "cve": "PVE-2021-34856",
+            "id": "pyup.io-34856",
+            "specs": [
+                "<1.3.0"
+            ],
+            "v": "<1.3.0"
+        }
+    ],
+    "droopescan": [
+        {
+            "advisory": "Droopescan 1.33.1 includes an update of Joomla because of an unauthenticated SQL injection vulnerability.",
+            "cve": "PVE-2021-39049",
+            "id": "pyup.io-39049",
+            "specs": [
+                "<1.33.1"
+            ],
+            "v": "<1.33.1"
+        }
+    ],
+    "drt": [
+        {
+            "advisory": "Drt version 1.2.1 includes a security patch for the function 'readConfig' in 'drt/configfile.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/ccdale/drt/commit/2fffc617a9ddac040182d54a3227c87eb268b8ed",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41321",
+            "specs": [
+                "<1.2.1"
+            ],
+            "v": "<1.2.1"
+        },
+        {
+            "advisory": "Drt throughout version 1.2.1 uses unsafe \"os.system\" in \"drt/dvddisc.py\". Under non-trusted input, it could lead to OS injection.",
+            "cve": "PVE-2021-41760",
+            "id": "pyup.io-41760",
+            "specs": [
+                "<=1.2.1"
+            ],
+            "v": "<=1.2.1"
+        }
+    ],
+    "dtale": [
+        {
+            "advisory": "Dtale 1.9.1 includes a fix for USE_COLAB to prevent colab proxy endpoint injection.",
+            "cve": "PVE-2021-38928",
+            "id": "pyup.io-38928",
+            "specs": [
+                "<1.9.1"
+            ],
+            "v": "<1.9.1"
+        }
+    ],
+    "dulwich": [
+        {
+            "advisory": "Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.",
+            "cve": "CVE-2015-0838",
+            "id": "pyup.io-25808",
+            "specs": [
+                "<0.9.920150320"
+            ],
+            "v": "<0.9.920150320"
+        }
+    ],
+    "dynamixel-sdk": [
+        {
+            "advisory": "ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.",
+            "cve": "CVE-2019-15786",
+            "id": "pyup.io-42263",
+            "specs": [
+                "<=3.7.11"
+            ],
+            "v": "<=3.7.11"
+        }
+    ],
+    "dynamo-release": [
+        {
+            "advisory": "Dynamo-release 0.99 includes fixes for various vulnerabilities.",
+            "cve": "PVE-2021-40192",
+            "id": "pyup.io-40192",
+            "specs": [
+                "<0.99"
+            ],
+            "v": "<0.99"
+        }
+    ],
+    "easy-install": [
+        {
+            "advisory": "easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.",
+            "cve": "PVE-2021-33124",
+            "id": "pyup.io-33124",
+            "specs": [
+                "<0.7"
+            ],
+            "v": "<0.7"
+        }
+    ],
+    "easy-xml": [
+        {
+            "advisory": "The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as input. See CVE-2020-26705.\r\nhttps://github.com/darkfoxprime/python-easy_xml/issues/1",
+            "cve": "CVE-2020-26705",
+            "id": "pyup.io-42417",
+            "specs": [
+                "==0.5.0"
+            ],
+            "v": "==0.5.0"
+        }
+    ],
+    "ebookmaker": [
+        {
+            "advisory": "Ebookmaker version 0.11.14 requires a version of its dependency 'pillow' >=8.3.2 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-43550",
+            "specs": [
+                "<0.11.14"
+            ],
+            "v": "<0.11.14"
+        },
+        {
+            "advisory": "Ebookmaker version 0.11.14 requires a version of its dependency 'pillow' >=8.3.2 to include security fixes.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-42213",
+            "specs": [
+                "<0.11.14"
+            ],
+            "v": "<0.11.14"
+        }
+    ],
+    "ec2-metadata": [
+        {
+            "advisory": "Ec2-metadata 2.2.0 moves to use Instance Metadata Service version 2 due to its increased security - see: https://github.com/adamchainz/ec2-metadata/issues/150",
+            "cve": "PVE-2021-38053",
+            "id": "pyup.io-38053",
+            "specs": [
+                "<2.2.0"
+            ],
+            "v": "<2.2.0"
+        }
+    ],
+    "ecdsa": [
+        {
+            "advisory": "A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions. See: CVE-2019-14859.",
+            "cve": "CVE-2019-14859",
+            "id": "pyup.io-37763",
+            "specs": [
+                "<0.13.3"
+            ],
+            "v": "<0.13.3"
+        },
+        {
+            "advisory": "An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service. See CVE-2019-14853.",
+            "cve": "CVE-2019-14853",
+            "id": "pyup.io-37762",
+            "specs": [
+                "<0.13.3"
+            ],
+            "v": "<0.13.3"
+        },
+        {
+            "advisory": "In ecdsa 0.14, deterministic signatures verify that the signature won't leak private key through very unlikely selection of `k` value (the nonce). Nonce bit size hiding was added (hardening against Minerva attack). Please note that it DOES NOT make library secure against side channel attacks (timing attacks).",
+            "cve": "PVE-2021-37637",
+            "id": "pyup.io-37637",
+            "specs": [
+                "<0.14"
+            ],
+            "v": "<0.14"
+        }
+    ],
+    "edapy": [
+        {
+            "advisory": "Edapy version 0.3.0 includes a security patch for the function '_read_yaml' in 'edapy/csv/init.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/MartinThoma/edapy/commit/47b958781a702e176ea72fe59ab8596ad93aabdc#diff-150063df356bdd6b5d718194a9ccb7750d86f8608959d31cef59012a8471709f",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41322",
+            "specs": [
+                "<0.3.0"
+            ],
+            "v": "<0.3.0"
+        }
+    ],
+    "edrn-sync": [
+        {
+            "advisory": "Edrn-sync version 1.0.5 addresses a vulnerability created by weak default passwords sync'd from the DMCC users list. It generates more secure random passwords for new users and also provides a utility for detecting old weak passwords and changing them to something randomized.",
+            "cve": "PVE-2021-41918",
+            "id": "pyup.io-41918",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        }
+    ],
+    "edrnsite.policy": [
+        {
+            "advisory": "Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.",
+            "cve": "CVE-2011-0720",
+            "id": "pyup.io-25810",
+            "specs": [
+                "<1.0.5"
+            ],
+            "v": "<1.0.5"
+        }
+    ],
+    "edx-ecommerce-worker": [
+        {
+            "advisory": "Edx-ecommerce-worker 0.8.3 updates its dependency 'pyyaml' to v5.1 to include a security fix.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-38792",
+            "specs": [
+                "<0.8.3"
+            ],
+            "v": "<0.8.3"
+        }
+    ],
+    "edx-proctoring": [
+        {
+            "advisory": "Edx-proctoring version 4.1.0 adds encryption to video review urls.",
+            "cve": "PVE-2021-42048",
+            "id": "pyup.io-42048",
+            "specs": [
+                "<4.1.0"
+            ],
+            "v": "<4.1.0"
+        }
+    ],
+    "egon": [
+        {
+            "advisory": "Egon 0.4.1 improves security and provides improved performance.",
+            "cve": "PVE-2021-40568",
+            "id": "pyup.io-40568",
+            "specs": [
+                "<0.4.1"
+            ],
+            "v": "<0.4.1"
+        }
+    ],
+    "eh": [
+        {
+            "advisory": "eh 0.2.8 changes: Fixed pyyaml security issue",
+            "cve": "PVE-2021-37217",
+            "id": "pyup.io-37217",
+            "specs": [
+                "<0.2.8"
+            ],
+            "v": "<0.2.8"
+        },
+        {
+            "advisory": "Eh 1.3.0 fixes a pyyaml security issue.",
+            "cve": "PVE-2021-37500",
+            "id": "pyup.io-37500",
+            "specs": [
+                "<1.3.0"
+            ],
+            "v": "<1.3.0"
+        }
+    ],
+    "ekuiper": [
+        {
+            "advisory": "Ekuiper 1.1.2 runs build process/container as 'kuiper' user to avoid security risks.\r\nhttps://github.com/lf-edge/ekuiper/commit/1327eb69d0173c8d4a2070a835be6894f5a90b2b",
+            "cve": "PVE-2021-42963",
+            "id": "pyup.io-42963",
+            "specs": [
+                "<1.1.2"
+            ],
+            "v": "<1.1.2"
+        }
+    ],
+    "elastic-apm": [
+        {
+            "advisory": "When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing. See: CVE-2019-7617.",
+            "cve": "CVE-2019-7617",
+            "id": "pyup.io-37398",
+            "specs": [
+                "<5.1.0"
             ],
-            "v": ">=1.8,<1.8.16,>=1.9,<1.9.11,>=1.10,<1.10.3"
-        },
+            "v": "<5.1.0"
+        }
+    ],
+    "electrumsv-secp256k1": [
         {
-            "advisory": "Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created when running tests with an Oracle database, which makes it easier for remote attackers to obtain access to the database server by leveraging failure to manually specify a password in the database settings TEST dictionary.",
-            "cve": "CVE-2016-9013",
-            "id": "pyup.io-33076",
+            "advisory": "Electrumsv-secp256k1 version 8.0.0 makes build system support new GitHub & PyPI security requirements.",
+            "cve": "PVE-2021-42043",
+            "id": "pyup.io-42043",
             "specs": [
-                ">=1.8,<1.8.16",
-                ">=1.9,<1.9.11",
-                ">=1.10,<1.10.3"
+                "<8.0.0"
             ],
-            "v": ">=1.8,<1.8.16,>=1.9,<1.9.11,>=1.10,<1.10.3"
-        },
+            "v": "<8.0.0"
+        }
+    ],
+    "electrumx": [
         {
-            "advisory": "The session.flush function in the cached_db backend in Django 1.8.x before 1.8.2 does not properly flush the session, which allows remote attackers to hijack user sessions via an empty string in the session key.",
-            "cve": "CVE-2015-3982",
-            "id": "pyup.io-25732",
+            "advisory": "electrumx before 1.4.1 did not use PROTOCOL_MIN to 1.0; this did not prevent 2.9.x clients from connecting\r\n  and encouraging upgrades to more recent clients without the security hole.",
+            "cve": "PVE-2021-36324",
+            "id": "pyup.io-36324",
             "specs": [
-                ">=1.8,<1.8.2"
+                "<1.4.1"
             ],
-            "v": ">=1.8,<1.8.2"
-        },
+            "v": "<1.4.1"
+        }
+    ],
+    "elkm1": [
         {
-            "advisory": "validators.URLValidator in Django 1.8.x before 1.8.3 allows remote attackers to cause a denial of service (CPU consumption) via unspecified vectors.",
-            "cve": "CVE-2015-5145",
-            "id": "pyup.io-25733",
+            "advisory": "Elkm1 v1.0.0 adds support for TLS 1.2 secure connection mode.",
+            "cve": "PVE-2021-42011",
+            "id": "pyup.io-42011",
             "specs": [
-                ">=1.8,<1.8.3"
+                "<1.0.0"
             ],
-            "v": ">=1.8,<1.8.3"
-        },
+            "v": "<1.0.0"
+        }
+    ],
+    "elyra": [
         {
-            "advisory": "Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an (1) email message to the EmailValidator, a (2) URL to the URLValidator, or unspecified vectors to the (3) validate_ipv4_address or (4) validate_slug validator.",
-            "cve": "CVE-2015-5144",
-            "id": "pyup.io-25726",
+            "advisory": "Elyra 2.2.3 allows secure connections to S3 object storage.",
+            "cve": "PVE-2021-40313",
+            "id": "pyup.io-40313",
             "specs": [
-                ">=1.8,<1.8.3",
-                ">=1.7,<1.7.9",
-                ">=1.5,<1.6",
-                ">=1.4,<1.4.21"
+                "<2.2.3"
             ],
-            "v": ">=1.8,<1.8.3,>=1.7,<1.7.9,>=1.5,<1.6,>=1.4,<1.4.21"
+            "v": "<2.2.3"
         },
         {
-            "advisory": "The get_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow remote attackers to obtain sensitive application secrets via a settings key in place of a date/time format setting, as demonstrated by SECRET_KEY.",
-            "cve": "CVE-2015-8213",
-            "id": "pyup.io-25714",
+            "advisory": "Elyra 2.3.0b0 allows secure connections to S3 object storage.",
+            "cve": "PVE-2021-40312",
+            "id": "pyup.io-40312",
             "specs": [
-                ">=1.8,<1.8.7",
-                "<1.7.11",
-                ">=1.9,<1.9rc2"
+                "<2.3.0b0"
             ],
-            "v": ">=1.8,<1.8.7,<1.7.11,>=1.9,<1.9rc2"
+            "v": "<2.3.0b0"
         },
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in the contents function in admin/helpers.py in Django before 1.7.6 and 1.8 before 1.8b2 allows remote attackers to inject arbitrary web script or HTML via a model attribute in ModelAdmin.readonly_fields, as demonstrated by a @property.",
-            "cve": "CVE-2015-2241",
-            "id": "pyup.io-25715",
+            "advisory": "Elyra 3.0.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
+            "cve": "CVE-2021-33503",
+            "id": "pyup.io-41074",
             "specs": [
-                ">=1.8,<1.8b2",
-                "<1.7.6"
+                "<3.0.0"
             ],
-            "v": ">=1.8,<1.8b2,<1.7.6"
+            "v": "<3.0.0"
         },
         {
-            "advisory": "The utils.http.is_safe_url function in Django before 1.4.20, 1.5.x, 1.6.x before 1.6.11, 1.7.x before 1.7.7, and 1.8.x before 1.8c1 does not properly validate URLs, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a control character in a URL, as demonstrated by a \\x08javascript: URL.",
-            "cve": "CVE-2015-2317",
-            "id": "pyup.io-25713",
+            "advisory": "Elyra 3.0.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
+            "cve": "CVE-2020-26137",
+            "id": "pyup.io-42728",
             "specs": [
-                ">=1.8,<1.8c1",
-                "<1.4.20",
-                ">=1.5,<1.6",
-                ">=1.6,<1.6.11",
-                ">=1.7,<1.7.7"
+                "<3.0.0"
             ],
-            "v": ">=1.8,<1.8c1,<1.4.20,>=1.5,<1.6,>=1.6,<1.6.11,>=1.7,<1.7.7"
+            "v": "<3.0.0"
         },
         {
-            "advisory": "Django versions 1.10.7, 1.9.13 and 1.8.18 include a fix for CVE-2017-7234: A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the 'django.views.static.serve()' view could redirect to any other domain, aka an open redirect vulnerability.\r\nhttps://www.djangoproject.com/weblog/2017/apr/04/security-releases/\r\nhttp://www.debian.org/security/2017/dsa-3835\r\nhttp://www.securityfocus.com/bid/97401\r\nhttp://www.securitytracker.com/id/1038177",
-            "cve": "CVE-2017-7234",
-            "id": "pyup.io-35740",
+            "advisory": "Elyra 3.0.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
+            "cve": "CVE-2019-11236",
+            "id": "pyup.io-42729",
             "specs": [
-                ">=1.8.0a1,<1.8.18",
-                ">=1.9.0a1,<1.9.13",
-                ">=1.10.0a1,<1.10.7"
+                "<3.0.0"
             ],
-            "v": ">=1.8.0a1,<1.8.18,>=1.9.0a1,<1.9.13,>=1.10.0a1,<1.10.7"
+            "v": "<3.0.0"
         },
         {
-            "advisory": "The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers to bypass an intended CSRF protection mechanism by setting arbitrary cookies.",
-            "cve": "CVE-2016-7401",
-            "id": "pyup.io-25718",
+            "advisory": "Elyra 3.0.0 updates its dependency 'requests' to v2.25.1 to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-42730",
             "specs": [
-                ">=1.9,<1.9.10",
-                "<1.8.15"
+                "<3.0.0"
             ],
-            "v": ">=1.9,<1.9.10,<1.8.15"
-        },
+            "v": "<3.0.0"
+        }
+    ],
+    "emcache": [
         {
-            "advisory": "Django 1.9.11 fixes two security issues in 1.9.10.\r\n\r\nUser with hardcoded password created when running tests on Oracle\r\n=================================================================\r\n\r\nWhen running tests with an Oracle database, Django creates a temporary database\r\nuser. In older versions, if a password isn't manually specified in the database\r\nsettings ``TEST`` dictionary, a hardcoded password is used. This could allow\r\nan attacker with network access to the database server to connect.\r\n\r\nThis user is usually dropped after the test suite completes, but not when using\r\nthe ``manage.py test --keepdb`` option or if the user has an active session\r\n(such as an attacker's connection).\r\n\r\nA randomly generated password is now used for each test run.\r\n\r\nDNS rebinding vulnerability when ``DEBUG=True``\r\n===============================================",
-            "cve": "PVE-2021-25734",
-            "id": "pyup.io-25734",
+            "advisory": "Emcache 1.3.6 fixes a security vulnerability by sanitizing key input.",
+            "cve": "PVE-2021-38331",
+            "id": "pyup.io-38331",
             "specs": [
-                ">=1.9,<1.9.11"
+                "<1.3.6"
             ],
-            "v": ">=1.9,<1.9.11"
-        },
+            "v": "<1.3.6"
+        }
+    ],
+    "emesene": [
         {
-            "advisory": "Django 1.9.x before 1.9.2, when ModelAdmin.save_as is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the \"Save as New\" option when editing objects and leveraging the \"change\" permission.",
-            "cve": "CVE-2016-2048",
-            "id": "pyup.io-25735",
+            "advisory": "emesenelib/ProfileManager.py in emesene before 1.6.2 allows local users to overwrite arbitrary files via a symlink attack on the emsnpic temporary file.",
+            "cve": "CVE-2010-2053",
+            "id": "pyup.io-42233",
             "specs": [
-                ">=1.9,<1.9.2"
+                "<1.6.2"
             ],
-            "v": ">=1.9,<1.9.2"
-        },
+            "v": "<1.6.2"
+        }
+    ],
+    "emitter-io": [
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjectLookups.js in Django before 1.8.14, 1.9.x before 1.9.8, and 1.10.x before 1.10rc1 allows remote attackers to inject arbitrary web script or HTML via vectors involving unsafe usage of Element.innerHTML.",
-            "cve": "CVE-2016-6186",
-            "id": "pyup.io-25721",
+            "advisory": "Emitter-io 2.704 fixes a security issue by disallowing pub/sub on extended keys.",
+            "cve": "PVE-2021-38320",
+            "id": "pyup.io-38320",
             "specs": [
-                ">=1.9,<1.9.8",
-                "==1.8.14",
-                ">=1.10,<1.10rc1"
+                "<2.704"
             ],
-            "v": ">=1.9,<1.9.8,==1.8.14,>=1.10,<1.10rc1"
-        },
+            "v": "<2.704"
+        }
+    ],
+    "emrt.necd.content": [
         {
-            "advisory": "In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. See: CVE-2019-3498.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-36770",
+            "advisory": "Emrt.necd.content 2.0.15 fixes a possible JavaScript injection.",
+            "cve": "PVE-2021-40547",
+            "id": "pyup.io-40547",
             "specs": [
-                ">=2.0a1,<2.0.10"
+                "<2.0.15"
             ],
-            "v": ">=2.0a1,<2.0.10"
-        },
+            "v": "<2.0.15"
+        }
+    ],
+    "encapsia-api": [
         {
-            "advisory": "Django 2.0.x before 2.0.11 allows Uncontrolled Memory Consumption via a malicious attacker-supplied value to the django.utils.numberformat.format() function.",
-            "cve": "CVE-2019-6975",
-            "id": "pyup.io-36884",
+            "advisory": "Encapsia-api 0.2.9 updates dependencies for security reasons.",
+            "cve": "PVE-2021-39689",
+            "id": "pyup.io-39689",
             "specs": [
-                ">=2.0a1,<2.0.11"
+                "<0.2.9"
             ],
-            "v": ">=2.0a1,<2.0.11"
+            "v": "<0.2.9"
+        }
+    ],
+    "engineio-client": [
+        {
+            "advisory": "engineio-client 3.1.2 - Bumps ws to version 1.1.2 (vulnerability fix) (539)",
+            "cve": "PVE-2021-36801",
+            "id": "pyup.io-36801",
+            "specs": [
+                "<3.1.2"
+            ],
+            "v": "<3.1.2"
         },
         {
-            "advisory": "CVE-2018-6188: Information leakage in ``AuthenticationForm``\r\n============================================================\r\n\r\nA regression in Django 1.11.8 made\r\n:class:`~django.contrib.auth.forms.AuthenticationForm` run its\r\n``confirm_login_allowed()`` method even if an incorrect password is entered.\r\nThis can leak information about a user, depending on what messages\r\n``confirm_login_allowed()`` raises. If ``confirm_login_allowed()`` isn't\r\noverridden, an attacker enter an arbitrary username and see if that user has\r\nbeen set to ``is_active=False``. If ``confirm_login_allowed()`` is overridden,\r\nmore sensitive details could be leaked.\r\n\r\nThis issue is fixed with the caveat that ``AuthenticationForm`` can no longer\r\nraise the \"This account is inactive.\" error if the authentication backend\r\nrejects inactive users (the default authentication backend, ``ModelBackend``,\r\nhas done that since Django 1.10). This issue will be revisited for Django 2.1\r\nas a fix to address the caveat will likely be too invasive for inclusion in\r\nolder versions.",
-            "cve": "CVE-2018-6188",
-            "id": "pyup.io-35173",
+            "advisory": "engineio-client 3.1.2 removes the parsejson dependency, which is vulnerable to a Regular Expression Denial of Service (NSP advisory [528](https://nodesecurity.io/advisories/528)). Please update as soon as possible.",
+            "cve": "PVE-2021-36800",
+            "id": "pyup.io-36800",
             "specs": [
-                ">=2.0a1,<2.0.2",
-                "==1.11.8",
-                "==1.11.9"
+                "<3.1.2"
             ],
-            "v": ">=2.0a1,<2.0.2,==1.11.8,==1.11.9"
+            "v": "<3.1.2"
         },
         {
-            "advisory": "If ``django.utils.text.Truncator``'s ``chars()`` and ``words()`` methods were\r\npassed the ``html=True`` argument, they were extremely slow to evaluate certain\r\ninputs due to a catastrophic backtracking vulnerability in a regular\r\nexpression. The ``chars()`` and ``words()`` methods are used to implement the\r\n``truncatechars_html`` and ``truncatewords_html`` template filters, which were\r\nthus vulnerable.",
-            "cve": "CVE-2018-7537",
-            "id": "pyup.io-35796",
+            "advisory": "engineio-client 3.1.4 updates the `ws` package, as the previous version was vulnerable to a Regular Expression Denial of Service (NSP advisory [#550](https://nodesecurity.io/advisories/550)). Please update as soon as possible.",
+            "cve": "PVE-2021-36799",
+            "id": "pyup.io-36799",
             "specs": [
-                ">=2.0a1,<2.0.3",
-                ">=1.8a1 ,<1.8.19",
-                ">=1.11a1,<1.11.11"
+                "<3.1.4"
             ],
-            "v": ">=2.0a1,<2.0.3,>=1.8a1 ,<1.8.19,>=1.11a1,<1.11.11"
+            "v": "<3.1.4"
+        }
+    ],
+    "enrocrypt": [
+        {
+            "advisory": "Enrocrypt 1.1.4 includes a fix for CVE-2021-39182: Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. As a workaround, users can remove the 'MD5' hashing function from the file 'hashing.py'.\r\nhttps://github.com/Morgan-Phoenix/EnroCrypt/security/advisories/GHSA-35m5-8cvj-8783\r\nhttps://github.com/Morgan-Phoenix/EnroCrypt/commit/e652d56ac60eadfc26489ab83927af13a9b9d8ce",
+            "cve": "CVE-2021-39182",
+            "id": "pyup.io-42519",
+            "specs": [
+                "<1.1.4"
+            ],
+            "v": "<1.1.4"
+        }
+    ],
+    "entente": [
+        {
+            "advisory": "Entente version 0.11.0 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/lace/entente/commit/bbbf1985cbb38f749e7dd998bbf42b72c4d1d99c#diff-52de9aa5fb74fe3cdb1d128e9e6b246c69003cf86a181c79f22ec2510dc19b3e",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41324",
+            "specs": [
+                "<0.11.0"
+            ],
+            "v": "<0.11.0"
+        }
+    ],
+    "envyconfig": [
+        {
+            "advisory": "Envyconfig 1.1.4 upgrades underlying libraries with security alerts.",
+            "cve": "PVE-2021-40257",
+            "id": "pyup.io-40257",
+            "specs": [
+                "<1.1.4"
+            ],
+            "v": "<1.1.4"
+        }
+    ],
+    "epsagon": [
+        {
+            "advisory": "Epsagon 1.5.0 updates several dependencies in package.json due to vulnerabilities.",
+            "cve": "PVE-2021-39030",
+            "id": "pyup.io-39030",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        }
+    ],
+    "epyk": [
+        {
+            "advisory": "Epyk 1.5.6 fixes an external JavaScript text injection issue.",
+            "cve": "PVE-2021-40189",
+            "id": "pyup.io-40189",
+            "specs": [
+                "<1.5.6"
+            ],
+            "v": "<1.5.6"
+        }
+    ],
+    "errbot": [
+        {
+            "advisory": "errbot 1.3.0 fixes a security issue: the plugin directory permissions were too lax.",
+            "cve": "PVE-2021-25812",
+            "id": "pyup.io-25812",
+            "specs": [
+                "<1.3.0"
+            ],
+            "v": "<1.3.0"
+        }
+    ],
+    "ert-storage": [
+        {
+            "advisory": "Ert-storage 0.1.8 enables token-based security for the 'ert-storage'.",
+            "cve": "PVE-2021-40562",
+            "id": "pyup.io-40562",
+            "specs": [
+                "<0.1.8"
+            ],
+            "v": "<0.1.8"
+        }
+    ],
+    "espeakng": [
+        {
+            "advisory": "Espeakng 1.49.0 fixes many security issues. No details were given.",
+            "cve": "PVE-2021-38581",
+            "id": "pyup.io-38581",
+            "specs": [
+                "<1.49.0"
+            ],
+            "v": "<1.49.0"
         },
         {
-            "advisory": "An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The django.utils.html.urlize() function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The urlize() function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable. See: CVE-2018-7536.",
-            "cve": "CVE-2018-7536",
-            "id": "pyup.io-35797",
+            "advisory": "Espeakng 1.50 includes the following security fixes:\r\n\r\n*  Fix several crashes in the emoji support.\r\n*  Fix several static analysis issues detected by Coverity Scan.\r\n*  Fix several static analysis issues detected by Microsoft Visual C++ `/analyze`.\r\n*  `oss-fuzz` support for the SSML logic.\r\n*  Fix running `make check` with `-fsanitize=address` (LLVM AddressSanitizer).",
+            "cve": "PVE-2021-38580",
+            "id": "pyup.io-38580",
             "specs": [
-                ">=2.0a1,<2.0.3",
-                ">=1.8a1 ,<1.8.19",
-                ">=1.11a1,<1.11.11"
+                "<1.50"
             ],
-            "v": ">=2.0a1,<2.0.3,>=1.8a1 ,<1.8.19,>=1.11a1,<1.11.11"
+            "v": "<1.50"
+        }
+    ],
+    "esphome": [
+        {
+            "advisory": "Esphome 1.15.0b1 includes a fix for an http_request ESP32 insecure requests that may return the address of local variable. See: <https://github.com/esphome/issues/issues/1175>.",
+            "cve": "PVE-2021-38623",
+            "id": "pyup.io-38623",
+            "specs": [
+                "<1.15.0b1"
+            ],
+            "v": "<1.15.0b1"
         },
         {
-            "advisory": "Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.) See: CVE-2019-19118.",
-            "cve": "CVE-2019-19118",
-            "id": "pyup.io-37766",
+            "advisory": "ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.",
+            "cve": "CVE-2021-41104",
+            "id": "pyup.io-42322",
             "specs": [
-                ">=2.1,<2.1.15",
-                ">=2.2,<2.2.8"
+                "<=2021.9.1"
             ],
-            "v": ">=2.1,<2.1.15,>=2.2,<2.2.8"
+            "v": "<=2021.9.1"
+        }
+    ],
+    "esptool": [
+        {
+            "advisory": "esptool before 2.5.0 `digest_secure_bootloader` could produce incorrect digest.",
+            "cve": "PVE-2021-36328",
+            "id": "pyup.io-36328",
+            "specs": [
+                "<2.5.0"
+            ],
+            "v": "<2.5.0"
+        }
+    ],
+    "eth-hash": [
+        {
+            "advisory": "eth-hash before 0.1.5 used an unsafe version of `pycryptodome`. 0.1.5 upgrades `pycryptodome` to `>=3.6.6,<4` to fix this recently discovered vulnerability",
+            "cve": "PVE-2021-36438",
+            "id": "pyup.io-36438",
+            "specs": [
+                "<0.1.5"
+            ],
+            "v": "<0.1.5"
+        }
+    ],
+    "eth-keyfile": [
+        {
+            "advisory": "Eth-keyfile 0.6.0 mitigates a timing attack vector affecting the hmac comparation when decoding keyfiles.\r\nhttps://github.com/ethereum/eth-keyfile/issues/12",
+            "cve": "PVE-2022-44610",
+            "id": "pyup.io-44610",
+            "specs": [
+                "<0.6.0"
+            ],
+            "v": "<0.6.0"
+        }
+    ],
+    "etherweaver": [
+        {
+            "advisory": "Etherweaver 0.3.0 updates its dependency 'paramiko' to v2.4.2 to include a security fix.",
+            "cve": "CVE-2018-1000805",
+            "id": "pyup.io-36549",
+            "specs": [
+                "<0.3.0"
+            ],
+            "v": "<0.3.0"
+        }
+    ],
+    "ethically": [
+        {
+            "advisory": "Ethically 0.0.3 fixes security issues with dependencies.",
+            "cve": "PVE-2021-37042",
+            "id": "pyup.io-37042",
+            "specs": [
+                "<0.0.3"
+            ],
+            "v": "<0.0.3"
+        }
+    ],
+    "ethsnarks": [
+        {
+            "advisory": "Ethsnarks 0.18.10.1 fixes security bugs in MiMC-p/p and Miximus.",
+            "cve": "PVE-2021-37387",
+            "id": "pyup.io-37387",
+            "specs": [
+                "<0.18.10.1"
+            ],
+            "v": "<0.18.10.1"
+        }
+    ],
+    "etlstat": [
+        {
+            "advisory": "etlstat 0.6.1 updates SQLAlchemy in requirements.txt to fix moderate security issues",
+            "cve": "PVE-2021-37878",
+            "id": "pyup.io-37878",
+            "specs": [
+                "<0.6.1"
+            ],
+            "v": "<0.6.1"
+        }
+    ],
+    "euphorie": [
+        {
+            "advisory": "Euphorie 11.1.2 tightens the security on several client views.",
+            "cve": "PVE-2021-37459",
+            "id": "pyup.io-37459",
+            "specs": [
+                "<11.1.2"
+            ],
+            "v": "<11.1.2"
         },
         {
-            "advisory": "Django versions 2.1.9 and 2.2.2 apply a patch to fix a vulnerability in its dependency 'jQuery'.\r\nhttps://github.com/django/django/commit/baaf187a4e354bf3976c51e2c83a0d2f8ee6e6ad",
-            "cve": "CVE-2019-11358",
-            "id": "pyup.io-39594",
+            "advisory": "Euphorie 11.7.1 introduces a new view 'get-resources-timestamp' to not use the protected view 'refresh-resources-timestamp' which will be forbidden by the latest security hot fix.",
+            "cve": "PVE-2021-40574",
+            "id": "pyup.io-40574",
             "specs": [
-                ">=2.1a0,<2.1.9",
-                ">=2.2a0,<2.2.2"
+                "<11.7.1"
             ],
-            "v": ">=2.1a0,<2.1.9,>=2.2a0,<2.2.2"
+            "v": "<11.7.1"
         },
         {
-            "advisory": "In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content. See: CVE-2019-3498.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-36769",
+            "advisory": "Euphorie 13.0.0 fixes an XSS vulnerability in the text entered by the user (description, measure text).\r\nhttps://github.com/euphorie/Euphorie/commit/8f3c3de271b274b45caad40b17db41c2f795e933",
+            "cve": "PVE-2021-43089",
+            "id": "pyup.io-43089",
             "specs": [
-                ">=2.1a1,<2.1.5"
+                "<13.0.0"
             ],
-            "v": ">=2.1a1,<2.1.5"
+            "v": "<13.0.0"
         },
         {
-            "advisory": "In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by \"startapp --template\" and \"startproject --template\") allows directory traversal via an archive with absolute paths or relative paths with dot segments. See CVE-2021-3281.",
-            "cve": "CVE-2021-3281",
-            "id": "pyup.io-39526",
+            "advisory": "euphorie 6.1 fixes a security issue: modify client to always check if a survey session belongs to the current user.",
+            "cve": "PVE-2021-25813",
+            "id": "pyup.io-25813",
+            "specs": [
+                "<6.1"
+            ],
+            "v": "<6.1"
+        }
+    ],
+    "evalne": [
+        {
+            "advisory": "Evalne version 0.3.3 includes a security patch for the function '_evaluate_ee_e2e_cmd' in 'evalne/evaluation/evaluator.py'. It contained an OS injection vulnerability: subprocess call with shell=True.\r\nhttps://github.com/Dru-Mara/EvalNE/commit/7041dbb701eb622f6ce38b4ab529b14d86656a26#diff-2279cc18e0f5d8bb6d8fc4820ab5190a43df3a2b6135d860204bcb3b2bc993e0",
+            "cve": "PVE-2021-41325",
+            "id": "pyup.io-41325",
+            "specs": [
+                "<0.3.3"
+            ],
+            "v": "<0.3.3"
+        }
+    ],
+    "eve-alpha": [
+        {
+            "advisory": "Ave-alpha 0.0.7 adds the `MONGO_QUERY_BLACKLIST` option. This allows blacklisting of mongo query operators that should not be allowed in resource queries (``?where=``). Defaults to ['$where', '$regex']. Mongo Javascript operators are disabled by default as they might be used as vectors for injection attacks. Javascript queries also tend to be slow and generally can be easily replaced with the /(very rich) Mongo query dialect.",
+            "cve": "PVE-2021-37162",
+            "id": "pyup.io-37162",
+            "specs": [
+                "<0.0.7"
+            ],
+            "v": "<0.0.7"
+        }
+    ],
+    "event-scheduler": [
+        {
+            "advisory": "Event-scheduler 0.1.2 updates its dependency 'urllib3' to v1.26.5 due to security issues.",
+            "cve": "CVE-2021-33503",
+            "id": "pyup.io-40343",
+            "specs": [
+                "<0.1.2"
+            ],
+            "v": "<0.1.2"
+        }
+    ],
+    "event-tracking": [
+        {
+            "advisory": "event-tracking 0.2.9 changes: This upgrade will fix the security vulnerability in the old versions of jinja2.",
+            "cve": "PVE-2021-37232",
+            "id": "pyup.io-37232",
+            "specs": [
+                "<0.2.9"
+            ],
+            "v": "<0.2.9"
+        }
+    ],
+    "eventlet": [
+        {
+            "advisory": "Eventlet 0.31.0 includes an important security fix (websocket: Limit maximum uncompressed frame length to 8MiB).",
+            "cve": "PVE-2021-40399",
+            "id": "pyup.io-40399",
             "specs": [
-                ">=2.2,<2.2.18",
-                ">=3.1,<3.1.6",
-                ">=3.0,<3.0.12"
+                "<0.31.0"
             ],
-            "v": ">=2.2,<2.2.18,>=3.1,<3.1.6,>=3.0,<3.0.12"
+            "v": "<0.31.0"
         },
         {
-            "advisory": "In Django 2.2 before 2.2.21, 3.1 before 3.1.9, and 3.2 before 3.2.1, MultiPartParser, UploadedFile, and FieldFile allowed directory traversal via uploaded files with suitably crafted file names.",
-            "cve": "CVE-2021-31542",
-            "id": "pyup.io-40404",
+            "advisory": "A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.",
+            "cve": "CVE-2021-21419",
+            "id": "pyup.io-40416",
             "specs": [
-                ">=2.2,<2.2.21",
-                ">=3.1a1,<3.1.9",
-                ">=3.2,<3.2.1"
+                "<0.31.0"
             ],
-            "v": ">=2.2,<2.2.21,>=3.1a1,<3.1.9,>=3.2,<3.2.1"
-        },
+            "v": "<0.31.0"
+        }
+    ],
+    "eventmq": [
         {
-            "advisory": "In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do not prohibit leading zero characters in octal literals. This may allow a bypass of access control that is based on IP addresses. (validate_ipv4_address and validate_ipv46_address are unaffected with Python 3.9.5+..) .",
-            "cve": "CVE-2021-33571",
-            "id": "pyup.io-40638",
+            "advisory": "Eventmq 0.3.13rc1 upgrades the psutil dependency to a more secure version.",
+            "cve": "PVE-2021-38402",
+            "id": "pyup.io-38402",
             "specs": [
-                ">=2.2.0a1,<2.2.24",
-                ">=3.0.0a1,<3.1.12",
-                ">=3.2.0a1,<3.2.4"
+                "<0.3.13rc1"
             ],
-            "v": ">=2.2.0a1,<2.2.24,>=3.0.0a1,<3.1.12,>=3.2.0a1,<3.2.4"
-        },
+            "v": "<0.3.13rc1"
+        }
+    ],
+    "exgrex-py": [
         {
-            "advisory": "The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.",
-            "cve": "CVE-2021-23336",
-            "id": "pyup.io-39646",
+            "advisory": "Exgrex-py 0.3a2 updates its dependency 'pygments' to v2.7.4 to include security fixes.",
+            "cve": "CVE-2021-27291",
+            "id": "pyup.io-40142",
             "specs": [
-                ">=2.2a1,<2.2.19"
+                "<0.3a2"
             ],
-            "v": ">=2.2a1,<2.2.19"
+            "v": "<0.3a2"
         },
         {
-            "advisory": "In Django 2.2 before 2.2.20, 3.0 before 3.0.14, and 3.1 before 3.1.8, MultiPartParser allowed directory traversal via uploaded files with suitably crafted file names. Built-in upload handlers were not affected by this vulnerability.",
-            "cve": "CVE-2021-28658",
-            "id": "pyup.io-40163",
+            "advisory": "Exgrex-py 0.3a2 updates its dependency 'pygments' to v2.7.4 to include security fixes.",
+            "cve": "CVE-2021-20270",
+            "id": "pyup.io-42748",
             "specs": [
-                ">=2.2a1,<2.2.20",
-                ">=3.0a1,<3.0.14",
-                ">=3.1a1,<3.1.8"
+                "<0.3a2"
             ],
-            "v": ">=2.2a1,<2.2.20,>=3.0a1,<3.0.14,>=3.1a1,<3.1.8"
+            "v": "<0.3a2"
         },
         {
-            "advisory": "The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.",
-            "cve": "CVE-2021-23336",
-            "id": "pyup.io-39645",
+            "advisory": "Exgrex-py 0.3a2 updates its dependency 'bleach' to v3.3.0 to include a security fix.",
+            "cve": "CVE-2021-23980",
+            "id": "pyup.io-42749",
             "specs": [
-                ">=3.0a1,<3.0.13"
+                "<0.3a2"
             ],
-            "v": ">=3.0a1,<3.0.13"
+            "v": "<0.3a2"
         },
         {
-            "advisory": "CVE-2020-13254: Potential data leakage via malformed memcached keys. In cases where a memcached backend does not perform key validation, passing malformed cache keys could result in a key collision, and potential data leakage. In order to avoid this vulnerability, key validation is added to the memcached cache backends.\r\n\r\nAdditionally, Django 2.2.13 and 3.0.7 upgrade the version of jQuery used by the admin to 3.5.1 for security reasons.",
-            "cve": "CVE-2020-13254",
-            "id": "pyup.io-38373",
+            "advisory": "Exgrex-py 0.3a2 updates its dependency 'cryptography' to v3.3.2 to include a security fix.",
+            "cve": "CVE-2020-36242",
+            "id": "pyup.io-42750",
             "specs": [
-                ">=3.0a1,<3.0.7",
-                ">=2.2a1,<2.2.13"
+                "<0.3a2"
             ],
-            "v": ">=3.0a1,<3.0.7,>=2.2a1,<2.2.13"
+            "v": "<0.3a2"
         },
         {
-            "advisory": "CVE-2020-13596: Possible XSS via admin ForeignKeyRawIdWidget. Query parameters for the admin ForeignKeyRawIdWidget were not properly URL encoded, posing an XSS attack vector. ForeignKeyRawIdWidget now ensures query parameters are correctly URL encoded.\r\n\r\nAdditionally, Django 2.2.13 and 3.0.7 upgrade the version of jQuery used by the admin to 3.5.1 for security reasons.",
-            "cve": "CVE-2020-13596",
-            "id": "pyup.io-38372",
+            "advisory": "Exgrex-py 0.3a2 updates its dependency 'urllib3' to v1.26.4 to include a security fix.",
+            "cve": "CVE-2021-28363",
+            "id": "pyup.io-42751",
             "specs": [
-                ">=3.0a1,<3.0.7",
-                ">=2.2a1,<2.2.13"
+                "<0.3a2"
             ],
-            "v": ">=3.0a1,<3.0.7,>=2.2a1,<2.2.13"
-        },
+            "v": "<0.3a2"
+        }
+    ],
+    "exgrex-pytest": [
         {
-            "advisory": "Django versions 3.1.13 and 3.2.5 include a fix for CVE-2021-35042: Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a web application.\r\nhttps://www.djangoproject.com/weblog/2021/jul/01/security-releases/\r\nhttps://www.openwall.com/lists/oss-security/2021/07/02/2\r\nhttps://docs.djangoproject.com/en/3.2/releases/security/\r\nhttps://groups.google.com/forum/#%21forum/django-announce",
-            "cve": "CVE-2021-35042",
-            "id": "pyup.io-40899",
+            "advisory": "Exgrex-pytest 0.1a2 updates its dependency 'urllib3' to v1.26.4 to include a security fix.",
+            "cve": "CVE-2021-28363",
+            "id": "pyup.io-40148",
             "specs": [
-                ">=3.1,<3.1.13",
-                ">=3.2,<3.2.5"
+                "<0.1a2"
             ],
-            "v": ">=3.1,<3.1.13,>=3.2,<3.2.5"
+            "v": "<0.1a2"
         },
         {
-            "advisory": "In Django 2.2 before 2.2.22, 3.1 before 3.1.10, and 3.2 before 3.2.2 (with Python 3.9.5+), URLValidator does not prohibit newlines and tabs (unless the URLField form field is used). If an application uses values with newlines in an HTTP response, header injection can occur. Django itself is unaffected because HttpResponse prohibits newlines in HTTP headers.",
-            "cve": "CVE-2021-32052",
-            "id": "pyup.io-40414",
+            "advisory": "Exgrex-pytest 0.1a2 updates underlying dependencies for security reasons: cryptography -> 3.3.2.",
+            "cve": "CVE-2020-36242",
+            "id": "pyup.io-43012",
             "specs": [
-                ">=3.1a1,<3.1.10",
-                ">=2.2a1,<2.2.22",
-                ">=3.2a1,<3.2.2"
+                "<0.1a2"
             ],
-            "v": ">=3.1a1,<3.1.10,>=2.2a1,<2.2.22,>=3.2a1,<3.2.2"
+            "v": "<0.1a2"
         },
         {
-            "advisory": "The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.",
-            "cve": "CVE-2021-23336",
-            "id": "pyup.io-39644",
+            "advisory": "Exgrex-pytest 0.1a2 updates underlying dependencies for security reasons: bleach -> 3.3.0.",
+            "cve": "CVE-2021-23980",
+            "id": "pyup.io-43013",
             "specs": [
-                ">=3.1a1,<3.1.7"
+                "<0.1a2"
             ],
-            "v": ">=3.1a1,<3.1.7"
+            "v": "<0.1a2"
         }
     ],
-    "django-access-tokens": [
+    "exoskeleton": [
         {
-            "advisory": "django-access-tokens 0.9.2 fixes scoping of permissions where the token provides a smaller subset of the required permissions. As an extreme case, an access token granting no permissions could be used to access any permissions on the site.",
-            "cve": "PVE-2021-25736",
-            "id": "pyup.io-25736",
+            "advisory": "Exoskeleton 1.2.1 requires lxml version >= 4.6.2 (released 2020-11-26) as it fixes a vulnerability.",
+            "cve": "PVE-2021-39207",
+            "id": "pyup.io-39207",
             "specs": [
-                "<0.9.2"
+                "<1.2.1"
             ],
-            "v": "<0.9.2"
-        }
-    ],
-    "django-access-tokens-py3": [
+            "v": "<1.2.1"
+        },
         {
-            "advisory": "Fixing scoping of permissions where the token provides a\r\nsmaller subset of the required permissions. As an extreme case, an access token\r\ngranting no permissions could be used to access any permissions on the site.",
-            "cve": "PVE-2021-34892",
-            "id": "pyup.io-34892",
+            "advisory": "Exoskeleton 1.2.5 updates the 'lxml' dependency to '4.6.3' (security update).",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-40224",
             "specs": [
-                "<0.9.2"
+                "<1.2.5"
             ],
-            "v": "<0.9.2"
+            "v": "<1.2.5"
         }
     ],
-    "django-afip": [
+    "experimaestro": [
         {
-            "advisory": "Django-afip 7.1.1 overrides the TLS configuration for AFIP's servers (and only those). They have worsened their security configuration, and it's now seen as insecure by default on many environments.",
-            "cve": "PVE-2021-38705",
-            "id": "pyup.io-38705",
+            "advisory": "Experimaestro 0.7.11 updates its NPM dependency 'axios' to v0.21.1 to include a security fix.",
+            "cve": "CVE-2020-28168",
+            "id": "pyup.io-39420",
             "specs": [
-                "<7.1.1"
+                "<0.7.11"
             ],
-            "v": "<7.1.1"
+            "v": "<0.7.11"
         }
     ],
-    "django-airplane": [
+    "extensiveautomation-server": [
         {
-            "advisory": "Django-airplane 1.1.0 and prior uses a version of Django (>=2.2.10) potentially insecure.",
-            "cve": "CVE-2021-44420",
-            "id": "pyup.io-43712",
+            "advisory": "Extensiveautomation-server 12.1.0 reactivates SSLv3 cipher to support Linux client in python 2.6, fixes a security issue on folder creation in repository (no more full rights), and fixes a security issue on web services (bad  handle of the level access).",
+            "cve": "PVE-2021-37348",
+            "id": "pyup.io-37348",
             "specs": [
-                "<=1.1.0"
+                "<12.1.0"
             ],
-            "v": "<=1.1.0"
+            "v": "<12.1.0"
         },
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2021-33203",
-            "id": "pyup.io-43713",
+            "advisory": "Extensiveautomation-server 13.0.0 includes various security improvements:\r\n- No longer uses truncate tables.\r\n- No longer creates folders with 777 mode.\r\n- Includes a new script to secure the server after a from-scratch installation.\r\n- Dumps mysql user in settings file, with updates on all services.",
+            "cve": "PVE-2021-37347",
+            "id": "pyup.io-37347",
             "specs": [
-                "<=1.1.0"
+                "<13.0.0"
             ],
-            "v": "<=1.1.0"
+            "v": "<13.0.0"
         },
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2021-33571",
-            "id": "pyup.io-43714",
+            "advisory": "Extensiveautomation-server 14.0.0 includes various security updates:\r\n- It has a minor improvement to secure the product (php and apache).\r\n- It encrypts test environment data.\r\n- It no longer run server as root.\r\n- It no longer uses the root account for database access.",
+            "cve": "PVE-2021-37346",
+            "id": "pyup.io-37346",
             "specs": [
-                "<=1.1.0"
+                "<14.0.0"
             ],
-            "v": "<=1.1.0"
+            "v": "<14.0.0"
         },
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2021-32052",
-            "id": "pyup.io-43715",
+            "advisory": "Extensiveautomation-server 16.0.0 fixes a security issue on rest API: it fixes the error on the get variables listing.",
+            "cve": "PVE-2021-37345",
+            "id": "pyup.io-37345",
             "specs": [
-                "<=1.1.0"
+                "<16.0.0"
             ],
-            "v": "<=1.1.0"
-        },
+            "v": "<16.0.0"
+        }
+    ],
+    "extractor": [
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2021-31542",
-            "id": "pyup.io-43716",
+            "advisory": "Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).",
+            "cve": "CVE-2006-2458",
+            "id": "pyup.io-42232",
             "specs": [
-                "<=1.1.0"
+                "<0.5.13"
             ],
-            "v": "<=1.1.0"
-        },
+            "v": "<0.5.13"
+        }
+    ],
+    "eyed3": [
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2021-28658",
-            "id": "pyup.io-43717",
+            "advisory": "tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.",
+            "cve": "CVE-2014-1934",
+            "id": "pyup.io-35538",
             "specs": [
-                "<=1.1.0"
+                "<0.6.18"
             ],
-            "v": "<=1.1.0"
-        },
+            "v": "<0.6.18"
+        }
+    ],
+    "faker": [
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2021-23336",
-            "id": "pyup.io-43718",
+            "advisory": "Faker 0.1 includes the message: \"`bundler-audit` has identified that i18 has fix a security vulnerability, that has been fixed in the 0.8 version.\"",
+            "cve": "PVE-2021-37386",
+            "id": "pyup.io-37386",
             "specs": [
-                "<=1.1.0"
+                "<0.1"
             ],
-            "v": "<=1.1.0"
-        },
+            "v": "<0.1"
+        }
+    ],
+    "fangfrisch": [
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2021-3281",
-            "id": "pyup.io-43719",
+            "advisory": "Fangfrisch 1.4.0 removes 'url_doppelstern' and 'url_crdfam_clamav' from Sanesecurity's provider section because the related signatures are no longer maintained and/or no longer distributed by Sanesecurity.",
+            "cve": "PVE-2021-39615",
+            "id": "pyup.io-39615",
             "specs": [
-                "<=1.1.0"
+                "<1.4.0"
             ],
-            "v": "<=1.1.0"
-        },
+            "v": "<1.4.0"
+        }
+    ],
+    "faraday-agent-dispatcher": [
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2020-24584",
-            "id": "pyup.io-43720",
+            "advisory": "Faraday-agent-dispatcher 1.2.1 escapes user-controlled executor parameters in order to prevent OS argument injection (not command injection).",
+            "cve": "PVE-2021-39351",
+            "id": "pyup.io-39351",
             "specs": [
-                "<=1.1.0"
+                "<1.2.1"
             ],
-            "v": "<=1.1.0"
-        },
+            "v": "<1.2.1"
+        }
+    ],
+    "fast-curator": [
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2020-24583",
-            "id": "pyup.io-43721",
+            "advisory": "Fast-curator 0.2.2 switches to pyyaml `safe_load` for better security.",
+            "cve": "PVE-2021-37514",
+            "id": "pyup.io-37514",
             "specs": [
-                "<=1.1.0"
+                "<0.2.2"
             ],
-            "v": "<=1.1.0"
-        },
+            "v": "<0.2.2"
+        }
+    ],
+    "fastapi": [
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2020-13254",
-            "id": "pyup.io-43722",
+            "advisory": "Fastapi 0.18.0 updates dependencies for security reasons.",
+            "cve": "PVE-2021-37084",
+            "id": "pyup.io-37084",
             "specs": [
-                "<=1.1.0"
+                "<0.18.0"
             ],
-            "v": "<=1.1.0"
+            "v": "<0.18.0"
         },
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2020-13596",
-            "id": "pyup.io-43723",
+            "advisory": "Fastapi 0.30.0 avoids/fixes a potential security issue: as the returned object is passed directly to Pydantic, if the returned object was a subclass of the `response_model` (e.g. you return a `UserInDB` that inherits from `User` but contains extra fields, like `hashed_password`, and `User` is used in the `response_model`), it would still pass the validation (because `UserInDB` is a subclass of `User`) and the object would be returned as-is, including the `hashed_password`. To fix this, the declared `response_model` is cloned, if it is a Pydantic model class (or contains Pydantic model classes in it, e.g. in a `List[Item]`), the Pydantic model class(es) will be a different one (the \"cloned\" one). So, an object that is a subclass won't simply pass the validation and returned as-is, because it is no longer a sub-class of the cloned `response_model`. Instead, a new Pydantic model object will be created with the contents of the returned object. So, it will be a new object (made with the data from the returned one), and will be filtered by the cloned `response_model`, containing only the declared fields as normally.",
+            "cve": "PVE-2021-37231",
+            "id": "pyup.io-37231",
             "specs": [
-                "<=1.1.0"
+                "<0.30.0"
             ],
-            "v": "<=1.1.0"
+            "v": "<0.30.0"
         },
         {
-            "advisory": "Django-airplane 1.1.0 and prior depends on an insecure Django version (2.2.10).",
-            "cve": "CVE-2020-9402",
-            "id": "pyup.io-43724",
-            "specs": [
-                "<=1.1.0"
-            ],
-            "v": "<=1.1.0"
-        }
-    ],
-    "django-ajax-datatable": [
-        {
-            "advisory": "Django-ajax-datatable version 4.1.4 adds missing CSRF token header in the first POST call (initialize_table()).",
-            "cve": "PVE-2021-41834",
-            "id": "pyup.io-41834",
+            "advisory": "Fastapi 0.37.0 fixes a security issue: when returning a sub-class of a response model and using `skip_defaults` it could leak information. See: https://github.com/tiangolo/fastapi/pull/485",
+            "cve": "PVE-2021-37428",
+            "id": "pyup.io-37428",
             "specs": [
-                "<4.1.4"
+                "<0.37.0"
             ],
-            "v": "<4.1.4"
+            "v": "<0.37.0"
         },
         {
-            "advisory": "Django-ajax-datatable 4.4.0 strips HTML tags by default in the rendered table for security reasons.\r\nhttps://github.com/morlandi/django-ajax-datatable/commit/702d2acfc953c2e9a2deb098e10c124cefb2bfc3",
-            "cve": "PVE-2021-43640",
-            "id": "pyup.io-43640",
+            "advisory": "Fastapi 0.60.2 fixes typos in docs for 'security' chapter.",
+            "cve": "PVE-2021-38670",
+            "id": "pyup.io-38670",
             "specs": [
-                "<4.4.0"
+                "<0.60.2"
             ],
-            "v": "<4.4.0"
-        }
-    ],
-    "django-allauth": [
+            "v": "<0.60.2"
+        },
         {
-            "advisory": "django-allauth before 0.28.0 previous versions contained a vulnerability allowing an attacker to alter the provider specific settings for ``SCOPE`` and/or ``AUTH_PARAMS`` (part of the  larger ``SOCIALACCOUNT_PROVIDERS`` setting). The changes would persist across subsequent requests for all users, provided these settings were explicitly set within your project. These settings translate directly into request parameters, giving the attacker undesirable control over the OAuth(2) handshake. You are not affected if you did not explicitly configure these settings.",
-            "cve": "PVE-2021-25737",
-            "id": "pyup.io-25737",
+            "advisory": "Fastapi 0.65.1 upgrades pydantic pin, to handle CVE-2021-29510.",
+            "cve": "CVE-2021-29510",
+            "id": "pyup.io-40443",
             "specs": [
-                "<0.28.0"
+                "<0.65.1"
             ],
-            "v": "<0.28.0"
+            "v": "<0.65.1"
         },
         {
-            "advisory": "On django-allauth before 0.34.0 the \"Set Password\" view did not properly check whether or not the user already had a usable password set. This allowed an attacker to set the password without providing the current password, but only in case the attacker already gained control over the victim's session.",
-            "cve": "PVE-2021-35034",
-            "id": "pyup.io-35034",
+            "advisory": "Fastapi version 0.65.2 includes a security fix for CVE-2021-32677: FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.\r\nhttps://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7\r\nhttps://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d",
+            "cve": "CVE-2021-32677",
+            "id": "pyup.io-40643",
             "specs": [
-                "<0.34.0"
+                "<0.65.2"
             ],
-            "v": "<0.34.0"
-        },
+            "v": "<0.65.2"
+        }
+    ],
+    "fastapi-login": [
         {
-            "advisory": "Django-allauth 0.41.0 conforms to the general Django 3.0.1, 2.2.9, and 1.11.27 security release. See CVE-2019-19844 and <https://www.djangoproject.com/weblog/2019/dec/18/security-releases/>.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-37664",
+            "advisory": "Fastapi-login 1.4.0 fixes a security vulnerability found in uvicorn",
+            "cve": "PVE-2021-38783",
+            "id": "pyup.io-38783",
             "specs": [
-                "<0.41.0"
+                "<1.4.0"
             ],
-            "v": "<0.41.0"
+            "v": "<1.4.0"
         },
         {
-            "advisory": "Django-allauth 0.47.0 adds a new setting 'SOCIALACCOUNT_LOGIN_ON_GET' that controls whether or not the endpoints for initiating a social login (for example, \"/accounts/google/login/\") require a POST request to initiate the handshake. As requiring a POST is more secure, the default of this new setting is 'False'. This is useful to prevent redirect attacks.",
-            "cve": "PVE-2021-43274",
-            "id": "pyup.io-43274",
+            "advisory": "Fastapi-login 1.6.0 updates underlying packages to fix security vulnerabilities.",
+            "cve": "PVE-2021-40234",
+            "id": "pyup.io-40234",
             "specs": [
-                "<0.47.0"
+                "<1.6.0"
             ],
-            "v": "<0.47.0"
-        }
-    ],
-    "django-allauth-underground": [
+            "v": "<1.6.0"
+        },
         {
-            "advisory": "django-allauth-underground before 0.28.0 contained a vulnerability allowing an attacker to alter the\r\n  provider specific settings for ``SCOPE`` and/or ``AUTH_PARAMS`` (part of the\r\n  larger ``SOCIALACCOUNT_PROVIDERS`` setting).",
-            "cve": "PVE-2021-36394",
-            "id": "pyup.io-36394",
+            "advisory": "Fastapi-login 1.6.1 includes updates of dependencies. This fixes several security issues found in dependencies.",
+            "cve": "PVE-2021-40652",
+            "id": "pyup.io-40652",
             "specs": [
-                "<0.28.0"
+                "<1.6.1"
             ],
-            "v": "<0.28.0"
+            "v": "<1.6.1"
         }
     ],
-    "django-anonymizer": [
+    "fastapi-restful": [
         {
-            "advisory": "Django-anonymizer 0.4 changes 'Anonymizer.attributes' to require every field to be listed.  This deals with the common security problem when a model is updated, but the Anonymizer is not updated.",
-            "cve": "PVE-2021-25738",
-            "id": "pyup.io-25738",
+            "advisory": "Fastapi-restful 0.3.1 includes a fix for the 'pydantic' dependency (update is required).",
+            "cve": "CVE-2021-29510",
+            "id": "pyup.io-40814",
             "specs": [
-                "<0.4"
+                "<0.3.1"
             ],
-            "v": "<0.4"
+            "v": "<0.3.1"
         }
     ],
-    "django-anymail": [
+    "fastecdsa": [
         {
-            "advisory": "In django-anymail before 1.4 the webhook validation was vulnerable to a timing attack. An attacker could have used this to obtain the WEBHOOK_AUTHORIZATION shared secret, potentially allowing them to post fabricated or malicious email tracking events to the app.",
-            "cve": "CVE-2018-6596",
-            "id": "pyup.io-35178",
+            "advisory": "An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.",
+            "cve": "CVE-2020-12607",
+            "id": "pyup.io-42273",
             "specs": [
-                "<1.4"
+                "<2.1.2"
             ],
-            "v": "<1.4"
+            "v": "<2.1.2"
         },
         {
-            "advisory": "Django-anymail version 1.4 includes a fix for CVE-2018-1000089: Anymail django-anymail version version 0.2 through 1.3 contains a CWE-532, CWE-209 vulnerability in WEBHOOK_AUTHORIZATION setting value that can result in an attacker with access to error logs could fabricate email tracking events. If you have exposed your Django error reports, an attacker could discover your ANYMAIL_WEBHOOK setting and use this to post fabricated or malicious Anymail tracking/inbound events to your app.\r\nhttps://github.com/anymail/django-anymail/commit/1a6086f2b58478d71f89bf27eb034ed81aefe5ef",
-            "cve": "CVE-2018-1000089",
-            "id": "pyup.io-35198",
+            "advisory": "Fastecdsa 2.1.5 fixes the timing leakage from nonce bit length. This is also known as the 'Minerva' vulnerability. See: <https://minerva.crocs.fi.muni.cz/>.",
+            "cve": "PVE-2021-38743",
+            "id": "pyup.io-38743",
             "specs": [
-                ">=0.2,<1.4"
+                "<2.1.5"
             ],
-            "v": ">=0.2,<1.4"
+            "v": "<2.1.5"
         }
     ],
-    "django-autocomplete-light": [
+    "fbpcp": [
         {
-            "advisory": "django-autocomplete-light before 2.3.0 when updating the queryset from outside the autocomplete class may lead to a security problem, ie. if you don't replicate filters you apply manually on the autocomplete object choices into choices_for_request() then a malicious user could see choices which they shouldn't by querying the autocomplete directly.",
-            "cve": "PVE-2021-25740",
-            "id": "pyup.io-25740",
+            "advisory": "Fbpcp 0.2.2 updates its dependency 'urllib3' to v1.26.7 to include security fixes.",
+            "cve": "CVE-2021-33503",
+            "id": "pyup.io-42988",
             "specs": [
-                "<2.3.0"
+                "<0.2.2"
             ],
-            "v": "<2.3.0"
+            "v": "<0.2.2"
         }
     ],
-    "django-awl": [
-        {
-            "advisory": "Django-awl 0.23.1 updates minimum requirements for Django to v2.1.2 to include a security fix.",
-            "cve": "CVE-2018-16984",
-            "id": "pyup.io-36588",
-            "specs": [
-                "<0.23.1"
-            ],
-            "v": "<0.23.1"
-        },
-        {
-            "advisory": "Django-awl 1.0 updates the minimum requirements for Django to versions 2.2.10 and 3.0 to include security fixes.",
-            "cve": "CVE-2019-6975",
-            "id": "pyup.io-43689",
-            "specs": [
-                "<1.0"
-            ],
-            "v": "<1.0"
-        },
+    "featureserver": [
         {
-            "advisory": "Django-awl 1.0 updates the minimum requirements for Django to versions 2.2.10 and 3.0 to include security fixes.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-38139",
+            "advisory": "featureserver before 1.06 allowed JSON callbacks.",
+            "cve": "PVE-2021-25814",
+            "id": "pyup.io-25814",
             "specs": [
-                "<1.0"
+                "<1.06"
             ],
-            "v": "<1.0"
+            "v": "<1.06"
         }
     ],
-    "django-basic-auth-ip-whitelist": [
+    "fedcloudclient": [
         {
-            "advisory": "In django-basic-auth-ip-whitelist before 0.3.4, a potential timing attack exists on websites where the basic authentication is used or configured, i.e. BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD is set. Currently the string comparison between configured credentials and the ones provided by users is performed through a character-by-character string comparison. This enables a possibility that attacker may time the time it takes the server to validate different usernames and password, and use this knowledge to work out the valid credentials. This attack is understood not to be realistic over the Internet. However, it may be achieved from within local networks where the website is hosted, e.g. from inside a data centre where a website's server is located. Sites protected by IP address whitelisting only are unaffected by this vulnerability. This vulnerability has been fixed on version 0.3.4 of django-basic-auth-ip-whitelist. Update to version 0.3.4 as soon as possible and change basic authentication username and password configured on a Django project using this package. A workaround without upgrading to version 0.3.4 is to stop using basic authentication and use the IP whitelisting component only. It can be achieved by not setting BASIC_AUTH_LOGIN and BASIC_AUTH_PASSWORD in Django project settings. See: CVE-2020-4071.",
-            "cve": "CVE-2020-4071",
-            "id": "pyup.io-38443",
+            "advisory": "Fedcloudclient 1.1.0 improves error checking and enhances security.",
+            "cve": "PVE-2021-40139",
+            "id": "pyup.io-40139",
             "specs": [
-                "<0.3.4"
+                "<1.1.0"
             ],
-            "v": "<0.3.4"
-        },
+            "v": "<1.1.0"
+        }
+    ],
+    "fedmsg": [
         {
-            "advisory": "Django-basic-auth-ip-whitelist 0.3.4 fixes a potential timing attack if basic authentication is enabled.",
-            "cve": "PVE-2021-38438",
-            "id": "pyup.io-38438",
+            "advisory": "FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.",
+            "cve": "CVE-2017-1000001",
+            "id": "pyup.io-34879",
             "specs": [
-                "<0.3.4"
+                "<0.18.2"
             ],
-            "v": "<0.3.4"
+            "v": "<0.18.2"
         }
     ],
-    "django-basicauth": [
+    "fedn": [
         {
-            "advisory": "django-basicauth before 0.4.2 is vulnerable to undisclosed timing attacks.",
-            "cve": "PVE-2021-35076",
-            "id": "pyup.io-35076",
+            "advisory": "Fedn 0.2.3 includes several bugfixes and security patches.",
+            "cve": "PVE-2021-40830",
+            "id": "pyup.io-40830",
             "specs": [
-                "<0.4.2"
+                "<0.2.3"
             ],
-            "v": "<0.4.2"
+            "v": "<0.2.3"
         }
     ],
-    "django-bootstrap4": [
+    "fedora": [
         {
-            "advisory": "Django-bootstrap4 2.3.0 updates its dependency 'Django' to v3.1.2 to include security fixes.",
-            "cve": "CVE-2020-24584",
-            "id": "pyup.io-43711",
+            "advisory": "Fedora 0.3.10 has some methods to help deal with CSRF, which is a vulnerability that can allow malicious web sites to execute server methods on behalf of an authenticated user.",
+            "cve": "PVE-2021-38173",
+            "id": "pyup.io-38173",
             "specs": [
-                "<2.3.0"
+                "<0.3.10"
             ],
-            "v": "<2.3.0"
-        },
+            "v": "<0.3.10"
+        }
+    ],
+    "feedgen": [
         {
-            "advisory": "Django-bootstrap4 2.3.0 updates its dependency 'Django' to v3.1.2 to include security fixes.",
-            "cve": "CVE-2020-24583",
-            "id": "pyup.io-38870",
+            "advisory": "Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources. See: CVE-2020-5227.",
+            "cve": "CVE-2020-5227",
+            "id": "pyup.io-37778",
             "specs": [
-                "<2.3.0"
+                "<0.9.0"
             ],
-            "v": "<2.3.0"
+            "v": "<0.9.0"
         }
     ],
-    "django-ca": [
+    "feedparser": [
         {
-            "advisory": "django-ca 1.10.0 stores CA private keys in the more secure PKCS8 format.",
-            "cve": "PVE-2021-37015",
-            "id": "pyup.io-37015",
+            "advisory": "Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.",
+            "cve": "CVE-2009-5065",
+            "id": "pyup.io-25815",
             "specs": [
-                "<1.10.0"
+                "<5.0"
             ],
-            "v": "<1.10.0"
+            "v": "<5.0"
         },
         {
-            "advisory": "Django-ca 1.17.0 secures CSRF and session cookies using Djangos `SESSION_COOKIE_SECURE`, `CSRF_COOKIE_HTTPONLY` and `CSRF_COOKIE_SECURE` settings. It also adds several security related headers to the admin interface (CSP, etc).",
-            "cve": "PVE-2021-39375",
-            "id": "pyup.io-39375",
+            "advisory": "feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration.",
+            "cve": "CVE-2011-1156",
+            "id": "pyup.io-33125",
             "specs": [
-                "<1.17.0"
+                "<5.0.1"
             ],
-            "v": "<1.17.0"
+            "v": "<5.0.1"
         },
         {
-            "advisory": "Django-ca version 1.19.0 fetches only the expected number of bytes when validating ACME challenges via HTTP to prevent DOS attacks.",
-            "cve": "PVE-2021-42088",
-            "id": "pyup.io-42088",
+            "advisory": "Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.",
+            "cve": "CVE-2011-1158",
+            "id": "pyup.io-33127",
             "specs": [
-                "<1.19.0"
+                "<5.0.1"
             ],
-            "v": "<1.19.0"
+            "v": "<5.0.1"
         },
         {
-            "advisory": "django-ca before 1.9.0 did not properly escape x509 extensions, allowing for potential injection attacks.",
-            "cve": "PVE-2021-36405",
-            "id": "pyup.io-36405",
+            "advisory": "Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.",
+            "cve": "CVE-2011-1157",
+            "id": "pyup.io-33126",
             "specs": [
-                "<1.9.0"
+                "<5.0.1"
             ],
-            "v": "<1.9.0"
-        }
-    ],
-    "django-celery-results": [
+            "v": "<5.0.1"
+        },
         {
-            "advisory": "Django-celery-results through 1.2.1 stores task results in the database. Among the data it stores are the variables passed into the tasks. The variables may contain sensitive cleartext information that does not belong unencrypted in the database. See CVE-2020-17495.",
-            "cve": "CVE-2020-17495",
-            "id": "pyup.io-38678",
+            "advisory": "Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.",
+            "cve": "CVE-2012-2921",
+            "id": "pyup.io-25819",
             "specs": [
-                "<=1.2.1"
+                "<5.1.2"
             ],
-            "v": "<=1.2.1"
+            "v": "<5.1.2"
         }
     ],
-    "django-cms": [
+    "fiduswriter": [
         {
-            "advisory": "django-cms 2.1.3 fixes a serious security issue in PlaceholderAdmin",
-            "cve": "PVE-2021-25741",
-            "id": "pyup.io-25741",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-43507",
             "specs": [
-                "<2.1.3"
+                "<3.9.24"
             ],
-            "v": "<2.1.3"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "Django-cms before 2.1.4 fixes a XSS issue in Text Plugins.\r\nhttps://github.com/django-cms/django-cms/commit/9ca7738bc1cef827765589c5b254810370a0fc0b",
-            "cve": "PVE-2021-25742",
-            "id": "pyup.io-25742",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-25288",
+            "id": "pyup.io-43508",
             "specs": [
-                "<2.1.4"
+                "<3.9.24"
             ],
-            "v": "<2.1.4"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "django-cms 3.0.14 fixes an issue where privileged users could be tricked into performing actions without their knowledge via a CSRF vulnerability",
-            "cve": "PVE-2021-25743",
-            "id": "pyup.io-25743",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-28677",
+            "id": "pyup.io-43510",
             "specs": [
-                "<3.0.14"
+                "<3.9.24"
             ],
-            "v": "<3.0.14"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "Cross-site request forgery (CSRF) vulnerability in django CMS before 3.0.14, 3.1.x before 3.1.1 allows remote attackers to manipulate privileged users into performing unknown actions via unspecified vectors.",
-            "cve": "CVE-2015-5081",
-            "id": "pyup.io-35628",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-40866",
             "specs": [
-                "<3.0.14",
-                ">3.1,<3.1.1"
+                "<3.9.24"
             ],
-            "v": "<3.0.14,>3.1,<3.1.1"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "django-cms  3.2.4 addresses security vulnerabilities in the `render_model` template tag that could lead to escalation of privileges or other security issues. It also addresses a security vulnerability in the cms' usage of the messages framework. Furthermore it fixes security vulnerabilities in custom FormFields that could lead to escalation of privileges or other security issue",
-            "cve": "PVE-2021-25746",
-            "id": "pyup.io-25746",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'Django' to v3.1.12 to include security fixes.",
+            "cve": "CVE-2021-32052",
+            "id": "pyup.io-43515",
             "specs": [
-                "<3.2.4"
+                "<3.9.24"
             ],
-            "v": "<3.2.4"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "django-cms 3.4.3 fixes a security vulnerability in the page redirect field which allowed users to insert JavaScript code and a vulnerability where the next parameter for the toolbar login was not sanitised and could point to another domain.",
-            "cve": "PVE-2021-34226",
-            "id": "pyup.io-34226",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'Django' to v3.1.12 to include security fixes.",
+            "cve": "CVE-2021-31542",
+            "id": "pyup.io-43512",
             "specs": [
-                "<3.4.3"
+                "<3.9.24"
             ],
-            "v": "<3.4.3"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "Django-cms 3.4.7 fixes a security vulnerability in the plugin_type url parameter to insert JavaScript code.",
-            "cve": "PVE-2021-38791",
-            "id": "pyup.io-38791",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-43506",
             "specs": [
-                ">=3.4.0,<3.4.7"
+                "<3.9.24"
             ],
-            "v": ">=3.4.0,<3.4.7"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "Django-cms 3.5.4 fixes a security vulnerability in the plugin_type url parameter to insert JavaScript code.",
-            "cve": "PVE-2021-38790",
-            "id": "pyup.io-38790",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-28676",
+            "id": "pyup.io-43509",
             "specs": [
-                ">=3.5.0,<3.5.4"
+                "<3.9.24"
             ],
-            "v": ">=3.5.0,<3.5.4"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "django-cms before 3.6.1\r\nDjango-cms 3.6.1 fixes a security vulnerability in the plugin_type url parameter to insert JavaScript code.",
-            "cve": "PVE-2021-38789",
-            "id": "pyup.io-38789",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-28678",
+            "id": "pyup.io-43511",
             "specs": [
-                ">=3.6.0,<3.6.1"
+                "<3.9.24"
             ],
-            "v": ">=3.6.0,<3.6.1"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "Django-cms 3.7.4 fixes a security vulnerability in the plugin_type url parameter to insert JavaScript code.",
-            "cve": "PVE-2021-38788",
-            "id": "pyup.io-38788",
-            "specs": [
-                ">=3.7.0,<3.7.4"
-            ],
-            "v": ">=3.7.0,<3.7.4"
-        }
-    ],
-    "django-cms-patched": [
-        {
-            "advisory": "django-cms-patched before 3.0.17 has security vulnerabilities in the `render_model` template tag that could\r\n  lead to escalation of privileges or other security issues.",
-            "cve": "PVE-2021-34123",
-            "id": "pyup.io-34123",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'django' to v3.1.12 to include security fixes.",
+            "cve": "CVE-2021-33203",
+            "id": "pyup.io-43513",
             "specs": [
-                "<3.0.17"
+                "<3.9.24"
             ],
-            "v": "<3.0.17"
+            "v": "<3.9.24"
         },
         {
-            "advisory": "django-cms-patched 3.4.3 fixes a security vulnerability in the page redirect field which allowed users to insert JavaScript code.",
-            "cve": "PVE-2021-34121",
-            "id": "pyup.io-34121",
+            "advisory": "Fiduswriter 3.9.24 updates its dependency 'django' to v3.1.12 to include security fixes.",
+            "cve": "CVE-2021-33571",
+            "id": "pyup.io-43514",
             "specs": [
-                "<3.4.3"
+                "<3.9.24"
             ],
-            "v": "<3.4.3"
+            "v": "<3.9.24"
         }
     ],
-    "django-cors-headers": [
+    "fincity-django-allauth": [
         {
-            "advisory": "Django-cors-headers version 3.0.0 fixes a security issue where the CORS middleware would allow requests between schemes, for example from insecure 'http://' origins to a secure 'https://' site. Now you will need to update your whitelist to include schemes, for example from this:\r\nCORS_ORIGIN_WHITELIST = ['example.com']\r\nto this:\r\nCORS_ORIGIN_WHITELIST = ['https://example.com']\r\nhttps://github.com/adamchainz/django-cors-headers/issues/259",
-            "cve": "PVE-2021-37132",
-            "id": "pyup.io-37132",
+            "advisory": "In fincity-django-allauth 0.18.0, the Persona provider now requires the ``AUDIENCE`` parameter to be explicitly configured, as required by the Persona specification for security reasons. Also, the inline Javascript is removed from the ``fbconnect.html`` template, which allows for a more strict ``Content-Security-Policy``. If you were using the builtin ``fbconnect.html`` this change should go by unnoticed.",
+            "cve": "PVE-2021-37466",
+            "id": "pyup.io-37466",
             "specs": [
-                "<3.0.0"
+                "<0.18.0"
             ],
-            "v": "<3.0.0"
-        }
-    ],
-    "django-councilmatic": [
+            "v": "<0.18.0"
+        },
         {
-            "advisory": "Django-councilmatic 2.5.9 patches a XSS vulnerability when using filter options. \r\nhttps://github.com/datamade/django-councilmatic/issues/270\r\nhttps://github.com/datamade/django-councilmatic/pull/271",
-            "cve": "PVE-2021-38708",
-            "id": "pyup.io-38708",
+            "advisory": "Version prior to fincity-django-allauth 0.28.0 contained a vulnerability allowing an attacker to alter the provider specific settings for ``SCOPE`` and/or ``AUTH_PARAMS`` (part of the larger ``SOCIALACCOUNT_PROVIDERS`` setting). The changes would persist across subsequent requests for all users, provided these settings were explicitly set within your project. These settings translate directly into request parameters, giving the attacker undesirable control over the OAuth(2) handshake. You are not affected if you did not explicitly configure these settings.",
+            "cve": "PVE-2021-37464",
+            "id": "pyup.io-37464",
             "specs": [
-                "<2.5.9"
+                "<0.28.0"
             ],
-            "v": "<2.5.9"
-        }
-    ],
-    "django-countries": [
+            "v": "<0.28.0"
+        },
         {
-            "advisory": "Django-countries 3.4 fixes a escaping issue in CountrySelectWidget that could lead to XSS.\r\nhttps://github.com/SmileyChris/django-countries/commit/1ed7c6763d890d00f32242202b424709e8668d5a",
-            "cve": "PVE-2021-25747",
-            "id": "pyup.io-25747",
+            "advisory": "Password reset tokens in fincity-django-allauth 0.33.0 are prevented from being leaked through the password reset URL.",
+            "cve": "PVE-2021-38514",
+            "id": "pyup.io-38514",
             "specs": [
-                "<3.4"
+                "<0.33.0"
             ],
-            "v": "<3.4"
-        }
-    ],
-    "django-crispy-forms": [
+            "v": "<0.33.0"
+        },
         {
-            "advisory": "django-crispy-forms 1.1.4 contains a security fix: Thread safety fixes to `CrispyFieldNode` thanks to Paul Oswald. This avoids leaking information between requests in multithreaded WSGI servers.",
-            "cve": "PVE-2021-25751",
-            "id": "pyup.io-25751",
+            "advisory": "Before fincity-django-allauth 0.34.0, the \"Set Password\" view did not properly check whether or not the user already had a usable password set. This allowed an attacker to set the password without providing the current password, but only in case the attacker already gained control over the victim's session.",
+            "cve": "PVE-2021-37463",
+            "id": "pyup.io-37463",
             "specs": [
-                "<1.1.4"
+                "<0.34.0"
             ],
-            "v": "<1.1.4"
-        }
-    ],
-    "django-crm": [
+            "v": "<0.34.0"
+        },
         {
-            "advisory": "MicroPyramid Django-CRM 0.2 does not use CSRF token for /users/create/, /users/##/edit/, and /accounts/##/delete/ URIs.",
-            "cve": "CVE-2018-16552",
-            "id": "pyup.io-36440",
+            "advisory": "As an extra security measure on top of what the standard Django password reset token generator is already facilitating, allauth in fincity-django-allauth 0.35.0 adds the user email address to the hash such that whenever the user's email address changes the token is invalidated.",
+            "cve": "PVE-2021-37462",
+            "id": "pyup.io-37462",
             "specs": [
-                "<=0.2"
+                "<0.35.0"
             ],
-            "v": "<=0.2"
+            "v": "<0.35.0"
         },
         {
-            "advisory": "Multiple CSRF issues exist in MicroPyramid Django CRM 0.2.1 via /change-password-by-admin/, /api/settings/add/, /cases/create/, /change-password-by-admin/, /comment/add/, /documents/1/view/, /documents/create/, /opportunities/create/, and /login/. See: CVE-2019-11457.",
-            "cve": "CVE-2019-11457",
-            "id": "pyup.io-37416",
+            "advisory": "The authentication backend in fincity-django-allauth before 0.36.0 did not invoke the `user_can_authenticate()` method, potentially allowing users with `is_active=False` to authenticate when the allauth authentication backend was used in a non allauth context.",
+            "cve": "PVE-2021-38513",
+            "id": "pyup.io-38513",
             "specs": [
-                "==0.2.1"
+                "<0.36.0"
             ],
-            "v": "==0.2.1"
-        }
-    ],
-    "django-dajaxice-ng": [
+            "v": "<0.36.0"
+        },
         {
-            "advisory": "Django-dajaxice-ng  0.1.7 fixes the dajaxice callback model to improve security against XSS attacks.\r\nhttps://github.com/ifanrx/django-dajaxice/commit/cd56cde9d9f4f0bea56e97fe86513553669ad187",
-            "cve": "PVE-2021-25753",
-            "id": "pyup.io-25753",
+            "advisory": "Before fincity-django-allauth 0.38.0, the '{% user_display user %}' tag wasn't escaped properly. Depending on the username validation rules, this could allow XSS.\r\nhttps://github.com/tiru777/fincity-django-allauth/commit/85ca0c710bfc27f5e74a95c5144fc497cffdb5fa",
+            "cve": "PVE-2021-37465",
+            "id": "pyup.io-37465",
             "specs": [
-                "<0.1.7"
+                "<0.38.0"
             ],
-            "v": "<0.1.7"
+            "v": "<0.38.0"
         }
     ],
-    "django-debug-toolbar": [
+    "firepyer": [
         {
-            "advisory": "A SQL Injection issue in the SQL Panel in Jazzband Django Debug Toolbar before 1.11.1, 2.x before 2.2.1, and 3.x before 3.2.1 allows attackers to execute SQL statements by changing the raw_sql input field of the SQL explain, analyze, or select form. See CVE-2021-30459.",
-            "cve": "CVE-2021-30459",
-            "id": "pyup.io-40207",
+            "advisory": "Firepyer 0.0.2 adds system, security policy and ICMP methods.",
+            "cve": "PVE-2021-39442",
+            "id": "pyup.io-39442",
             "specs": [
-                "<1.11.1",
-                ">2,<2.2.1",
-                ">3,<3.2.1"
+                "<0.0.2"
             ],
-            "v": "<1.11.1,>2,<2.2.1,>3,<3.2.1"
+            "v": "<0.0.2"
         }
     ],
-    "django-discord-bind": [
+    "flambe": [
         {
-            "advisory": "django-discord-bind  0.2.0 added state validation to prevent CSRF attacks.",
-            "cve": "PVE-2021-25754",
-            "id": "pyup.io-25754",
+            "advisory": "Flambe 0.4.16 fixes a vulnerability with PyYAML < 5.3.1.",
+            "cve": "PVE-2021-38138",
+            "id": "pyup.io-38138",
             "specs": [
-                "<0.2.0"
+                "<0.4.16"
             ],
-            "v": "<0.2.0"
+            "v": "<0.4.16"
         }
     ],
-    "django-embed-video": [
+    "flashfocus": [
         {
-            "advisory": "django-embed-video  0.3 has a security fix: faked urls are treated as invalid.",
-            "cve": "PVE-2021-25755",
-            "id": "pyup.io-25755",
+            "advisory": "Flashfocus 1.2.1 updates pyyaml version to >=4.2b1 to include a security fix.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-36825",
             "specs": [
-                "<0.3"
+                "<1.2.1"
             ],
-            "v": "<0.3"
+            "v": "<1.2.1"
         }
     ],
-    "django-envelope": [
+    "flask": [
         {
-            "advisory": "django-envelope  0.4.1 contains a security bugfix regarding initial form values.",
-            "cve": "PVE-2021-25756",
-            "id": "pyup.io-25756",
+            "advisory": "flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.",
+            "cve": "CVE-2018-1000656",
+            "id": "pyup.io-36388",
             "specs": [
-                "<0.4.1"
+                "<0.12.3"
             ],
-            "v": "<0.4.1"
-        }
-    ],
-    "django-epiced": [
+            "v": "<0.12.3"
+        },
         {
-            "advisory": "django-epiced before 0.3.0 does not escape HTML output by default.",
-            "cve": "PVE-2021-34269",
-            "id": "pyup.io-34269",
+            "advisory": "flask 0.6.1 fixes a security problem that allowed clients to download arbitrary files  if the host server was a windows based operating system and the client  uses backslashes to escape the directory the files where exposed from.",
+            "cve": "PVE-2021-25820",
+            "id": "pyup.io-25820",
             "specs": [
-                "<0.3.0"
+                "<0.6.1"
             ],
-            "v": "<0.3.0"
-        }
-    ],
-    "django-epiceditor": [
+            "v": "<0.6.1"
+        },
         {
-            "advisory": "There is a cross-site scripting vulnerability in django-epiceditor 0.2.3 via crafted content in a form field.",
-            "cve": "CVE-2017-6591",
-            "id": "pyup.io-35735",
+            "advisory": "The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. See: CVE-2019-1010083. (NOTE: this may overlap CVE-2018-1000656.)",
+            "cve": "CVE-2019-1010083",
+            "id": "pyup.io-38654",
             "specs": [
-                "<=0.2.3"
+                "<1.0"
             ],
-            "v": "<=0.2.3"
+            "v": "<1.0"
         }
     ],
-    "django-fernet-fields": [
+    "flask-admin": [
         {
-            "advisory": "django-fernet-fields before 0.3 has DualField and HashField. The only cases where they are useful, they aren't secure.",
-            "cve": "PVE-2021-34331",
-            "id": "pyup.io-34331",
+            "advisory": "Flask-admin 1.3.0 fixes an XSS vulnerability escaping html in column_editable_list values in the WTForms widget.\r\nhttps://github.com/flask-admin/flask-admin/commit/f447db0c78c03235d0dd6bdce0c5365fc6a7c321\r\nhttps://github.com/flask-admin/flask-admin/pull/1002\r\nhttps://github.com/flask-admin/flask-admin/issues/1000",
+            "cve": "PVE-2021-25821",
+            "id": "pyup.io-25821",
             "specs": [
-                "<0.3"
+                "<1.3.0"
             ],
-            "v": "<0.3"
+            "v": "<1.3.0"
         },
         {
-            "advisory": "django-fernet-fields 0.3 removes DualField and HashField. The only cases where they are useful, they aren't secure.",
-            "cve": "PVE-2021-25757",
-            "id": "pyup.io-25757",
+            "advisory": "Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.\r\nhttps://github.com/flask-admin/flask-admin/pull/1699",
+            "cve": "CVE-2018-16516",
+            "id": "pyup.io-36437",
             "specs": [
-                "<0.3"
+                "<=1.5.2"
             ],
-            "v": "<0.3"
+            "v": "<=1.5.2"
         }
     ],
-    "django-fiber": [
+    "flask-api-tools": [
         {
-            "advisory": "django-fiber  0.9.9.1 contains a security bugfix: Changed permission check in API from IsAuthenticated to IsAdminUser",
-            "cve": "PVE-2021-25758",
-            "id": "pyup.io-25758",
+            "advisory": "Flask-api-tools 1.6.2 fixes a security vulnerability discovered and patched in a dependency. See also <https://github.com/mozilla/bleach/releases/tag/v3.3.0>.",
+            "cve": "PVE-2021-40044",
+            "id": "pyup.io-40044",
             "specs": [
-                "<0.9.9.1"
+                "<1.6.2"
             ],
-            "v": "<0.9.9.1"
+            "v": "<1.6.2"
         }
     ],
-    "django-filter": [
+    "flask-appbuilder": [
         {
-            "advisory": "Django-filter 2.4.0 added a MaxValueValidator to the form field for NumberFilter. This prevents a potential DoS attack if numbers with very large exponents were subsequently converted to integers.",
-            "cve": "PVE-2021-38825",
-            "id": "pyup.io-38825",
+            "advisory": "Flask-appbuilder 0.2.0 includes reset password corrections.",
+            "cve": "PVE-2021-37060",
+            "id": "pyup.io-37060",
             "specs": [
-                "<2.4.0"
+                "<0.2.0"
             ],
-            "v": "<2.4.0"
+            "v": "<0.2.0"
         },
         {
-            "advisory": "django-filter is a generic system for filtering Django QuerySets based on user selections. In django-filter before version 2.4.0, automatically generated `NumberFilter` instances, whose value was later converted to an integer, were subject to potential DoS from maliciously input using exponential format with sufficiently large exponents. Version 2.4.0+ applies a `MaxValueValidator` with a a default `limit_value` of 1e50 to the form field used by `NumberFilter` instances. In addition, `NumberFilter` implements the new `get_max_validator()` which should return a configured validator instance to customise the limit, or else `None` to disable the additional validation. Users may manually apply an equivalent validator if they are not able to upgrade.",
-            "cve": "CVE-2020-15225",
-            "id": "pyup.io-40317",
-            "specs": [
-                "<2.4.0"
-            ],
-            "v": "<2.4.0"
-        }
-    ],
-    "django-fluent-comments": [
-        {
-            "advisory": "django-fluent-comments  1.0.1 fixes security hash formatting errors on bad requests..",
-            "cve": "PVE-2021-25761",
-            "id": "pyup.io-25761",
-            "specs": [
-                "<1.0.1"
-            ],
-            "v": "<1.0.1"
-        }
-    ],
-    "django-formidable": [
-        {
-            "advisory": "Django-formidable 4.0.0 adds an XSS prevention mechanism.\r\nhttps://github.com/peopledoc/django-formidable/pull/378/commits/e6e5392823e78bb17259b1d4ed45182e34c13dd7",
-            "cve": "PVE-2021-37875",
-            "id": "pyup.io-37875",
+            "advisory": "flask-appbuilder 0.7.8 adds new, added optional parameter \"label\" and \"category_label\" for menu items, better security and i18n",
+            "cve": "PVE-2021-37905",
+            "id": "pyup.io-37905",
             "specs": [
-                "<4.0.0"
+                "<0.7.8"
             ],
-            "v": "<4.0.0"
-        }
-    ],
-    "django-friendship": [
+            "v": "<0.7.8"
+        },
         {
-            "advisory": "django-friendship 1.2.0 fixes a security issue where the library was not checking the owner of a FriendRequest during accept and cancelation.",
-            "cve": "PVE-2021-25762",
-            "id": "pyup.io-25762",
+            "advisory": "Flask-appbuilder 0.7.8 has better security than previous versions. No details are given.",
+            "cve": "PVE-2021-37064",
+            "id": "pyup.io-37064",
             "specs": [
-                "<1.2.0"
+                "<0.7.8"
             ],
-            "v": "<1.2.0"
-        }
-    ],
-    "django-froala-editor": [
+            "v": "<0.7.8"
+        },
         {
-            "advisory": "Django-froala-editor 4.0.8 fixed high level security vulnerability in dependent packages for Node.",
-            "cve": "PVE-2021-43580",
-            "id": "pyup.io-43580",
+            "advisory": "flask-appbuilder 1.9.0 prevents masquerade attacks through oauth providers",
+            "cve": "PVE-2021-37828",
+            "id": "pyup.io-37828",
             "specs": [
-                "<4.0.8"
+                "<1.9.0"
             ],
-            "v": "<4.0.8"
-        }
-    ],
-    "django-guts": [
+            "v": "<1.9.0"
+        },
         {
-            "advisory": "django-guts 0.1.1 fixes a security issue, allowing anyone to read any file.",
-            "cve": "PVE-2021-25763",
-            "id": "pyup.io-25763",
+            "advisory": "Flask-appbuilder 1.9.0 prevent masquerade attacks through OAuth providers and fixes crash on OAuth errors, which was a security concern.",
+            "cve": "PVE-2021-37061",
+            "id": "pyup.io-37061",
             "specs": [
-                "<0.1.1"
+                "<1.9.0"
             ],
-            "v": "<0.1.1"
-        }
-    ],
-    "django-hashedfilenamestorage": [
+            "v": "<1.9.0"
+        },
         {
-            "advisory": "Django-hashedfilenamestorage 2.4 updates Django dependency requirement to >=2.0.8 to include security fixes.",
-            "cve": "CVE-2018-7537",
-            "id": "pyup.io-43734",
+            "advisory": "flask-appbuilder 1.9.2 fixes possible SQL injection vulnerability",
+            "cve": "PVE-2021-37297",
+            "id": "pyup.io-37297",
             "specs": [
-                "<2.4"
+                "<1.9.2"
             ],
-            "v": "<2.4"
+            "v": "<1.9.2"
         },
         {
-            "advisory": "Django-hashedfilenamestorage 2.4 updates Django dependency requirement to >=2.0.8 to include security fixes.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-36802",
+            "advisory": "Flask-appbuilder 1.9.3 fixes a possible SQL injection vulnerability on order by clauses.",
+            "cve": "PVE-2021-38900",
+            "id": "pyup.io-38900",
             "specs": [
-                "<2.4"
+                "<1.9.3"
             ],
-            "v": "<2.4"
-        }
-    ],
-    "django-hashid-field": [
+            "v": "<1.9.3"
+        },
         {
-            "advisory": "Django-hashid-field v1.0.0 \r\n\r\nIf you already specified `salt` in fields, like `id = HashidField(salt=\"something\")` everywhere then you're already set, and can upgrade worry-free.\r\n\r\nIf you instead let the module fallback to `salt=settings.SECRET_KEY` (default behavior) then this upgrade will change all of your existing fields. It has been pointed out that it's possible to discover the salt used when encoding Hashids, and thus it is very dangerous to use settings.SECRET_KEY, as an attacker may be able to get your SECRET_KEY from your HashidFields.\r\n\r\nIf you absolutely MUST maintain backwards-compatibility and continue to support your old hashed values, then you can set `HASHID_FIELD_SALT = SECRET_KEY` in your settings. But this is *VERY DISCOURAGED*.",
-            "cve": "PVE-2021-38508",
-            "id": "pyup.io-38508",
+            "advisory": "Flask-appbuilder 2.2.2 make userstatschartview optional (a security issue) (#1239).",
+            "cve": "PVE-2021-37059",
+            "id": "pyup.io-37059",
             "specs": [
-                "<1.0.0"
+                "<2.2.2"
             ],
-            "v": "<1.0.0"
+            "v": "<2.2.2"
         },
         {
-            "advisory": "Django-hashid-field 3.1.1 fixes a security bug where comparison operators (gt, gte, lt, lte) would allow integer lookups regardless of ALLOW_INT_LOOKUP setting.",
-            "cve": "PVE-2021-37680",
-            "id": "pyup.io-37680",
+            "advisory": "Flask-appbuilder 2.2.4 toggles pvm, perm and vm mvc views config options (a security issue) (#1259).",
+            "cve": "PVE-2021-37130",
+            "id": "pyup.io-37130",
             "specs": [
-                "<3.1.1"
+                "<2.2.4"
             ],
-            "v": "<3.1.1"
-        }
-    ],
-    "django-haystack": [
+            "v": "<2.2.4"
+        },
         {
-            "advisory": "Django-haystack 1.1 removes insecure use of 'eval' from the Whoosh backend.\r\nhttps://github.com/django-haystack/django-haystack/commit/e0dc369cc12621df51bc8f807ff5ef728131e6ea",
-            "cve": "PVE-2021-25764",
-            "id": "pyup.io-25764",
+            "advisory": "Flask-appbuilder 3.1.1 includes a security fix related to permissions mapping.\r\nhttps://github.com/dpgaspar/Flask-AppBuilder/commit/54fc4131ef6544ffb065157a90ebcfcafe40c479",
+            "cve": "PVE-2021-42155",
+            "id": "pyup.io-42155",
             "specs": [
-                "<1.1"
+                "<3.1.1"
             ],
-            "v": "<1.1"
-        }
-    ],
-    "django-heartbeat": [
+            "v": "<3.1.1"
+        },
         {
-            "advisory": "Django-heartbeat 2.0.3 fixes its dependency to an insecure psutil package.",
-            "cve": "PVE-2021-38604",
-            "id": "pyup.io-38604",
+            "advisory": "Flask-appbuilder version 3.2.2 includes a fix for CVE-2021-32805: In affected versions, if using flask-appbuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with flask-appbuilder and this URL can redirect a user to a malicious site. This is an open redirect vulnerability. If upgrading is infeasible,  as a workaround, users may filter HTTP traffic containing \"?next={next-site}\" where the \"next-site\" domain is different from the application you are protecting.\r\nhttps://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-624f-cqvr-3qw4\r\nhttps://github.com/dpgaspar/Flask-AppBuilder/commit/6af28521589599b1dbafd6313256229ee9a4fa74",
+            "cve": "CVE-2021-32805",
+            "id": "pyup.io-41284",
             "specs": [
-                "<2.0.3"
+                "<3.2.2"
             ],
-            "v": "<2.0.3"
-        }
-    ],
-    "django-helpdesk": [
+            "v": "<3.2.2"
+        },
         {
-            "advisory": "Django-helpdesk 0.3.1 includes a fix for CVE-2021-3945: Django-helpdesk is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').\r\nhttps://github.com/django-helpdesk/django-helpdesk/commit/2c7065e0c4296e0c692fb4a7ee19c7357583af30\r\nhttps://huntr.dev/bounties/745f483c-70ed-441f-ab2e-7ac1305439a4",
-            "cve": "CVE-2021-3945",
-            "id": "pyup.io-42683",
+            "advisory": "Flask-AppBuilder 3.3.4 includes a fix for CVE-2021-41265: Versions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints.\r\nhttps://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q",
+            "cve": "CVE-2021-41265",
+            "id": "pyup.io-43309",
             "specs": [
-                "<0.3.1"
+                "<3.3.4"
             ],
-            "v": "<0.3.1"
+            "v": "<3.3.4"
         },
         {
-            "advisory": "Django-helpdesk 0.3.1 includes a fix for CVE-2021-3950: Django-helpdesk is vulnerable to improper neutralization of input during web page generation ('Cross-site Scripting').\r\nhttps://huntr.dev/bounties/4d7a5fdd-b2de-467a-ade0-3f2fb386638e\r\nhttps://github.com/django-helpdesk/django-helpdesk/commit/04483bdac3b5196737516398b5ce0383875a5c60",
-            "cve": "CVE-2021-3950",
-            "id": "pyup.io-42743",
+            "advisory": "Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.",
+            "cve": "CVE-2021-29621",
+            "id": "pyup.io-40630",
             "specs": [
-                "<0.3.1"
+                "<=3.2.3"
             ],
-            "v": "<0.3.1"
-        },
+            "v": "<=3.2.3"
+        }
+    ],
+    "flask-async": [
         {
-            "advisory": "Django-helpdesk 0.3.2 includes a fix for CVE-2021-3994: Django-helpdesk is vulnerable to improper neutralization of input during web page generation ('Cross-site Scripting').\r\nhttps://huntr.dev/bounties/be7f211d-4bfd-44fd-91e8-682329906fbd",
-            "cve": "CVE-2021-3994",
-            "id": "pyup.io-42766",
+            "advisory": "Flask-async 0.6.1 fixes a security problem that allowed clients to download arbitrary files if the host server was a windows based operating system and the client used backslashes to escape the directory the files where exposed from.\r\nhttps://github.com/mrdon/flask/commit/aeed530e3221c1b445c13269dcd2fb67548bcefc",
+            "cve": "PVE-2021-25822",
+            "id": "pyup.io-25822",
             "specs": [
-                "<0.3.2"
+                "<0.6.1"
             ],
-            "v": "<0.3.2"
+            "v": "<0.6.1"
         }
     ],
-    "django-hijack": [
+    "flask-caching": [
         {
-            "advisory": "django-hijack before 1.0.7 has a unspecified security issue and is vulnerable via unknown vectors.",
-            "cve": "PVE-2021-25765",
-            "id": "pyup.io-25765",
+            "advisory": "The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code.",
+            "cve": "CVE-2021-33026",
+            "id": "pyup.io-40459",
             "specs": [
-                "<1.0.7"
+                "<=1.10.1"
             ],
-            "v": "<1.0.7"
+            "v": "<=1.10.1"
         }
     ],
-    "django-howl": [
+    "flask-cors": [
         {
-            "advisory": "Django-howl 1.0.4 updates Django to v2.2.2 to include a security fix.",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-37240",
+            "advisory": "An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format. See CVE-2020-25032.",
+            "cve": "CVE-2020-25032",
+            "id": "pyup.io-38745",
             "specs": [
-                "<1.0.4"
+                "<3.0.9"
             ],
-            "v": "<1.0.4"
-        },
+            "v": "<3.0.9"
+        }
+    ],
+    "flask-exceptions": [
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-43654",
+            "advisory": "Flask-exceptions 1.2.2 updates its dependency 'requests' to v2.21.0 to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36812",
             "specs": [
-                "<1.0.5"
+                "<1.2.2"
             ],
-            "v": "<1.0.5"
+            "v": "<1.2.2"
         },
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2020-9402",
-            "id": "pyup.io-38069",
+            "advisory": "Flask-exceptions 1.2.2 updates its dependency 'pyyaml' minimum version to v4.2b1 to include a security fix.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-44625",
             "specs": [
-                "<1.0.5"
+                "<1.2.2"
             ],
-            "v": "<1.0.5"
-        },
+            "v": "<1.2.2"
+        }
+    ],
+    "flask-flatpages": [
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2020-7471",
-            "id": "pyup.io-43651",
+            "advisory": "Flask-flatpages 0.7.1 updates its dependencies to resolve some severe security alerts.",
+            "cve": "PVE-2021-37077",
+            "id": "pyup.io-37077",
             "specs": [
-                "<1.0.5"
+                "<0.7.1"
             ],
-            "v": "<1.0.5"
-        },
+            "v": "<0.7.1"
+        }
+    ],
+    "flask-i18n": [
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-43652",
+            "advisory": "Flask-i18n 1.1.1 updates its dependency 'requests' to v2.21.0 to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36814",
             "specs": [
-                "<1.0.5"
+                "<1.1.1"
             ],
-            "v": "<1.0.5"
+            "v": "<1.1.1"
         },
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2019-19118",
-            "id": "pyup.io-43653",
+            "advisory": "Flask-i18n 1.1.1 updates its dependency 'pyyaml' to v4.2b4 to include a security fix.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-44627",
             "specs": [
-                "<1.0.5"
+                "<1.1.1"
             ],
-            "v": "<1.0.5"
-        },
+            "v": "<1.1.1"
+        }
+    ],
+    "flask-images": [
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-43655",
+            "advisory": "flask-images 1.1.3 fixes 3 security bugs, each of which would allow for reading any image on disk.",
+            "cve": "PVE-2021-25823",
+            "id": "pyup.io-25823",
             "specs": [
-                "<1.0.5"
+                "<1.1.3"
             ],
-            "v": "<1.0.5"
-        },
+            "v": "<1.1.3"
+        }
+    ],
+    "flask-ipban": [
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-43656",
+            "advisory": "flask-ipban 0.2.2 fixes a yaml loading vulnerability.",
+            "cve": "PVE-2021-36997",
+            "id": "pyup.io-36997",
             "specs": [
-                "<1.0.5"
+                "<0.2.2"
             ],
-            "v": "<1.0.5"
-        },
+            "v": "<0.2.2"
+        }
+    ],
+    "flask-micropub": [
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-43657",
+            "advisory": "flask-micropub 0.2.2 fixes a vulnerability; re-discover the authorization_endpoint and token_endpoint at each stage in the flow. Prevents a buggy or malicious authorization_endpoint from giving you credentials for another user's domain name.",
+            "cve": "PVE-2021-25824",
+            "id": "pyup.io-25824",
             "specs": [
-                "<1.0.5"
+                "<0.2.2"
             ],
-            "v": "<1.0.5"
-        },
+            "v": "<0.2.2"
+        }
+    ],
+    "flask-monitoring": [
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'Django' to v2.2.11 to include security fixes.",
-            "cve": "CVE-2019-12781",
-            "id": "pyup.io-43658",
+            "advisory": "flask-monitoring 1.10.0 adds security for automatic endpoint-data retrieval",
+            "cve": "PVE-2021-37847",
+            "id": "pyup.io-37847",
             "specs": [
-                "<1.0.5"
+                "<1.10.0"
             ],
-            "v": "<1.0.5"
-        },
+            "v": "<1.10.0"
+        }
+    ],
+    "flask-oauthlib": [
         {
-            "advisory": "Django-howl 1.0.5 updates its dependency 'urllib3' to v1.25.8 to include a security fix.",
-            "cve": "CVE-2020-7212",
-            "id": "pyup.io-43659",
+            "advisory": "Flask-oauthlib before 0.9.1 didn't verify client_secret when authenticating non-confidential clients.\r\nhttps://github.com/lepture/flask-oauthlib/commit/829fdea095d2dac9cc03eb41b2e9946225c995fb",
+            "cve": "PVE-2021-25825",
+            "id": "pyup.io-25825",
             "specs": [
-                "<1.0.5"
+                "<0.9.1"
             ],
-            "v": "<1.0.5"
+            "v": "<0.9.1"
         }
     ],
-    "django-html5-appcache": [
+    "flask-oidc": [
         {
-            "advisory": "django-html5-appcache 0.3.0 added a security check for sensitive views.",
-            "cve": "PVE-2021-25766",
-            "id": "pyup.io-25766",
+            "advisory": "flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect",
+            "cve": "CVE-2016-1000001",
+            "id": "pyup.io-25826",
             "specs": [
-                "<0.3.0"
+                "<0.1.2"
             ],
-            "v": "<0.3.0"
+            "v": "<0.1.2"
         }
     ],
-    "django-idempotency-key": [
+    "flask-pagedown": [
         {
-            "advisory": "Django-idempotency-key 1.1.0 updates the minimum version of its dependency 'bleach' to v3.1.4 to include a security fix.",
-            "cve": "CVE-2020-6817",
-            "id": "pyup.io-42975",
+            "advisory": "Flask-pagedown 0.1.4 uses secure URLs when request is secure.\r\nhttps://github.com/miguelgrinberg/flask-pagedown/issues/3\r\nhttps://github.com/miguelgrinberg/flask-pagedown/commit/50ba142994e47d584f5bdf083e0c47f4a9209aa4",
+            "cve": "PVE-2021-41280",
+            "id": "pyup.io-41280",
             "specs": [
-                "<1.1.0"
+                "<0.1.4"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<0.1.4"
+        }
+    ],
+    "flask-pyoidc": [
         {
-            "advisory": "Django-idempotency-key 1.1.0 updates the minimum version of its dependency 'urllib3' to v1.24.2 to include a security fix.",
-            "cve": "CVE-2019-11324",
-            "id": "pyup.io-42976",
+            "advisory": "Flask-pyoidc before 3.7.0 did not properly validate the ID token according to the OIDC specification. It also still depended on a pyoidc version that is now known to not be secure.",
+            "cve": "PVE-2021-39225",
+            "id": "pyup.io-39225",
             "specs": [
-                "<1.1.0"
+                "<3.7.0"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<3.7.0"
+        }
+    ],
+    "flask-restless-ng": [
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2020-7471",
-            "id": "pyup.io-42977",
+            "advisory": "Flask-restless-ng 2.2.6 escapes user input in error messages to prevent potential server-side cross-site scripting.",
+            "cve": "PVE-2021-41218",
+            "id": "pyup.io-41218",
             "specs": [
-                "<1.1.0"
+                "<2.2.6"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<2.2.6"
+        }
+    ],
+    "flask-restx": [
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-42978",
+            "advisory": "Flask-restx version 0.5.1 includes a fix for CVE-2021-32838: Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex.\r\nhttps://github.com/advisories/GHSA-3q6g-vf58-7m4g\r\nhttps://github.com/python-restx/flask-restx/blob/fd99fe11a88531f5f3441a278f7020589f9d2cc0/flask_restx/inputs.py#L51\r\nhttps://github.com/python-restx/flask-restx/commit/bab31e085f355dd73858fd3715f7ed71849656da\r\nhttps://github.com/python-restx/flask-restx/issues/372\r\nhttps://pypi.org/project/flask-restx/",
+            "cve": "CVE-2021-32838",
+            "id": "pyup.io-41752",
             "specs": [
-                "<1.1.0"
+                "<0.5.1"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<0.5.1"
+        }
+    ],
+    "flask-security": [
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-42979",
+            "advisory": "All versions of flask-security are affected by CVE-2021-23385, an open redirect vulnerability: When using the get_post_logout_redirect and get_post_login_redirect functions, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behavior of Werkzeug is modified using 'autocorrect_location_header=False`.",
+            "cve": "CVE-2021-23385",
+            "id": "pyup.io-44501",
             "specs": [
-                "<1.1.0"
+                ">0"
             ],
-            "v": "<1.1.0"
-        },
+            "v": ">0"
+        }
+    ],
+    "flask-security-fork": [
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-42980",
+            "advisory": "flask-security-fork before 1.8.1 fixes a security bug when validating a confirmation token, also checks if the email that the token was created with matches the user's current email.",
+            "cve": "PVE-2021-25827",
+            "id": "pyup.io-25827",
             "specs": [
-                "<1.1.0"
+                "<1.8.1"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<1.8.1"
+        }
+    ],
+    "flask-security-too": [
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-42981",
+            "advisory": "All versions of flask-security-too are affected by CVE-2021-32618: Flask-Security-Too allows redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want. This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False'.",
+            "cve": "CVE-2021-32618",
+            "id": "pyup.io-40493",
             "specs": [
-                "<1.1.0"
+                ">0"
             ],
-            "v": "<1.1.0"
+            "v": ">0"
         },
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-42982",
+            "advisory": "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable. See CVE-2021-21241.",
+            "cve": "CVE-2021-21241",
+            "id": "pyup.io-39440",
             "specs": [
-                "<1.1.0"
+                ">=3.3.0rc1,<3.4.5"
             ],
-            "v": "<1.1.0"
-        },
+            "v": ">=3.3.0rc1,<3.4.5"
+        }
+    ],
+    "flask-sieve": [
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-42984",
+            "advisory": "Flask-sieve 1.0.4 fixes some vulnerabilities by updating the werkzeug package.",
+            "cve": "PVE-2021-39139",
+            "id": "pyup.io-39139",
             "specs": [
-                "<1.1.0"
+                "<1.0.4"
             ],
-            "v": "<1.1.0"
+            "v": "<1.0.4"
         },
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2020-9402",
-            "id": "pyup.io-42985",
+            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
+            "cve": "CVE-2019-19911",
+            "id": "pyup.io-43498",
             "specs": [
-                "<1.1.0"
+                "<1.1.1"
             ],
-            "v": "<1.1.0"
+            "v": "<1.1.1"
         },
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2019-12781",
-            "id": "pyup.io-42983",
+            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
+            "cve": "CVE-2020-5310",
+            "id": "pyup.io-37632",
             "specs": [
-                "<1.1.0"
+                "<1.1.1"
             ],
-            "v": "<1.1.0"
+            "v": "<1.1.1"
         },
         {
-            "advisory": "Django-idempotency-key 1.1.0 drops support for Django 1.x as it arrived to end of life.",
-            "cve": "CVE-2021-33203",
-            "id": "pyup.io-38162",
+            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
+            "cve": "CVE-2020-5311",
+            "id": "pyup.io-43495",
             "specs": [
-                "<1.1.0"
+                "<1.1.1"
             ],
-            "v": "<1.1.0"
-        }
-    ],
-    "django-initial-avatars": [
+            "v": "<1.1.1"
+        },
         {
-            "advisory": "django-initial-avatars before 0.4 has a unspecified security issue and is vulnerable via unknown vectors.",
-            "cve": "PVE-2021-25767",
-            "id": "pyup.io-25767",
+            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
+            "cve": "CVE-2020-5312",
+            "id": "pyup.io-43496",
             "specs": [
-                "<0.4"
+                "<1.1.1"
             ],
-            "v": "<0.4"
+            "v": "<1.1.1"
         },
         {
-            "advisory": "django-initial-avatars before 0.5.0 has a unspecified security issue and is vulnerable via unknown vectors.",
-            "cve": "PVE-2021-25768",
-            "id": "pyup.io-25768",
+            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
+            "cve": "CVE-2020-5313",
+            "id": "pyup.io-43497",
             "specs": [
-                "<0.5.0"
+                "<1.1.1"
             ],
-            "v": "<0.5.0"
+            "v": "<1.1.1"
         }
     ],
-    "django-jet": [
+    "flask-socketio": [
         {
-            "advisory": "Django-jet 1.0.4 fixes a security issue with accessing model_lookup_view (when using RelatedFieldAjaxListFilter) without permissions.\r\nhttps://github.com/geex-arts/django-jet/commit/734f3521d8290f6162847ad0b5c33d8ab5e119a9",
-            "cve": "PVE-2021-25769",
-            "id": "pyup.io-25769",
+            "advisory": "Flask-socketio 4.2.0 addresses potential websocket cross-origin attacks. See: <https://github.com/miguelgrinberg/python-engineio/issues/128>.",
+            "cve": "PVE-2021-37309",
+            "id": "pyup.io-37309",
             "specs": [
-                "<1.0.4"
+                "<4.2.0"
             ],
-            "v": "<1.0.4"
+            "v": "<4.2.0"
         }
     ],
-    "django-jet-reboot": [
+    "flask-statsdclient": [
         {
-            "advisory": "Django-jet-reboot 1.0.4 fixes a security issue with accessing model_lookup_view (when using RelatedFieldAjaxListFilter) without permissions.\r\nhttps://github.com/assem-ch/django-jet-reboot/commit/734f3521d8290f6162847ad0b5c33d8ab5e119a9",
-            "cve": "PVE-2021-39370",
-            "id": "pyup.io-39370",
+            "advisory": "flask-statsdclient 2.0.2 is for security vulnerabilities",
+            "cve": "PVE-2021-36813",
+            "id": "pyup.io-36813",
             "specs": [
-                "<1.0.4"
+                "<2.0.2"
             ],
-            "v": "<1.0.4"
+            "v": "<2.0.2"
         }
     ],
-    "django-jinja-knockout": [
+    "flask-unchained": [
         {
-            "advisory": "'TemplateContext' class is used in Django-jinja-knockout 0.9.0 to manage client-side data injection.",
-            "cve": "PVE-2021-39610",
-            "id": "pyup.io-39610",
+            "advisory": "Flask-unchained 0.9.0 includes a security fix in salt configuration for the 'itsdangerous' 2.0+ and a security fix for redirect vulnerability.",
+            "cve": "PVE-2021-40628",
+            "id": "pyup.io-40628",
             "specs": [
                 "<0.9.0"
             ],
             "v": "<0.9.0"
-        }
-    ],
-    "django-js-reverse": [
-        {
-            "advisory": "django-js-reverse (aka Django JS Reverse) before 0.9.1 has XSS via js_reverse_inline. See: CVE-2019-15486.",
-            "cve": "CVE-2019-15486",
-            "id": "pyup.io-37399",
-            "specs": [
-                "<0.9.1"
-            ],
-            "v": "<0.9.1"
-        }
-    ],
-    "django-lazysignup": [
-        {
-            "advisory": "django-lazysignup before 0.4.0 fixes a security issue: Generated usernames are now based on the session key, rather than actually being the session key. This is to avoid a potential security issue where an app might simply display a username, giving away a significant part of the user's session key. The username is now generated from a SHA1 hash of the session key. This change means that existing generated users will become invalid.",
-            "cve": "PVE-2021-25770",
-            "id": "pyup.io-25770",
-            "specs": [
-                "<0.4.0"
-            ],
-            "v": "<0.4.0"
-        }
-    ],
-    "django-lazysignup-redux": [
+        },
         {
-            "advisory": "django-lazysignup-redux 0.4.0 fixes a security issue: Generated usernames are now based on the session key, rather than actually being the session key. This is to avoid a potential security issue where an app might simply display a username, giving away a significant part of the user's session key. The username is now generated from a SHA1 hash of the session key. This change means that existing generated users will become invalid.",
-            "cve": "PVE-2021-25771",
-            "id": "pyup.io-25771",
+            "advisory": "This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.",
+            "cve": "CVE-2021-23393",
+            "id": "pyup.io-40657",
             "specs": [
-                "<0.4.0"
+                "<0.9.0"
             ],
-            "v": "<0.4.0"
+            "v": "<0.9.0"
         }
     ],
-    "django-lfs": [
+    "flask-user": [
         {
-            "advisory": "django-lfs before 0.6.9 has a unspecified security issue and is vulnerable via unknown vectors.",
-            "cve": "PVE-2021-25772",
-            "id": "pyup.io-25772",
+            "advisory": "This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.",
+            "cve": "CVE-2021-23401",
+            "id": "pyup.io-40904",
             "specs": [
-                "<0.6.9"
+                "<=1.0.2.2"
             ],
-            "v": "<0.6.9"
+            "v": "<=1.0.2.2"
         }
     ],
-    "django-magiclink": [
+    "flask-wtf": [
         {
-            "advisory": "Django-magiclink 1.0.4 adds csrf_protect decorator for POST requests by default to improve security.",
-            "cve": "PVE-2021-41829",
-            "id": "pyup.io-41829",
+            "advisory": "Flask-wtf 0.9.3 fixes how CSRF tokens are verified.\r\nhttps://github.com/wtforms/flask-wtf/pull/91/commits/91f70259660a106a49cd8cc2ccd137d47c9c393d",
+            "cve": "PVE-2021-42493",
+            "id": "pyup.io-42493",
             "specs": [
-                "<1.0.4"
+                "<0.9.3"
             ],
-            "v": "<1.0.4"
-        }
-    ],
-    "django-mail-auth": [
+            "v": "<0.9.3"
+        },
         {
-            "advisory": "Django-mail-auth 0.1.3 fixes session key security issues.",
-            "cve": "PVE-2021-37171",
-            "id": "pyup.io-37171",
+            "advisory": "Flask-wtf 0.9.5 adds missing CSRF tokens to all templates.\r\nhttps://github.com/wtforms/flask-wtf/commit/8e5998cd759d0a87a0197a87e7f780fcf84f2933",
+            "cve": "PVE-2021-42491",
+            "id": "pyup.io-42491",
             "specs": [
-                "<0.1.3"
+                "<0.9.5"
             ],
-            "v": "<0.1.3"
+            "v": "<0.9.5"
         }
     ],
-    "django-make-app": [
+    "flatplan": [
         {
-            "advisory": "An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in io_utils.py in django_make_app 0.1.3. A YAML parser can execute arbitrary Python commands resulting in command execution. An attacker can insert Python into loaded YAML to trigger this vulnerability.",
-            "cve": "CVE-2017-16764",
-            "id": "pyup.io-35722",
+            "advisory": "Flatplan 1.2.0 updates its dependencies to fix vulnerability issues.",
+            "cve": "PVE-2021-40345",
+            "id": "pyup.io-40345",
             "specs": [
-                "<0.1.3"
+                "<1.2.0"
             ],
-            "v": "<0.1.3"
+            "v": "<1.2.0"
         }
     ],
-    "django-mapstore-adapter": [
+    "flex": [
         {
-            "advisory": "Django-mapstore-adapter 1.0.4 fixes an unescaped \"ms2_config\" which may cause JS injection.",
-            "cve": "PVE-2021-38936",
-            "id": "pyup.io-38936",
+            "advisory": "Flex before 6.12.0 uses the unsafe 'yaml.load' function to load YAML files, leading to an attack vector that allows remote code execution. See CVE-2020-1747.",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-35155",
             "specs": [
-                "<1.0.4"
+                "<6.12.0"
             ],
-            "v": "<1.0.4"
+            "v": "<6.12.0"
         }
     ],
-    "django-markupfield": [
+    "flora-blockchain": [
         {
-            "advisory": "django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.",
-            "cve": "CVE-2015-0846",
-            "id": "pyup.io-25773",
+            "advisory": "Flora-blockchain 1.0b10 includes fixes for various Node.js security vulnerabilities.",
+            "cve": "PVE-2021-40983",
+            "id": "pyup.io-40983",
             "specs": [
-                "<1.3.2"
+                "<1.0b10"
             ],
-            "v": "<1.3.2"
+            "v": "<1.0b10"
         },
         {
-            "advisory": "django-markupfield before 1.3.2 uses the default docutils RESTRUCTUREDTEXT_FILTER_SETTINGS settings, which allows remote attackers to include and read arbitrary files via unspecified vectors.",
-            "cve": "CVE-2015-0846",
-            "id": "pyup.io-25774",
+            "advisory": "Flora-blockchain 1.0b8 removes the ability to pass in 'sk_seed' to plotting, to increase security.",
+            "cve": "PVE-2021-40985",
+            "id": "pyup.io-40985",
             "specs": [
-                "<1.3.3"
+                "<1.0b8"
             ],
-            "v": "<1.3.3"
-        }
-    ],
-    "django-material": [
+            "v": "<1.0b8"
+        },
         {
-            "advisory": "Django-material 0.9.0 fixes a XSS vulnerability in input fields.\r\nhttps://github.com/viewflow/django-material/issues/139",
-            "cve": "PVE-2021-25775",
-            "id": "pyup.io-25775",
+            "advisory": "Flora-blockchain 1.0b9 starts to use the 'libsodium' dependency for additional security for Windows BLS Signature library and updates Node.js dependencies to fix security vulnerabilities.",
+            "cve": "PVE-2021-40984",
+            "id": "pyup.io-40984",
             "specs": [
-                "<0.9.0"
+                "<1.0b9"
             ],
-            "v": "<0.9.0"
+            "v": "<1.0b9"
         },
         {
-            "advisory": "Django-material before 1.5.1 included a js injection vulnerability in a list view.\r\nhttps://github.com/viewflow/django-material/commit/778ad3e170a59e750ed7a86b83beebe5eccc39ee",
-            "cve": "PVE-2021-36950",
-            "id": "pyup.io-36950",
+            "advisory": "Flora-blockchain 1.0rc6 takes secret words a prompt on the command line or stdin instead of command line arguments for better security for 'chia keys add' command. This version also adds rate limiting for full node. Limitation can and will lead to short term bans of certain peers that didn't behave in expected ways. This is ok and normal, but strong defense against many DDOS attacks.",
+            "cve": "PVE-2021-40979",
+            "id": "pyup.io-40979",
             "specs": [
-                "<1.5.1"
+                "<1.0rc6"
             ],
-            "v": "<1.5.1"
-        }
-    ],
-    "django-modern-rpc": [
+            "v": "<1.0rc6"
+        },
         {
-            "advisory": "django-modern-rpc before 0.8.1 isn't correctly checking the authentication backend when executing 'system.multicall()'.",
-            "cve": "PVE-2021-34991",
-            "id": "pyup.io-34991",
+            "advisory": "Flora-blockchain 1.1.3 includes a fix to mitigate 1-3 mojo dust attacks.",
+            "cve": "PVE-2021-40978",
+            "id": "pyup.io-40978",
             "specs": [
-                "<0.8.1"
+                "<1.1.3"
             ],
-            "v": "<0.8.1"
+            "v": "<1.1.3"
         }
     ],
-    "django-mptt": [
+    "fnapy": [
         {
-            "advisory": "Django-mptt <0.8.0 uses versions of python/django that no longer receive security patches. You should upgrade to Python 2.7 and Django 1.8+.",
-            "cve": "PVE-2021-41205",
-            "id": "pyup.io-41205",
+            "advisory": "Fnapy 1.1.7 prevents possible vulnerabilities due to requests <=2.19.1. See CVE-2018-18074.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-39418",
             "specs": [
-                "<0.8.0"
+                "<1.1.7"
             ],
-            "v": "<0.8.0"
+            "v": "<1.1.7"
         }
     ],
-    "django-music-publisher": [
+    "foolscap": [
         {
-            "advisory": "Django 2.1 had a minor security issue, so 2.1.2 was promptly released.. django-music-publisher before 18.9.1 included this issue.",
-            "cve": "PVE-2021-36523",
-            "id": "pyup.io-36523",
+            "advisory": "In foolscap before 0.7.0 the \"flappserver\" feature was found to have a vulnerability in the service-lookup code which, when combined with an attacker who has the ability to write files to a location where the flappserver process could read them, would allow that attacker to obtain control of the flappserver process.\r\n\r\nUsers who run flappservers should upgrade to 0.7.0, where this was fixed as part of 226.",
+            "cve": "PVE-2021-25828",
+            "id": "pyup.io-25828",
             "specs": [
-                "<18.9.1"
+                "<0.7.0"
             ],
-            "v": "<18.9.1"
-        },
+            "v": "<0.7.0"
+        }
+    ],
+    "form-designer": [
         {
-            "advisory": "Django-music-publisher 18.9.3 updates its dependency 'requests' to v2.20.0 to include a security fix.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36608",
+            "advisory": "Form-designer 0.8 fixes an XSS vulnerability in the administration panel.\r\nhttps://github.com/feincms/form_designer/pull/18/commits/bc252a4bf3d610c9beaf83ffa39d66f2cbbcc5cd\r\nhttps://github.com/feincms/form_designer/commit/0e93601195f4c22c84ee1704de34e5331816188b",
+            "cve": "PVE-2021-34711",
+            "id": "pyup.io-34711",
             "specs": [
-                "<18.9.3"
+                "<0.8"
             ],
-            "v": "<18.9.3"
+            "v": "<0.8"
         }
     ],
-    "django-nameko-standalone": [
+    "formbar": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2018-7537",
-            "id": "pyup.io-38565",
+            "advisory": "Formbar 0.9 fixes a potential code injection issue by removing the rule parsing out of formbar and by using brabbel library for rule parsing and evaluation.\r\nhttps://github.com/ringo-framework/formbar/commit/bcbcf67fc68c37dd12528e3ddcacd712e4e0e64d",
+            "cve": "PVE-2021-25829",
+            "id": "pyup.io-25829",
             "specs": [
-                "<1.3.2"
+                "<0.9"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<0.9"
+        }
+    ],
+    "formencode": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-43700",
+            "advisory": "schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.",
+            "cve": "CVE-2008-6547",
+            "id": "pyup.io-25830",
             "specs": [
-                "<1.3.2"
+                "<1.0"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<1.0"
+        }
+    ],
+    "freewvs": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-43701",
+            "advisory": "In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users.\r\nhttps://github.com/schokokeksorg/freewvs/security/advisories/GHSA-7pmh-vrww-25xx\r\nhttps://github.com/schokokeksorg/freewvs/commit/83a6b55c0435c69f447488b791555e6078803143",
+            "cve": "CVE-2020-15101",
+            "id": "pyup.io-38575",
             "specs": [
-                "<1.3.2"
+                "<0.1.1"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<0.1.1"
+        }
+    ],
+    "fresco": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-43702",
+            "advisory": "In fresco after 0.5.5 user supplied data is no longer reflected in error messages raised from \"fresco.routeargs.RequestArg\". This fixes a potential XSS vulnerability affecting versions starting from 0.5.0.",
+            "cve": "PVE-2021-35028",
+            "id": "pyup.io-35028",
             "specs": [
-                "<1.3.2"
+                ">=0.5.0,<0.5.5"
             ],
-            "v": "<1.3.2"
-        },
+            "v": ">=0.5.0,<0.5.5"
+        }
+    ],
+    "friendlyshell": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-43703",
+            "advisory": "friendlyshell 1.0.3 fixes security warnings, and bugs with parsing quoted command parameters.",
+            "cve": "PVE-2021-36642",
+            "id": "pyup.io-36642",
             "specs": [
-                "<1.3.2"
+                "<1.0.3"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<1.0.3"
+        }
+    ],
+    "ftw-dashboard-portlets-postit": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-43704",
+            "advisory": "ftw-dashboard-portlets-postit  1.3.4 fixes a security error, it was possible to add postit comment on a foreign dashboard if the userid an portlet id was known.",
+            "cve": "PVE-2021-35933",
+            "id": "pyup.io-35933",
             "specs": [
-                "<1.3.2"
+                "<1.3.4"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<1.3.4"
+        }
+    ],
+    "ftw.dashboard.dragndrop": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-12781",
-            "id": "pyup.io-43705",
+            "advisory": "ftw.dashboard.dragndrop 1.5.1 includes several undisclosed security fixes.",
+            "cve": "PVE-2021-25831",
+            "id": "pyup.io-25831",
             "specs": [
-                "<1.3.2"
+                "<1.5.1"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<1.5.1"
+        }
+    ],
+    "ftw.dashboard.portlets.postit": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-43706",
+            "advisory": "ftw.dashboard.portlets.postit 1.3.4 fixes a security error, it was possible to add postit comment on a foreign dashboard if the userid an portlet id was known.",
+            "cve": "PVE-2021-25832",
+            "id": "pyup.io-25832",
             "specs": [
-                "<1.3.2"
+                "<1.3.4"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<1.3.4"
+        }
+    ],
+    "ftw.lawgiver": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-43708",
+            "advisory": "Ftw.lawgiver 1.16.1 fixes the workflow security.",
+            "cve": "PVE-2021-37470",
+            "id": "pyup.io-37470",
             "specs": [
-                "<1.3.2"
+                "<1.16.1"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<1.16.1"
+        }
+    ],
+    "ftw.mail": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-43709",
+            "advisory": "Ftw.mail 2.2.3 makes mail view XSS-save using the safe-html transform for the mail-body display.\r\nhttps://github.com/4teamwork/ftw.mail/pull/25",
+            "cve": "PVE-2021-25833",
+            "id": "pyup.io-25833",
             "specs": [
-                "<1.3.2"
+                "<2.2.3"
             ],
-            "v": "<1.3.2"
-        },
+            "v": "<2.2.3"
+        }
+    ],
+    "ftw.meeting": [
         {
-            "advisory": "Django-nameko-standalone 1.3.2 updates its Django version to 1.11.27 to include security fixes.",
-            "cve": "CVE-2019-6975",
-            "id": "pyup.io-43707",
+            "advisory": "ftw.meeting before 1.4.1 isn't using safe-html-transform for textfields.",
+            "cve": "PVE-2021-25834",
+            "id": "pyup.io-25834",
             "specs": [
-                "<1.3.2"
+                "<1.4.1"
             ],
-            "v": "<1.3.2"
+            "v": "<1.4.1"
         }
     ],
-    "django-newsletter": [
+    "ftw.permissionmanager": [
         {
-            "advisory": "django-newsletter before 0.7 allowed a user to subscribe others to the newsletter without authorization.",
-            "cve": "PVE-2021-36318",
-            "id": "pyup.io-36318",
+            "advisory": "ftw.permissionmanager before 2.2.2 allowed users with view permission to access the advanced security features. Since it's possible to search for all users, which exposes all usernames and email addresses to anyone with view permission.",
+            "cve": "PVE-2021-25835",
+            "id": "pyup.io-25835",
             "specs": [
-                "<0.7"
+                "<2.2.2"
             ],
-            "v": "<0.7"
-        },
+            "v": "<2.2.2"
+        }
+    ],
+    "ftw.recipe.solr": [
         {
-            "advisory": "Django-newsletter 0.9 updates its dependency 'Django' to v3.0.3 to include a security fix.",
-            "cve": "CVE-2020-7471",
-            "id": "pyup.io-37916",
+            "advisory": "Ftw.recipe.solr 1.3.5 disables message lookups in log4j dependency to fix a critical vulnerability.\r\nhttps://github.com/4teamwork/ftw.recipe.solr/commit/5d5ede2d8e0119c74ad6fa51cd2bee434109810f",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43395",
             "specs": [
-                "<0.9"
+                "<1.3.5"
             ],
-            "v": "<0.9"
+            "v": "<1.3.5"
         },
         {
-            "advisory": "Django-newsletter 0.9 updates its dependency 'Waitress' to v1.4.3 to include a security fix.",
-            "cve": "CVE-2020-5236",
-            "id": "pyup.io-43671",
+            "advisory": "Ftw.recipe.solr 1.3.6 fixes a system property for Log4j configuration file to be compatible with secure versions of this package.",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-43440",
             "specs": [
-                "<0.9"
+                "<1.3.6"
             ],
-            "v": "<0.9"
+            "v": "<1.3.6"
         },
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'waitress' to v1.4.2 to include security fixes.",
-            "cve": "CVE-2019-16786",
-            "id": "pyup.io-37677",
+            "advisory": "Ftw.recipe.solr 1.3.6 fixes a system property for Log4j configuration file to be compatible with secure versions of this package.",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43396",
             "specs": [
-                "<0.9b1"
+                "<1.3.6"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<1.3.6"
+        }
+    ],
+    "funcx": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'waitress' to v1.4.2 to include security fixes.",
-            "cve": "CVE-2019-16789",
-            "id": "pyup.io-43673",
+            "advisory": "Funcx 0.2.0 overhauls the security architecture.",
+            "cve": "PVE-2021-40175",
+            "id": "pyup.io-40175",
             "specs": [
-                "<0.9b1"
+                "<0.2.0"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<0.2.0"
+        }
+    ],
+    "fundnsf": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'waitress' to v1.4.2 to include security fixes.",
-            "cve": "CVE-2019-16792",
-            "id": "pyup.io-43674",
+            "advisory": "Fundnsf 0.0.32 updates requests to v2.20.0 for including a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36598",
             "specs": [
-                "<0.9b1"
+                "<0.0.32"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<0.0.32"
+        }
+    ],
+    "futoin-cid": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
-            "cve": "CVE-2019-19911",
-            "id": "pyup.io-43675",
+            "advisory": "futoin-cid before 0.8.5 does not properly check components loading from the root directory when using os.path.join().",
+            "cve": "PVE-2021-35184",
+            "id": "pyup.io-35184",
             "specs": [
-                "<0.9b1"
+                "<0.8.5"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<0.8.5"
+        }
+    ],
+    "galaxy-importer": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
-            "cve": "CVE-2020-5310",
-            "id": "pyup.io-43676",
+            "advisory": "Galaxy-importer 0.2.15 updates 'bleach' dependency to v3.3.0 to fix a 'XSS mutation' vulnerability.",
+            "cve": "CVE-2021-23980",
+            "id": "pyup.io-40174",
             "specs": [
-                "<0.9b1"
+                "<0.2.15"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<0.2.15"
+        }
+    ],
+    "galaxy-ng": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
-            "cve": "CVE-2020-5311",
-            "id": "pyup.io-43677",
+            "advisory": "Galaxy-ng 4.4.0 updates its dependency 'Django' to v3.2.6 to include security fixes.",
+            "cve": "CVE-2021-32052",
+            "id": "pyup.io-42974",
             "specs": [
-                "<0.9b1"
+                "<4.4.0"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<4.4.0"
+        }
+    ],
+    "gallery-dl": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'waitress' to v1.4.2 to include security fixes.",
-            "cve": "CVE-2019-16785",
-            "id": "pyup.io-43672",
+            "advisory": "Gallery-dl 1.5.3 improves the downloader/postprocessor module loading to prevent potential security risk through relative imports.\r\nhttps://github.com/mikf/gallery-dl/commit/e9ae6fd080d8c9662a1ce688ec622d413b99e615",
+            "cve": "PVE-2021-42368",
+            "id": "pyup.io-42368",
             "specs": [
-                "<0.9b1"
+                "<1.5.3"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<1.5.3"
+        }
+    ],
+    "gandi.cli": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-43680",
+            "advisory": "gandi.cli 0.10 includes two security related fixes: \r\n\r\n- validate server certificate using request as\r\n  xmlrpc transport.\r\n- Security: restrict configuration file rights to owner only.",
+            "cve": "PVE-2021-25836",
+            "id": "pyup.io-25836",
             "specs": [
-                "<0.9b1"
+                "<0.10"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<0.10"
+        }
+    ],
+    "gdal": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-19118",
-            "id": "pyup.io-43681",
+            "advisory": "Gdal 1.10.0 fixes various vulnerabilities/DoS  in the GXF driver.\r\nhttps://github.com/OSGeo/gdal/commit/283146cbff813f0a7eff3e1fe4712ff1f48f1188",
+            "cve": "PVE-2021-42375",
+            "id": "pyup.io-42375",
             "specs": [
-                "<0.9b1"
+                "<1.10.0"
             ],
-            "v": "<0.9b1"
+            "v": "<1.10.0"
         },
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
-            "cve": "CVE-2020-5312",
-            "id": "pyup.io-43678",
+            "advisory": "Gdal 1.11.0 applies a patch for CVE-2013-6629 in the JPEG driver.",
+            "cve": "CVE-2013-6629",
+            "id": "pyup.io-42374",
             "specs": [
-                "<0.9b1"
+                "<1.11.0"
             ],
-            "v": "<0.9b1"
+            "v": "<1.11.0"
         },
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-43683",
+            "advisory": "Gdal 1.11.0 switches http to https for the oauth2 link to improve security in the GFT driver.",
+            "cve": "PVE-2021-42376",
+            "id": "pyup.io-42376",
             "specs": [
-                "<0.9b1"
+                "<1.11.0"
             ],
-            "v": "<0.9b1"
+            "v": "<1.11.0"
         },
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-43684",
+            "advisory": "Gdal 2.3.0 drops support for PostgreSQL client library older than 7.4, or non security maintained releases older than 8.1.4, 8.0.8, 7.4.13, 7.3.15.",
+            "cve": "PVE-2021-42372",
+            "id": "pyup.io-42372",
             "specs": [
-                "<0.9b1"
+                "<2.3.0"
             ],
-            "v": "<0.9b1"
+            "v": "<2.3.0"
         },
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-43687",
+            "advisory": "Gdal 2.3.0 includes more than 1000 fixes for issues/vulnerabilities found by OSS-Fuzz.",
+            "cve": "PVE-2021-42371",
+            "id": "pyup.io-42371",
             "specs": [
-                "<0.9b1"
+                "<2.3.0"
             ],
-            "v": "<0.9b1"
+            "v": "<2.3.0"
         },
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'pillow' to v7.0.0 to include security fixes.",
-            "cve": "CVE-2020-5313",
-            "id": "pyup.io-43679",
+            "advisory": "Gdal 3.1.0 includes multiple security-related fixes. No details are given.",
+            "cve": "PVE-2021-38264",
+            "id": "pyup.io-38264",
             "specs": [
-                "<0.9b1"
+                "<3.1.0"
             ],
-            "v": "<0.9b1"
+            "v": "<3.1.0"
         },
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-43682",
+            "advisory": "Gdal 3.1.0 includes multiple security related fixes detected by OSS-Fuzz.",
+            "cve": "PVE-2021-42370",
+            "id": "pyup.io-42370",
             "specs": [
-                "<0.9b1"
+                "<3.1.0"
             ],
-            "v": "<0.9b1"
+            "v": "<3.1.0"
         },
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-43685",
+            "advisory": "Gdal 3.3.3 adds netcdf patch to fix a stack read overflow vulnerability.\r\nhttps://github.com/OSGeo/gdal/commit/eec259c7c73f8bc200ff41efc8e6771472b48f86\r\nhttps://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39189",
+            "cve": "PVE-2021-42369",
+            "id": "pyup.io-42369",
             "specs": [
-                "<0.9b1"
+                "<3.3.3"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<3.3.3"
+        }
+    ],
+    "gds-django-jet": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-12781",
-            "id": "pyup.io-43686",
+            "advisory": "Gds-django-jet 1.0.4 fixes an security issue with accessing 'model_lookup_view' (when using 'RelatedFieldAjaxListFilter') without permissions.\r\nhttps://github.com/govindsharma7/gds-django-jet/commit/734f3521d8290f6162847ad0b5c33d8ab5e119a9",
+            "cve": "PVE-2021-40668",
+            "id": "pyup.io-40668",
             "specs": [
-                "<0.9b1"
+                "<1.0.4"
             ],
-            "v": "<0.9b1"
-        },
+            "v": "<1.0.4"
+        }
+    ],
+    "genbadge": [
         {
-            "advisory": "Django-newsletter 0.9b1 updates its dependency 'django' to v3.0.2 to include security fixes.",
-            "cve": "CVE-2019-6975",
-            "id": "pyup.io-43688",
+            "advisory": "Genbadge 1.0.0 starts to use 'defusedxml' to fix a known vulnerability. See: <https://github.com/smarie/python-genbadge/issues/11>.",
+            "cve": "PVE-2021-40496",
+            "id": "pyup.io-40496",
             "specs": [
-                "<0.9b1"
+                "<1.0.0"
             ],
-            "v": "<0.9b1"
+            "v": "<1.0.0"
         }
     ],
-    "django-ninecms": [
+    "genshi": [
         {
-            "advisory": "django-ninecms before 0.4.5b has a unknown security issue in its url configuration.",
-            "cve": "PVE-2021-25776",
-            "id": "pyup.io-25776",
+            "advisory": "genshi 0.6.1 includes a security fix to enhance sanitizing of CSS in style attributes. Genshi's `HTMLSanitizer` disallows style attributes by default (this remains unchanged) and warns against such attacks in its documentation, but the provided CSS santizing is now less lacking (see GitHub issue 455).",
+            "cve": "PVE-2021-34688",
+            "id": "pyup.io-34688",
             "specs": [
-                "<0.4.5b"
+                "<0.6.1"
             ],
-            "v": "<0.4.5b"
+            "v": "<0.6.1"
+        },
+        {
+            "advisory": "Genshi 0.6.1 updates the HTML sanitizer to strip any CSS comments in style attributes, which could previously be used to hide malicious property values. This security fix also enhances the sanitizing of CSS in style attributes. Genshi's  'HTMLSanitizer' disallows style attributes by default (this remains unchanged) and warns against such attacks in its documentation.",
+            "cve": "PVE-2021-39055",
+            "id": "pyup.io-39055",
+            "specs": [
+                "<0.6.1"
+            ],
+            "v": "<0.6.1"
         }
     ],
-    "django-nopassword": [
+    "geoipsets": [
         {
-            "advisory": "django-nopassword before 5.0.0 stores cleartext secrets in the database. See: CVE-2019-10682.",
-            "cve": "CVE-2019-10682",
-            "id": "pyup.io-38080",
+            "advisory": "Geoipsets 2.3.2 improves the systemd service sandboxing to lower exposure of update-geoipsets.service unit file.\r\nhttps://github.com/chr0mag/geoipsets/issues/18",
+            "cve": "PVE-2022-44473",
+            "id": "pyup.io-44473",
             "specs": [
-                "<5.0.0"
+                "<2.3.2"
             ],
-            "v": "<5.0.0"
+            "v": "<2.3.2"
         }
     ],
-    "django-oauth-toolkit": [
+    "geojson-client": [
         {
-            "advisory": "Django-oauth-toolkit 0.8.0 includes fixes for various vulnerabilities on 'Basic' authentication.",
-            "cve": "PVE-2021-39609",
-            "id": "pyup.io-39609",
+            "advisory": "Geojson-client 0.4 fetches NSW Rural Fire Service feed securely via HTTPS.",
+            "cve": "PVE-2021-38898",
+            "id": "pyup.io-38898",
             "specs": [
-                "<0.8.0"
+                "<0.4"
             ],
-            "v": "<0.8.0"
+            "v": "<0.4"
         }
     ],
-    "django-orghierarchy": [
+    "geokey": [
         {
-            "advisory": "Django-orghierarchy 0.1.13 updates its dependency 'Django' to v1.11.15 to include a security fix.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-37039",
+            "advisory": "Geokey 1.11.2 upgrades the REST framework (+GIS) dependencies in order to resolve reported vulnerability issue.",
+            "cve": "PVE-2021-37207",
+            "id": "pyup.io-37207",
             "specs": [
-                "<0.1.13"
+                "<1.11.2"
             ],
-            "v": "<0.1.13"
+            "v": "<1.11.2"
         },
         {
-            "advisory": "Django-orghierarchy 0.1.18 updates its dependency 'requests' to v2.20.0 to include a security fix.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-37038",
+            "advisory": "Geokey 1.3.1 includes a not further specified security update.",
+            "cve": "PVE-2021-35080",
+            "id": "pyup.io-35080",
             "specs": [
-                "<0.1.18"
+                "<1.3.1"
             ],
-            "v": "<0.1.18"
+            "v": "<1.3.1"
         }
     ],
-    "django-pagetree": [
+    "geonode": [
         {
-            "advisory": "Django-pagetree version 1.0.4 adds csrf_tokens to several forms where it was missing.",
-            "cve": "PVE-2021-41899",
-            "id": "pyup.io-41899",
+            "advisory": "Geonode 2.10 updates 'urllib3' to v1.24.2 to include security fixes.",
+            "cve": "CVE-2018-20060",
+            "id": "pyup.io-42969",
             "specs": [
-                "<1.0.4"
+                "<2.10"
             ],
-            "v": "<1.0.4"
+            "v": "<2.10"
         },
         {
-            "advisory": "Django-pagetree version 1.0.7 adds a csrf token for the import_json form.",
-            "cve": "PVE-2021-41898",
-            "id": "pyup.io-41898",
+            "advisory": "Geonode 2.10 updates 'urllib3' to v1.24.2 to include security fixes.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-42968",
             "specs": [
-                "<1.0.7"
+                "<2.10"
             ],
-            "v": "<1.0.7"
+            "v": "<2.10"
         },
         {
-            "advisory": "Django-pagetree 1.1.8 adds a csrf_token to the base clone_hierarchy form.",
-            "cve": "PVE-2021-41897",
-            "id": "pyup.io-41897",
+            "advisory": "Geonode 2.10 patches a yaml vulnerability by using safe_load().\r\nhttps://github.com/geonode/geonode/commit/b2d6f0e5ede3642c308fcc5df2c33b2e2a5e010c",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-42972",
             "specs": [
-                "<1.1.8"
+                "<2.10"
             ],
-            "v": "<1.1.8"
-        }
-    ],
-    "django-patchwork": [
+            "v": "<2.10"
+        },
         {
-            "advisory": "A Cross Site Scripting (XSS) vulnerability exists in the template tag used to render message ids in Patchwork v1.1 through v2.1.x. This allows an attacker to insert JavaScript or HTML into the patch detail page via an email sent to a mailing list consumed by Patchwork. This affects the function msgid in templatetags/patch.py. Patchwork versions v2.1.4 and v2.0.4 will contain the fix.",
-            "cve": "CVE-2019-13122",
-            "id": "pyup.io-42262",
+            "advisory": "Geonode 2.10 updates 'twisted' to v19.2.1 to include security fixes.",
+            "cve": "CVE-2019-12387",
+            "id": "pyup.io-42970",
             "specs": [
-                ">=1.1,<2.0.4",
-                ">=2.1.0,<2.1.4",
-                "==2.1.0:rc1",
-                "==2.1.0:rc2"
+                "<2.10"
             ],
-            "v": ">=1.1,<2.0.4,>=2.1.0,<2.1.4,==2.1.0:rc1,==2.1.0:rc2"
-        }
-    ],
-    "django-perms-provisioner": [
+            "v": "<2.10"
+        },
         {
-            "advisory": "Django-perms-provisioner 0.0.4 updates PyYAML to v5.3.1 to include security fixes.",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-38289",
+            "advisory": "Geonode 2.10 updates 'twisted' to v19.2.1 to include security fixes.",
+            "cve": "PVE-2021-37040",
+            "id": "pyup.io-42971",
             "specs": [
-                "<0.0.4"
+                "<2.10"
             ],
-            "v": "<0.0.4"
+            "v": "<2.10"
         },
         {
-            "advisory": "Django-perms-provisioner 0.0.4 updates PyYAML to v5.3.1 to include security fixes.",
-            "cve": "CVE-2019-20477",
-            "id": "pyup.io-43456",
+            "advisory": "Geonode 2.10 updates 'django' to v1.11.22 to include a security fix.",
+            "cve": "CVE-2019-12781",
+            "id": "pyup.io-37877",
             "specs": [
-                "<0.0.4"
+                "<2.10"
             ],
-            "v": "<0.0.4"
-        }
-    ],
-    "django-piston": [
+            "v": "<2.10"
+        },
         {
-            "advisory": "emitters.py in Django Piston before 0.2.3 and 0.2.x before 0.2.2.1 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.",
-            "cve": "CVE-2011-4103",
-            "id": "pyup.io-25777",
+            "advisory": "Geonode 2.8.1 fix a JavaScript vulnerability and also fixes a vulnerability with the Pillow dependency.",
+            "cve": "PVE-2021-38558",
+            "id": "pyup.io-38558",
             "specs": [
-                "<0.2.3"
+                "<2.8.1"
             ],
-            "v": "<0.2.3"
+            "v": "<2.8.1"
         }
     ],
-    "django-pluggable-filebrowser": [
+    "geonode-oauth-toolkit": [
         {
-            "advisory": "django-pluggable-filebrowser 3.4.2 fixes a security bug: added staff_member_required decorator to the upload-function.",
-            "cve": "PVE-2021-25778",
-            "id": "pyup.io-25778",
+            "advisory": "Geonode-oauth-toolkit 0.8.0 fixes vulnerabilities on Basic authentication.",
+            "cve": "PVE-2021-40423",
+            "id": "pyup.io-40423",
             "specs": [
-                "<3.4.2"
+                "<0.8.0"
             ],
-            "v": "<3.4.2"
+            "v": "<0.8.0"
         }
     ],
-    "django-polaris": [
+    "gerapy": [
         {
-            "advisory": "Improvements in the Multi-signature Asset Distribution Account Support allow anchors since django-polaris version 1.1.0 to improve the security of the account that controls outbound payments.",
-            "cve": "PVE-2021-38837",
-            "id": "pyup.io-38837",
+            "advisory": "This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn\u2019t being sanitized. See: CVE-2020-7698.",
+            "cve": "CVE-2020-7698",
+            "id": "pyup.io-38636",
             "specs": [
-                "<1.1.0"
+                "<0.9.3"
             ],
-            "v": "<1.1.0"
+            "v": "<0.9.3"
         }
     ],
-    "django-postman": [
+    "getmail": [
         {
-            "advisory": "django-postman 3.6.2 fixes issue 101, for security concern, ignore the scheme and domain parts in the 'next' query param.",
-            "cve": "PVE-2021-36667",
-            "id": "pyup.io-36667",
+            "advisory": "Versions of getmail prior to 4.2.0 and 3.2.5 contain a security vulnerability. A local attacker with a shell account could exploit a race condition (or a similar symlink attack) to cause getmail to create or overwrite files in a directory of the local user's choosing if the system administrator ran getmail as root and delivered messages to a maildir or mbox file under the control of the attacker, resulting in a local root exploit. (This vulnerability is not exploitable if the administrator does not deliver mail to the maildirs/mbox files of untrusted local users, or if getmail is configured to use an external unprivileged MDA. Also, this vulnerability is not remotely exploitable.)",
+            "cve": "PVE-2021-38862",
+            "id": "pyup.io-38862",
             "specs": [
-                "<3.6.2"
+                "<3.2.5",
+                ">=4.0.0a1,<4.2.0"
             ],
-            "v": "<3.6.2"
+            "v": "<3.2.5,>=4.0.0a1,<4.2.0"
         }
     ],
-    "django-python3-ldap": [
-        {
-            "advisory": "django-python3-ldap 0.9.5 fixes a security vulnerability where username and password could be transmitted in plain text before starting TLS.",
-            "cve": "PVE-2021-25779",
-            "id": "pyup.io-25779",
-            "specs": [
-                "<0.9.5"
-            ],
-            "v": "<0.9.5"
-        },
+    "gevent": [
         {
-            "advisory": "django-python3-ldap 0.9.8 fixes a security vulnerability allowing users to authenticate with a valid username but with an empty password if anonymous authentication is allowed on the LDAP server.",
-            "cve": "PVE-2021-25780",
-            "id": "pyup.io-25780",
+            "advisory": "gevent 1.2a1 includes a security related fix. Errors logged by :class:`~gevent.pywsgi.WSGIHandler` no longer print the entire WSGI environment by default. This avoids  possible information disclosure vulnerabilities. Applications can also opt-in to a higher security level for the WSGI environment if they  choose and their frameworks support it. Originally reported  in :pr:`779` by sean-peters-au and changed in :pr:`781`.",
+            "cve": "PVE-2021-25837",
+            "id": "pyup.io-25837",
             "specs": [
-                "<0.9.8"
+                "<1.2a1"
             ],
-            "v": "<0.9.8"
+            "v": "<1.2a1"
         }
     ],
-    "django-rated": [
+    "geventhttpclient": [
         {
-            "advisory": "django-rated before 1.1.2 has a unspecified security issue and is vulnerable via unknown vectors.",
-            "cve": "PVE-2021-25781",
-            "id": "pyup.io-25781",
+            "advisory": "geventhttpclient 1.2.0 includes an undisclosed security fix related to SSL support.",
+            "cve": "PVE-2021-25838",
+            "id": "pyup.io-25838",
             "specs": [
-                "<1.1.2"
+                "<1.2.0"
             ],
-            "v": "<1.1.2"
+            "v": "<1.2.0"
         }
     ],
-    "django-registration": [
+    "gimpformats": [
         {
-            "advisory": "django-registration before 1.7 leaked password reset token through the Referer\r\nheader.",
-            "cve": "PVE-2021-36431",
-            "id": "pyup.io-36431",
+            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-40211",
             "specs": [
-                "<1.7"
+                "<2021"
             ],
-            "v": "<1.7"
+            "v": "<2021"
         },
         {
-            "advisory": "django-registration is a user registration package for Django. The django-registration package provides tools for implementing user-account registration flows in the Django web framework. In django-registration prior to 3.1.2, the base user-account registration view did not properly apply filters to sensitive data, with the result that sensitive data could be included in error reports rather than removed automatically by Django. Triggering this requires: A site is using django-registration < 3.1.2, The site has detailed error reports (such as Django's emailed error reports to site staff/developers) enabled and a server-side error (HTTP 5xx) occurs during an attempt by a user to register an account. Under these conditions, recipients of the detailed error report will see all submitted data from the account-registration attempt, which may include the user's proposed credentials (such as a password). See CVE-2021-21416.",
-            "cve": "CVE-2021-21416",
-            "id": "pyup.io-40136",
+            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-42150",
             "specs": [
-                "<3.1.2"
+                "<2021"
             ],
-            "v": "<3.1.2"
-        }
-    ],
-    "django-registration-redux": [
+            "v": "<2021"
+        },
         {
-            "advisory": "django-registration-redux before 1.7 leaks password reset tokens through the Referer header. For more info, see: https://github.com/macropin/django-registration/pull/268",
-            "cve": "PVE-2021-35199",
-            "id": "pyup.io-35199",
+            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-42152",
             "specs": [
-                "<1.7"
+                "<2021"
             ],
-            "v": "<1.7"
-        }
-    ],
-    "django-relatives": [
+            "v": "<2021"
+        },
         {
-            "advisory": "Django-relatives before 0.3.0 is vulnerable to XSS in html tags.\r\nhttps://github.com/treyhunner/django-relatives/commit/6410ae4695389cb377ce23d35883d8b70b789deb",
-            "cve": "PVE-2021-25782",
-            "id": "pyup.io-25782",
+            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-42153",
             "specs": [
-                "<0.3.0"
+                "<2021"
             ],
-            "v": "<0.3.0"
-        }
-    ],
-    "django-rest-registration": [
+            "v": "<2021"
+        },
         {
-            "advisory": "verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.e., the Django Signing API is misused), which allows remote attackers to spoof the verification process. This occurs because incorrect code refactoring led to calling a security-critical function with an incorrect argument.",
-            "cve": "CVE-2019-13177",
-            "id": "pyup.io-37266",
+            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-42154",
             "specs": [
-                "<0.5.0"
+                "<2021"
             ],
-            "v": "<0.5.0"
+            "v": "<2021"
         },
         {
-            "advisory": "Django-rest-registration 0.5.0 fixes a critical security issue with misusing the Django Signer API. See: <https://github.com/apragacz/django-rest-registration/security/advisories/GHSA-p3w6-jcg4-52xh>.",
-            "cve": "PVE-2021-37385",
-            "id": "pyup.io-37385",
+            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-42151",
             "specs": [
-                "<0.5.0"
+                "<2021"
             ],
-            "v": "<0.5.0"
+            "v": "<2021"
         }
     ],
-    "django-revproxy": [
+    "gino-quart": [
         {
-            "advisory": "django-revproxy 0.9.6 fixes a security issue that allowed remote-user header injection.",
-            "cve": "PVE-2021-25783",
-            "id": "pyup.io-25783",
+            "advisory": "Gino-quart 0.1.1b2 updates 'cryptography' dependency to fix a security issue.",
+            "cve": "PVE-2021-39623",
+            "id": "pyup.io-39623",
             "specs": [
-                "<0.9.6"
+                "<0.1.1b2"
             ],
-            "v": "<0.9.6"
+            "v": "<0.1.1b2"
         },
         {
-            "advisory": "django-revproxy 0.9.7 fixes a security issue: when colon is present at URL path urljoin ignores the upstream and the request is redirected to the path itself allowing content injection.",
-            "cve": "PVE-2021-25784",
-            "id": "pyup.io-25784",
+            "advisory": "Gino-quart 0.1.1b4 updates Jinja2 to v2.11.3 to include a security fix.",
+            "cve": "CVE-2020-28493",
+            "id": "pyup.io-40058",
             "specs": [
-                "<0.9.7"
+                "<0.1.1b4"
             ],
-            "v": "<0.9.7"
+            "v": "<0.1.1b4"
         }
     ],
-    "django-safedelete": [
+    "giosgapps-bindings": [
         {
-            "advisory": "Django-safedelete 0.3.3 contains a security fix that prevents an XSS attack in the admin interface.\r\nhttps://github.com/makinacorpus/django-safedelete/commit/317c548c9d53e8983bb9a361c02f658f635ac13e",
-            "cve": "PVE-2021-25785",
-            "id": "pyup.io-25785",
+            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
+            "cve": "CVE-2019-19118",
+            "id": "pyup.io-37906",
             "specs": [
-                "<0.3.3"
+                "<0.0.19"
             ],
-            "v": "<0.3.3"
-        }
-    ],
-    "django-sage-painless": [
+            "v": "<0.0.19"
+        },
         {
-            "advisory": "Django-sage-painless 1.10.2 includes fixes for few security bugs.",
-            "cve": "PVE-2021-41101",
-            "id": "pyup.io-41101",
+            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-43725",
             "specs": [
-                "<1.10.2"
+                "<0.0.19"
             ],
-            "v": "<1.10.2"
-        }
-    ],
-    "django-secure-auth": [
+            "v": "<0.0.19"
+        },
         {
-            "advisory": "django-secure-auth 1.1 includes undisclosed security fixes.",
-            "cve": "PVE-2021-34185",
-            "id": "pyup.io-34185",
+            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-43726",
             "specs": [
-                "<1.1"
+                "<0.0.19"
             ],
-            "v": "<1.1"
-        }
-    ],
-    "django-select2": [
+            "v": "<0.0.19"
+        },
         {
-            "advisory": "django-select2 5.7.0 contains a security fix that allows a `field_id` to only be used for the intended JSON endpoint.",
-            "cve": "PVE-2021-25787",
-            "id": "pyup.io-25787",
+            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-43727",
             "specs": [
-                "<5.7.0"
+                "<0.0.19"
             ],
-            "v": "<5.7.0"
-        }
-    ],
-    "django-selectable": [
+            "v": "<0.0.19"
+        },
         {
-            "advisory": "Django-selectable 0.5.2 fixes a XSS flaw with lookup \"get_item_*\" methods.\r\nhttps://github.com/mlavin/django-selectable/issues/63",
-            "cve": "PVE-2021-25788",
-            "id": "pyup.io-25788",
+            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-43728",
             "specs": [
-                "<0.5.2"
+                "<0.0.19"
             ],
-            "v": "<0.5.2"
+            "v": "<0.0.19"
         }
     ],
-    "django-server": [
+    "girder": [
         {
-            "advisory": "django-server is a package affected by pytosquatting: http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/",
-            "cve": "PVE-2021-34982",
-            "id": "pyup.io-34982",
+            "advisory": "Girder 2.2.0 fixes an XSS vulnerability in girders human-readable web API output. This vulnerability was not present in girders normal web client, so users of the Girder web client would not have been affected.\r\nhttps://github.com/girder/girder/pull/1828",
+            "cve": "PVE-2021-34634",
+            "id": "pyup.io-34634",
             "specs": [
-                ">0",
-                "<0"
+                "<2.2.0"
             ],
-            "v": ">0,<0"
-        }
-    ],
-    "django-session-security": [
+            "v": "<2.2.0"
+        },
         {
-            "advisory": "django-session-security  2.4.0 fixes a vulnerability when SESSION_EXPIRE_AT_BROWSER_CLOSE is off.",
-            "cve": "PVE-2021-25789",
-            "id": "pyup.io-25789",
+            "advisory": "In girder 2.5.0 the default Girder server now binds to localhost by default instead of 0.0.0.0.",
+            "cve": "PVE-2021-35831",
+            "id": "pyup.io-35831",
             "specs": [
-                "<2.4.0"
+                "<2.5.0"
             ],
-            "v": "<2.4.0"
+            "v": "<2.5.0"
         }
     ],
-    "django-silk": [
-        {
-            "advisory": "Django-silk version 0.4 improves user input sanitization.\r\nhttps://github.com/jazzband/django-silk/commit/487bca243e6d68678abfd83423c33684734281ab",
-            "cve": "PVE-2021-42212",
-            "id": "pyup.io-42212",
-            "specs": [
-                "<0.4"
-            ],
-            "v": "<0.4"
-        },
+    "git-big-picture": [
         {
-            "advisory": "Django-silk version 4.0.0 masks request headers to avoid auth information leaking.\r\nhttps://github.com/jazzband/django-silk/issues/375",
-            "cve": "PVE-2021-42212",
-            "id": "pyup.io-42216",
+            "advisory": "git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.",
+            "cve": "CVE-2021-3028",
+            "id": "pyup.io-42311",
             "specs": [
-                "<4.0.0"
+                "<1.0.0"
             ],
-            "v": "<4.0.0"
+            "v": "<1.0.0"
         }
     ],
-    "django-smart-lists": [
+    "git-portfolio": [
         {
-            "advisory": "Django-smart-lists 1.0.26 fixes a XSS vulnerability in the render_function.\r\nhttps://github.com/plecto/django-smart-lists/commit/44314e51b371e01cd9bceb2e0ed6c8d75d7f87c3",
-            "cve": "PVE-2021-38150",
-            "id": "pyup.io-38150",
+            "advisory": "Git-portfolio 0.10.1 includes various security patches.",
+            "cve": "PVE-2021-39510",
+            "id": "pyup.io-39510",
             "specs": [
-                "<1.0.26"
+                "<0.10.1"
             ],
-            "v": "<1.0.26"
+            "v": "<0.10.1"
         }
     ],
-    "django-smart-selects": [
+    "gitlab-languages": [
         {
-            "advisory": "django-smart-selects before 1.5.0 allowed anybody to list arbitrary objects by tweaking URL parameters. 1.5.0 adds checks to the views to ensure that queries return an HTTP 403 (Permission denied) for models that do not have smart_selects fields defined.",
-            "cve": "PVE-2021-34234",
-            "id": "pyup.io-34234",
+            "advisory": "Gitlab-languages 1.4.1 updates dependencies because of a security vulnerability in 'requests' <2.20.0.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36639",
             "specs": [
-                "<1.5.1"
+                "<1.4.1"
             ],
-            "v": "<1.5.1"
+            "v": "<1.4.1"
         }
     ],
-    "django-social-auth": [
+    "gitlabform": [
         {
-            "advisory": "django-social-auth 0.7.2 fixes a security hole - redirects via the next param are now properly sanitized to disallow redirecting to  external hosts.",
-            "cve": "PVE-2021-25790",
-            "id": "pyup.io-25790",
+            "advisory": "Gitlabform 2.0.5 fixes potential security issue by enabling autoescaping when loading the 'Jinja' templates.",
+            "cve": "PVE-2021-40639",
+            "id": "pyup.io-40639",
             "specs": [
-                "<0.7.2"
+                "<2.0.5"
             ],
-            "v": "<0.7.2"
+            "v": "<2.0.5"
         }
     ],
-    "django-social-auth3": [
+    "gitsup": [
         {
-            "advisory": "django-social-auth3 0.7.2 fixes a security hole - redirects via the next param are now properly sanitized to disallow redirecting to  external hosts.",
-            "cve": "PVE-2021-25791",
-            "id": "pyup.io-25791",
+            "advisory": "Gitsup 0.4.0 updates its dependency 'urllib3' to v1.26.8 to include a security fix.",
+            "cve": "CVE-2021-33503",
+            "id": "pyup.io-44647",
             "specs": [
-                "<0.7.2"
+                "<0.4.0"
             ],
-            "v": "<0.7.2"
+            "v": "<0.4.0"
         }
     ],
-    "django-sql-dashboard": [
+    "glances": [
         {
-            "advisory": "Django-sql-dashboard 0.14 fixes a security and permissions flaw, where users without the 'execute_sql' permission could still run custom queries by editing saved dashboards using the Django admin interface.",
-            "cve": "PVE-2021-40482",
-            "id": "pyup.io-40482",
+            "advisory": "Glances 3.2.0 updates Web UI for a security vulnerability.",
+            "cve": "PVE-2021-40900",
+            "id": "pyup.io-40900",
             "specs": [
-                "<0.14"
+                "<3.2.0"
             ],
-            "v": "<0.14"
-        }
-    ],
-    "django-sql-explorer": [
+            "v": "<3.2.0"
+        },
         {
-            "advisory": "Users in django-sql-explorer version 0.5 with view permissions can use query parameters. This results in a potential for SQL injection.",
-            "cve": "PVE-2021-39445",
-            "id": "pyup.io-39445",
+            "advisory": "Glances before version 3.2.1 is vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks. See: CVE-2021-23418.",
+            "cve": "CVE-2021-23418",
+            "id": "pyup.io-41042",
             "specs": [
-                "<0.5"
+                "<3.2.1"
             ],
-            "v": "<0.5"
+            "v": "<3.2.1"
         },
         {
-            "advisory": "Django-sql-explorer before 1.1.0 isn't escaping values from the database correctly, making it open for potential XSS-attacks.\r\nhttps://github.com/groveco/django-sql-explorer/pull/286",
-            "cve": "PVE-2021-33293",
-            "id": "pyup.io-33293",
+            "advisory": "Glances 3.2.4 updates WebUI dependencies (particularly, \"node-sass\") to include a security fix.\r\nhttps://github.com/nicolargo/glances/commit/d3560d403db1d8133d87f569d3fa3299f5db4a31",
+            "cve": "CVE-2020-24025",
+            "id": "pyup.io-42752",
             "specs": [
-                "<1.1.0"
+                "<3.2.4"
             ],
-            "v": "<1.1.0"
+            "v": "<3.2.4"
         }
     ],
-    "django-sticky-uploads": [
+    "glooey": [
         {
-            "advisory": "django-sticky-uploads 0.2.0 fixes a security issue related to client changing the upload url specified by the widget for the upload.",
-            "cve": "PVE-2021-25793",
-            "id": "pyup.io-25793",
+            "advisory": "Glooey version 0.3.5 includes a security patch for the function 'yaml' in 'glooey/themes/helpers.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/kxgames/glooey/commit/9178939df55a44dcf0a890aec0aceef2f4989947",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41326",
             "specs": [
-                "<0.2.0"
+                "<0.3.5"
             ],
-            "v": "<0.2.0"
+            "v": "<0.3.5"
         }
     ],
-    "django-storages": [
+    "glovo-api-python": [
         {
-            "advisory": "In django-storages before 1.7 - the ``S3BotoStorage`` and ``S3Boto3Storage`` backends have an insecure default ACL of ``public-read``. It is recommended that all current users upgrade to 1.7 and audit their bucket permissions.  Support has been added for setting ``AWS_DEFAULT_ACL = None`` and ``AWS_BUCKET_ACL = None``. V1.7 will raise a warning if ``AWS_DEFAULT_ACL`` or ``AWS_BUCKET_ACL`` is not explicitly set.",
-            "cve": "PVE-2021-36434",
-            "id": "pyup.io-36434",
+            "advisory": "Glovo-api-python 2.0.0 updates its dependencies to remove the insecure ones.",
+            "cve": "PVE-2021-38427",
+            "id": "pyup.io-38427",
             "specs": [
-                "<1.7"
+                "<2.0.0"
             ],
-            "v": "<1.7"
+            "v": "<2.0.0"
         }
     ],
-    "django-tastypie": [
+    "gns3-gui": [
         {
-            "advisory": "The from_yaml method in serializers.py in Django Tastypie before 0.9.10 does not properly deserialize YAML data, which allows remote attackers to execute arbitrary Python code via vectors related to the yaml.load method.",
-            "cve": "CVE-2011-4104",
-            "id": "pyup.io-25794",
+            "advisory": "gns3-gui 1.5.1 fixes a security related bug to prevent client to send empty hostname.",
+            "cve": "PVE-2021-25839",
+            "id": "pyup.io-25839",
             "specs": [
-                "<0.9.10"
+                "<1.5.1"
             ],
-            "v": "<0.9.10"
+            "v": "<1.5.1"
         }
     ],
-    "django-trench": [
+    "gns3-server": [
         {
-            "advisory": "Django-trench 0.2.3 updates default backup codes settings to a more secure standard.\r\nhttps://github.com/merixstudio/django-trench/pull/52",
-            "cve": "PVE-2021-42899",
-            "id": "pyup.io-42899",
+            "advisory": "GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-file errors by printing the configuration file while executing in a setuid root context.",
+            "cve": "CVE-2020-14976",
+            "id": "pyup.io-42277",
             "specs": [
-                "<0.2.3"
+                "<2.1.17"
             ],
-            "v": "<0.2.3"
+            "v": "<2.1.17"
         }
     ],
-    "django-triggers": [
+    "gnupg": [
         {
-            "advisory": "Django-triggers 2.0.13 updates its dependency 'Django' to v2.1.5 to include security fixes.",
-            "cve": "CVE-2018-7537",
-            "id": "pyup.io-37072",
+            "advisory": "python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.",
+            "cve": "CVE-2013-7323",
+            "id": "pyup.io-35493",
             "specs": [
-                "<2.0.13"
+                "<0.3.5"
             ],
-            "v": "<2.0.13"
+            "v": "<0.3.5"
         },
         {
-            "advisory": "Django-triggers 2.0.13 updates its dependency 'Django' to v2.1.5 to include security fixes.",
-            "cve": "CVE-2020-9402",
-            "id": "pyup.io-43667",
+            "advisory": "The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using \"\\\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.",
+            "cve": "CVE-2014-1928",
+            "id": "pyup.io-35534",
             "specs": [
-                "<2.0.13"
+                "==0.3.5"
             ],
-            "v": "<2.0.13"
+            "v": "==0.3.5"
         },
         {
-            "advisory": "Django-triggers 2.0.13 updates its dependency 'Django' to v2.1.5 to include security fixes.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-43669",
+            "advisory": "The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using \"$(\" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.",
+            "cve": "CVE-2014-1927",
+            "id": "pyup.io-35533",
             "specs": [
-                "<2.0.13"
+                "==0.3.5"
             ],
-            "v": "<2.0.13"
+            "v": "==0.3.5"
         },
         {
-            "advisory": "Django-triggers 2.0.13 updates its dependency 'Django' to v2.1.5 to include security fixes.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-43668",
+            "advisory": "python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to \"option injection through positional arguments.\" NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.",
+            "cve": "CVE-2014-1929",
+            "id": "pyup.io-35535",
             "specs": [
-                "<2.0.13"
+                "==0.3.5",
+                "==0.3.6"
             ],
-            "v": "<2.0.13"
+            "v": "==0.3.5,==0.3.6"
         }
     ],
-    "django-two-factor-auth": [
+    "gocept.month": [
         {
-            "advisory": "Django Two-Factor Authentication before 1.12, stores the user's password in clear text in the user session (base64-encoded). The password is stored in the session when the user submits their username and password, and is removed once they complete authentication by entering a two-factor authentication code. This means that the password is stored in clear text in the session for an arbitrary amount of time, and potentially forever if the user begins the login process by entering their username and password and then leaves before entering their two-factor authentication code. The severity of this issue depends on which type of session storage you have configured: in the worst case, if you're using Django's default database session storage, then users' passwords are stored in clear text in your database. In the best case, if you're using Django's signed cookie session, then users' passwords are only stored in clear text within their browser's cookie store. In the common case of using Django's cache session store, the users' passwords are stored in clear text in whatever cache storage you have configured (typically Memcached or Redis). This has been fixed in 1.12. After upgrading, users should be sure to delete any clear text passwords that have been stored. For example, if you're using the database session backend, you'll likely want to delete any session record from the database and purge that data from any database backups or replicas. In addition, affected organizations who have suffered a database breach while using an affected version should inform their users that their clear text passwords have been compromised. All organizations should encourage users whose passwords were insecurely stored to change these passwords on any sites where they were used. As a workaround, wwitching Django's session storage to use signed cookies instead of the database or cache lessens the impact of this issue, but should not be done without a thorough understanding of the security tradeoffs of using signed cookies rather than a server-side session storage. There is no way to fully mitigate the issue without upgrading. See: CVE-2020-15105.",
-            "cve": "CVE-2020-15105",
-            "id": "pyup.io-38562",
+            "advisory": "Gocept.month 2.2 adds a missing security declaration needed for the '.browser.widget.MonthWidget', the month widget for 'z3c.form'.",
+            "cve": "PVE-2021-40231",
+            "id": "pyup.io-40231",
             "specs": [
-                "<1.12"
+                "<2.2"
             ],
-            "v": "<1.12"
+            "v": "<2.2"
         }
     ],
-    "django-ucamlookup": [
+    "goharbor": [
         {
-            "advisory": "django-ucamlookup 1.9 fixes XXS vulnerability in template macros",
-            "cve": "PVE-2021-36744",
-            "id": "pyup.io-36744",
+            "advisory": "goharbor 1.1.0 fixes some security issues in token service.",
+            "cve": "PVE-2021-36776",
+            "id": "pyup.io-36776",
             "specs": [
-                "<1.9"
+                "<1.1.0"
             ],
-            "v": "<1.9"
+            "v": "<1.1.0"
         }
     ],
-    "django-uni-form": [
+    "google-appengine": [
         {
-            "advisory": "Django-uni-form 0.9.0 fixes a XSS security issue. Errors weren't rendered safe: field's input was part of the error message, unsanitized.\r\nhttps://github.com/pydanny/django-uni-form/pull/98",
-            "cve": "PVE-2021-25796",
-            "id": "pyup.io-25796",
+            "advisory": "Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the SDK Console (aka Admin Console) in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary Python code via the code parameter.",
+            "cve": "CVE-2011-1364",
+            "id": "pyup.io-33128",
             "specs": [
-                "<0.9.0"
+                "<1.5.4"
             ],
-            "v": "<0.9.0"
-        }
-    ],
-    "django-unicorn": [
+            "v": "<1.5.4"
+        },
         {
-            "advisory": "Django-unicorn version 0.29.0 sanitizes initial JSON to prevent XSS.\r\nhttps://github.com/adamghill/django-unicorn/commit/c38e2a8bbb3ec6a8cdba30813282d9159c90f0d2",
-            "cve": "PVE-2021-42099",
-            "id": "pyup.io-42099",
+            "advisory": "The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWED_MODES and ALLOWED_DIRS changes within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.",
+            "cve": "CVE-2011-4211",
+            "id": "pyup.io-33129",
             "specs": [
-                "<0.29.0"
+                "<1.5.4"
             ],
-            "v": "<0.29.0"
+            "v": "<1.5.4"
         },
         {
-            "advisory": "Django-unicorn version 0.36.0 includes a fix for CVE-2021-42053: The Unicorn framework through 0.35.3 for Django allows XSS via component.name.\r\nhttps://github.com/adamghill/django-unicorn/pull/288/files",
-            "cve": "CVE-2021-42053",
-            "id": "pyup.io-42060",
+            "advisory": "The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a file_blob_storage.os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.",
+            "cve": "CVE-2011-4213",
+            "id": "pyup.io-33131",
             "specs": [
-                "<0.36.0"
+                "<1.5.4"
             ],
-            "v": "<0.36.0"
+            "v": "<1.5.4"
         },
         {
-            "advisory": "The Unicorn framework before 0.36.1 for Django allows XSS via a component. NOTE: this issue exists because of an incomplete fix for CVE-2021-42053.\r\nhttps://github.com/adamghill/django-unicorn/commit/3a832a9e3f6455ddd3b87f646247269918ad10c6\r\nhttps://github.com/adamghill/django-unicorn/compare/0.36.0...0.36.1",
-            "cve": "CVE-2021-42134",
-            "id": "pyup.io-42107",
+            "advisory": "The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a dev_appserver.RestrictedPathFunction._original_os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.",
+            "cve": "CVE-2011-4212",
+            "id": "pyup.io-33130",
             "specs": [
-                "<0.36.1"
+                "<1.5.4"
             ],
-            "v": "<0.36.1"
+            "v": "<1.5.4"
         }
     ],
-    "django-urlconf-export": [
+    "google-images-search": [
         {
-            "advisory": "Django-urlconf-export 1.1.1 updates Django to v3.0.7 to include security fixes.",
-            "cve": "CVE-2020-13254",
-            "id": "pyup.io-43660",
+            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-25293",
+            "id": "pyup.io-43482",
             "specs": [
-                "<1.1.1"
+                "<1.3.8"
             ],
-            "v": "<1.1.1"
+            "v": "<1.3.8"
         },
         {
-            "advisory": "Django-urlconf-export 1.1.1 updates Django to v3.0.7 to include security fixes.",
-            "cve": "CVE-2020-13596",
-            "id": "pyup.io-38386",
+            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-25289",
+            "id": "pyup.io-43485",
             "specs": [
-                "<1.1.1"
+                "<1.3.8"
             ],
-            "v": "<1.1.1"
-        }
-    ],
-    "django-user-accounts": [
+            "v": "<1.3.8"
+        },
         {
-            "advisory": "django-user-accounts before 2.0.2 has a potentional security issue with leaking password reset tokens through HTTP Referer header.",
-            "cve": "PVE-2021-34774",
-            "id": "pyup.io-34774",
+            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-40043",
             "specs": [
-                "<2.0.2"
+                "<1.3.8"
             ],
-            "v": "<2.0.2"
-        }
-    ],
-    "django-user-management": [
+            "v": "<1.3.8"
+        },
         {
-            "advisory": "Django-user-management 18.0.0 updates its dependency 'djangorestframework' to a version >=3.9.1 to patch an XSS vulnerability.",
-            "cve": "PVE-2021-43472",
-            "id": "pyup.io-38634",
+            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-43479",
             "specs": [
-                "<18.0.0"
+                "<1.3.8"
             ],
-            "v": "<18.0.0"
+            "v": "<1.3.8"
         },
         {
-            "advisory": "Django-user-management 18.0.0 updates its dependency 'pillow' to a version >3.3.2 to include security fixes.",
-            "cve": "CVE-2016-9189",
-            "id": "pyup.io-43473",
+            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-43480",
             "specs": [
-                "<18.0.0"
+                "<1.3.8"
             ],
-            "v": "<18.0.0"
+            "v": "<1.3.8"
         },
         {
-            "advisory": "Django-user-management 18.0.0 updates its dependency 'pillow' to a version >3.3.2 to include security fixes.",
-            "cve": "CVE-2016-9190",
-            "id": "pyup.io-43474",
+            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-25292",
+            "id": "pyup.io-43481",
             "specs": [
-                "<18.0.0"
+                "<1.3.8"
             ],
-            "v": "<18.0.0"
-        }
-    ],
-    "django-user-sessions": [
+            "v": "<1.3.8"
+        },
         {
-            "advisory": "In Django User Sessions (django-user-sessions) before 1.7.1, the views provided allow users to terminate specific sessions. The session key is used to identify sessions, and thus included in the rendered HTML. In itself this is not a problem. However if the website has an XSS vulnerability, the session key could be extracted by the attacker and a session takeover could happen. See: CVE-2020-5224.",
-            "cve": "CVE-2020-5224",
-            "id": "pyup.io-37777",
+            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-25291",
+            "id": "pyup.io-43483",
             "specs": [
-                "<1.7.1"
+                "<1.3.8"
             ],
-            "v": "<1.7.1"
-        }
-    ],
-    "django-watchman": [
+            "v": "<1.3.8"
+        },
         {
-            "advisory": "django-watchman  0.10.0 improves security by keeping tokens out of logs.",
-            "cve": "PVE-2021-25797",
-            "id": "pyup.io-25797",
+            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-25290",
+            "id": "pyup.io-43484",
             "specs": [
-                "<0.10.0"
+                "<1.3.8"
             ],
-            "v": "<0.10.0"
+            "v": "<1.3.8"
         }
     ],
-    "django-widgy": [
+    "gordo-components": [
         {
-            "advisory": "Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the component 'Change Widgy Page' (https://github.com/fusionbox/django-widgy/issues/387). See CVE-2020-18704.",
-            "cve": "CVE-2020-18704",
-            "id": "pyup.io-41185",
+            "advisory": "Gordo-components 0.15.1 includes a fix for CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-37545",
             "specs": [
-                "==0.8.4"
+                "<0.15.1"
             ],
-            "v": "==0.8.4"
+            "v": "<0.15.1"
         }
     ],
-    "django-x509": [
+    "gphotos-sync": [
         {
-            "advisory": "Django-x509 0.9.1 updates the minimum version of 'cryptography' to 3.2 for security reasons.",
-            "cve": "CVE-2020-25659",
-            "id": "pyup.io-39116",
+            "advisory": "gphotos-sync 2.9 update dependencies for security patches",
+            "cve": "PVE-2021-37829",
+            "id": "pyup.io-37829",
             "specs": [
-                "<0.9.1"
+                "<2.9"
             ],
-            "v": "<0.9.1"
+            "v": "<2.9"
         }
     ],
-    "djangocms-admin-style": [
+    "gpmf": [
         {
-            "advisory": "djangocms-admin-style 1.2.5 fixes a potential security issue if the ``Site.name`` field contains malicious code.",
-            "cve": "PVE-2021-36834",
-            "id": "pyup.io-36834",
+            "advisory": "Gpmf 1.2.2 addresses OOB attacks.",
+            "cve": "PVE-2021-38566",
+            "id": "pyup.io-38566",
             "specs": [
-                "<1.2.5"
+                "<1.2.2"
             ],
-            "v": "<1.2.5"
+            "v": "<1.2.2"
         }
     ],
-    "djangocms-highlightjs": [
+    "gps-time": [
         {
-            "advisory": "djangocms-highlightjs before 0.3.1 has a unspecified security issue and is vulnerable via unknown vectors.",
-            "cve": "PVE-2021-25798",
-            "id": "pyup.io-25798",
+            "advisory": "Gps-time 2.8.6 updates its dependency 'nokogiri' to v1.11.0 to include a security fix.",
+            "cve": "CVE-2020-26247",
+            "id": "pyup.io-43743",
             "specs": [
-                "<0.3.1"
+                "<2.8.6"
             ],
-            "v": "<0.3.1"
+            "v": "<2.8.6"
+        },
+        {
+            "advisory": "Gps-time 2.8.6 updates its dependency 'kramdown' to v2.3.1 to include a security fix.",
+            "cve": "CVE-2021-28834",
+            "id": "pyup.io-43739",
+            "specs": [
+                "<2.8.6"
+            ],
+            "v": "<2.8.6"
         }
     ],
-    "djangorestframework": [
+    "gradio": [
         {
-            "advisory": "djangorestframework 2.2.1 fixes a security issue: Use `defusedxml` package to address XML parsing vulnerabilities.",
-            "cve": "PVE-2021-25799",
-            "id": "pyup.io-25799",
+            "advisory": "Gradio 2.6.0 fixes arbitrary file reading vulnerabilities.\r\nhttps://github.com/gradio-app/gradio/pull/406",
+            "cve": "PVE-2021-43619",
+            "id": "pyup.io-43619",
             "specs": [
-                "<2.2.1"
+                "<2.6.0"
             ],
-            "v": "<2.2.1"
-        },
+            "v": "<2.6.0"
+        }
+    ],
+    "grafana-dashboard-builder": [
         {
-            "advisory": "djangorestframework 2.3.12 fixes a security issue: `OrderingField` now only allows ordering on readable serializer fields, or on fields explicitly specified using `ordering_fields`. This prevents users being able to order by fields that are not visible in the API, and exploiting the ordering of sensitive data such as password hashes.",
-            "cve": "PVE-2021-25800",
-            "id": "pyup.io-25800",
+            "advisory": "Grafana-dashboard-builder 0.6.0a1 fixes a pyyaml security issue.",
+            "cve": "PVE-2021-38648",
+            "id": "pyup.io-38648",
             "specs": [
-                "<2.3.12"
+                "<0.6.0a1"
             ],
-            "v": "<2.3.12"
-        },
+            "v": "<0.6.0a1"
+        }
+    ],
+    "graph-notebook": [
         {
-            "advisory": "djangorestframework 2.3.14 fixes a security issue: Escape request path when it is include as part of the login and logout links in the browsable API.",
-            "cve": "PVE-2021-25801",
-            "id": "pyup.io-25801",
+            "advisory": "Graph-notebook 3.0.5 includes an upgrade of a Jupyter Notebook dependency for a security fix. \r\nhttps://github.com/aws/graph-notebook/pull/182",
+            "cve": "PVE-2021-41231",
+            "id": "pyup.io-41231",
             "specs": [
-                "<2.3.14"
+                "<3.0.5"
             ],
-            "v": "<2.3.14"
-        },
+            "v": "<3.0.5"
+        }
+    ],
+    "graphite-web": [
         {
-            "advisory": "djangorestframework 2.4.4 fixes a security issue: Escape URLs when replacing `format=` query parameter, as used in dropdown on `GET` button in browsable API to allow explicit selection of JSON vs HTML output.",
-            "cve": "PVE-2021-25802",
-            "id": "pyup.io-25802",
+            "advisory": "Graphite-web 1.1.8 prevents cross-site scripting.",
+            "cve": "PVE-2021-40227",
+            "id": "pyup.io-40227",
             "specs": [
-                "<2.4.4"
+                "<1.1.8"
             ],
-            "v": "<2.4.4"
-        },
+            "v": "<1.1.8"
+        }
+    ],
+    "graphrepo": [
         {
-            "advisory": "djangorestframework  2.4.5 fixes a security issue: Escape tab switching cookie name in browsable API. [Backported from 3.1.1]",
-            "cve": "PVE-2021-25803",
-            "id": "pyup.io-25803",
+            "advisory": "Graphrepo 0.1.8 updates some dependencies in order to avoid security vulnerabilities.",
+            "cve": "PVE-2021-38421",
+            "id": "pyup.io-38421",
             "specs": [
-                "<2.4.5"
+                "<0.1.8"
             ],
-            "v": "<2.4.5"
-        },
+            "v": "<0.1.8"
+        }
+    ],
+    "graphscope": [
         {
-            "advisory": "djangorestframework 3.1.1 fixes a security issue: : Escape tab switching cookie name in browsable API.",
-            "cve": "PVE-2021-25804",
-            "id": "pyup.io-25804",
+            "advisory": "Graphscope 0.7.0 updates its dependency 'Junit4' to v4.13.2 to include a security fix.",
+            "cve": "CVE-2020-15250",
+            "id": "pyup.io-42562",
             "specs": [
-                "<3.1.1"
+                "<0.7.0"
             ],
-            "v": "<3.1.1"
+            "v": "<0.7.0"
         },
         {
-            "advisory": "A flaw was found in Django REST Framework versions before 3.12.0 and before 3.11.2. When using the browseable API viewer, Django REST Framework fails to properly escape certain strings that can come from user input. This allows a user who can control those strings to inject malicious <script> tags, leading to a cross-site-scripting (XSS) vulnerability. See: CVE-2020-25626.",
-            "cve": "CVE-2020-25626",
-            "id": "pyup.io-38841",
+            "advisory": "Graphscope 0.7.0 updates its dependency 'Apache Commons IO' to v2.7 to include a security fix.",
+            "cve": "CVE-2021-29425",
+            "id": "pyup.io-42560",
             "specs": [
-                "<3.11.2"
+                "<0.7.0"
             ],
-            "v": "<3.11.2"
+            "v": "<0.7.0"
         },
         {
-            "advisory": "Djangorestframework 3.9.1 includes a fix for an XSS vulnerability.\r\nhttps://github.com/encode/django-rest-framework/commit/4bb9a3c48427867ef1e46f7dee945a4c25a4f9b8",
-            "cve": "PVE-2021-43472",
-            "id": "pyup.io-43472",
+            "advisory": "Graphscope 0.7.0 updates its dependency 'SLF4J' to v1.7.31 to include a security fix.",
+            "cve": "CVE-2018-8088",
+            "id": "pyup.io-42561",
             "specs": [
-                "<3.9.1"
+                "<0.7.0"
             ],
-            "v": "<3.9.1"
+            "v": "<0.7.0"
         }
     ],
-    "djangorestframework-api-key": [
+    "graphtransliterator": [
         {
-            "advisory": "djangorestframework-api-key before 0.2.0 the API key was stored in plaintext in database.",
-            "cve": "PVE-2021-36524",
-            "id": "pyup.io-36524",
+            "advisory": "Graphtransliterator 1.1.2 includes security updates. No details were given.",
+            "cve": "PVE-2021-38234",
+            "id": "pyup.io-38234",
             "specs": [
-                "<0.2.0"
+                "<1.1.2"
             ],
-            "v": "<0.2.0"
+            "v": "<1.1.2"
         }
     ],
-    "djangorestframework-simplejwt": [
+    "great-components": [
         {
-            "advisory": "djangorestframework-simplejwt before 1.5 allowed `__getattr__` access to the underlying JWT through the `rest_framework_simplejwt.module.TokenUser` class.",
-            "cve": "PVE-2021-34792",
-            "id": "pyup.io-34792",
+            "advisory": "great-components 25.0.1 updates lodash vulnerability",
+            "cve": "PVE-2021-37925",
+            "id": "pyup.io-37925",
             "specs": [
-                "<1.5"
+                "<25.0.1"
             ],
-            "v": "<1.5"
+            "v": "<25.0.1"
         }
     ],
-    "djangosaml2": [
-        {
-            "advisory": "djangosaml2 0.17.2 upgrades the pysaml2 dependency to version 4.6.0 which fixes a security issue.",
-            "cve": "PVE-2021-36423",
-            "id": "pyup.io-36423",
-            "specs": [
-                "<0.17.2"
-            ],
-            "v": "<0.17.2"
-        },
-        {
-            "advisory": "Djangosaml2 1.0.1 includes a security update for the PySAML2 dependency.",
-            "cve": "CVE-2021-21239",
-            "id": "pyup.io-43661",
-            "specs": [
-                "<1.0.1"
-            ],
-            "v": "<1.0.1"
-        },
+    "gseapy": [
         {
-            "advisory": "Djangosaml2 1.0.1 includes a security update for the PySAML2 dependency.",
-            "cve": "CVE-2021-21238",
-            "id": "pyup.io-39535",
+            "advisory": "Gseapy 0.10.5 fixes 'InsecureRequestWarning'.",
+            "cve": "PVE-2021-41066",
+            "id": "pyup.io-41066",
             "specs": [
-                "<1.0.1"
+                "<0.10.5"
             ],
-            "v": "<1.0.1"
+            "v": "<0.10.5"
         }
     ],
-    "djblets": [
+    "gsutil": [
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in util/templatetags/djblets_js.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django, as used in Review Board, allows remote attackers to inject arbitrary web script or HTML via a JSON object, as demonstrated by the name field when changing a user name.",
-            "cve": "CVE-2014-3994",
-            "id": "pyup.io-35571",
+            "advisory": "Gsutil 3.41 includes changes to protect the security of resumable upload IDs.\r\nhttps://github.com/GoogleCloudPlatform/gsutil/commit/43cf0087b97c889d8e3eca67499ac2e887a6726a",
+            "cve": "PVE-2021-27541",
+            "id": "pyup.io-27541",
             "specs": [
-                "<0.8.3"
+                "<3.41"
             ],
-            "v": "<0.8.3"
+            "v": "<3.41"
         },
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in gravatars/templatetags/gravatars.py in Djblets before 0.7.30 and 0.8.x before 0.8.3 for Django allows remote attackers to inject arbitrary web script or HTML via a user display name.",
-            "cve": "CVE-2014-3995",
-            "id": "pyup.io-35572",
+            "advisory": "Gsutil 5.0 drops support for Python 2 to patch RSA security issues.",
+            "cve": "PVE-2021-41771",
+            "id": "pyup.io-41771",
             "specs": [
-                "<0.8.3"
+                "<5.0"
             ],
-            "v": "<0.8.3"
+            "v": "<5.0"
         },
         {
-            "advisory": "An eval() vulnerability exists in Python Software Foundation Djblets 0.7.21 and Beanbag Review Board before 1.7.15 when parsing JSON requests. See: CVE-2013-4409.",
-            "cve": "CVE-2013-4409",
-            "id": "pyup.io-37636",
+            "advisory": "Gsutil 5.2 drops support for Python 2 to patch RSA security issues.",
+            "cve": "PVE-2021-41871",
+            "id": "pyup.io-41871",
             "specs": [
-                "==0.7.21"
+                "<5.2"
             ],
-            "v": "==0.7.21"
+            "v": "<5.2"
         }
     ],
-    "djedefre": [
+    "guillotina": [
         {
-            "advisory": "djedefre 0.7.0 fixes a security bug in \"djoser.views.UserView\"",
-            "cve": "PVE-2021-37913",
-            "id": "pyup.io-37913",
+            "advisory": "guillotina 4.5.8 fixes memory leak in security policy lookups",
+            "cve": "PVE-2021-36961",
+            "id": "pyup.io-36961",
             "specs": [
-                "<0.7.0"
+                "<4.5.8"
             ],
-            "v": "<0.7.0"
+            "v": "<4.5.8"
         },
         {
-            "advisory": "djedefre 1.3.2 fixes vulnerability of user endpoints.",
-            "cve": "PVE-2021-37912",
-            "id": "pyup.io-37912",
+            "advisory": "Guillotina 6.0.0b3 fixes a security policy not taking into account IInheritPermissionMap for principals.",
+            "cve": "PVE-2021-38203",
+            "id": "pyup.io-38203",
             "specs": [
-                "<1.3.2"
+                "<6.0.0b3"
             ],
-            "v": "<1.3.2"
+            "v": "<6.0.0b3"
         },
         {
-            "advisory": "djedefre 1.5.1 fixes a vulnerability of UserViewSet that allows to create new accounts on wrong endpoint",
-            "cve": "PVE-2021-37911",
-            "id": "pyup.io-37911",
+            "advisory": "Guillotina 6.2.3 improves security checking for the search in PostgreSQL catalog.",
+            "cve": "PVE-2021-40178",
+            "id": "pyup.io-40178",
             "specs": [
-                "<1.5.1"
+                "<6.2.3"
             ],
-            "v": "<1.5.1"
+            "v": "<6.2.3"
         }
     ],
-    "djem": [
+    "guillotina-dynamictablestorage": [
         {
-            "advisory": "Djem version 0.6 adds CSRF tokens to outgoing AJAX requests.",
-            "cve": "PVE-2021-42044",
-            "id": "pyup.io-42044",
+            "advisory": "guillotina-dynamictablestorage 1.1.0 fixes a possible sql injection.",
+            "cve": "PVE-2021-40218",
+            "id": "pyup.io-40218",
             "specs": [
-                "<0.6"
+                "<1.1.0"
             ],
-            "v": "<0.6"
+            "v": "<1.1.0"
         }
     ],
-    "djoser": [
+    "gunicorn": [
         {
-            "advisory": "djoser 0.7.0 fixes a security bug in djoser.views.UserView. (Missing more information)",
-            "cve": "PVE-2021-34904",
-            "id": "pyup.io-34904",
+            "advisory": "Gunicorn 19.10.0 includes a security fix to prevent HTTP desync attack.",
+            "cve": "PVE-2021-40105",
+            "id": "pyup.io-40105",
             "specs": [
-                "<0.7.0"
+                "<19.10.0"
             ],
-            "v": "<0.7.0"
+            "v": "<19.10.0"
         },
         {
-            "advisory": "djoser 1.3.2 fixes vulnerability of user endpoints.",
-            "cve": "PVE-2021-36711",
-            "id": "pyup.io-36711",
+            "advisory": "Gunicorn 20.0.1 fixes chunked encoding support to prevent any request smuggling for security purposes.",
+            "cve": "PVE-2021-40104",
+            "id": "pyup.io-40104",
             "specs": [
-                "<1.3.2"
+                "<19.10.0",
+                ">=20.0.0,<20.0.1"
             ],
-            "v": "<1.3.2"
+            "v": "<19.10.0,>=20.0.0,<20.0.1"
         },
         {
-            "advisory": "djoser 1.5.1 fixes a vulnerability of UserViewSet that allowed to create new accounts on wrong endpoint.",
-            "cve": "PVE-2021-37010",
-            "id": "pyup.io-37010",
+            "advisory": "Gunicorn 19.4.0 includes a security fix to raise 'InvalidRequestLine' exception when the line contains malicious data.",
+            "cve": "PVE-2021-40103",
+            "id": "pyup.io-40103",
             "specs": [
-                "<1.5.1"
+                "<19.4.0"
             ],
-            "v": "<1.5.1"
+            "v": "<19.4.0"
         }
     ],
-    "dlhub-gateway": [
+    "gvar": [
         {
-            "advisory": "Dlhub-gateway 2.0.0 fixes security requirements in the swagger spec.",
-            "cve": "PVE-2021-37339",
-            "id": "pyup.io-37339",
+            "advisory": "Gvar 9.2.1 fixes bugs in gvar.load and gvar.dump caused by recent security upgrades to pyYAML.",
+            "cve": "PVE-2021-37809",
+            "id": "pyup.io-37809",
             "specs": [
-                "<2.0.0"
+                "<9.2.1"
             ],
-            "v": "<2.0.0"
+            "v": "<9.2.1"
         }
     ],
-    "dmoj": [
+    "h2o": [
         {
-            "advisory": "Dmoj 1.4.0 includes a number of enhancements and security fixes.",
-            "cve": "PVE-2021-37474",
-            "id": "pyup.io-37474",
+            "advisory": "H2o 3.34.0.7 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/h2oai/h2o-3/commit/85dc8a3fdbfef002919d15764b1ad99b3c39f851",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43397",
             "specs": [
-                "<1.4.0"
+                "<3.34.0.7"
             ],
-            "v": "<1.4.0"
+            "v": "<3.34.0.7"
         },
         {
-            "advisory": "ANSI HTML-ifying has been moved to the site in dmoj 2.0.0 in order to prevent judges from potentially executing HTML injection attacks.",
-            "cve": "PVE-2021-38276",
-            "id": "pyup.io-38276",
+            "advisory": "H2o 3.34.0.7 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/h2oai/h2o-3/commit/85dc8a3fdbfef002919d15764b1ad99b3c39f851",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-43439",
             "specs": [
-                "<2.0.0"
+                "<3.34.0.7"
             ],
-            "v": "<2.0.0"
+            "v": "<3.34.0.7"
         },
         {
-            "advisory": "Dmoj 3.0.1 includes two security fixes:\r\n-Wraps JVM-based executors in cptbox rather than relying only on security policies.\r\n-Patches \"int(...)\" to avoid DOS attacks in custom checkers.",
-            "cve": "PVE-2021-41295",
-            "id": "pyup.io-41295",
-            "specs": [
-                "<3.0.1"
-            ],
-            "v": "<3.0.1"
-        }
-    ],
-    "dnsimple": [
-        {
-            "advisory": "Dnsimple 2.1.2 updates its dependency 'pytest' to v6.2.4 to include security fixes.",
-            "cve": "PVE-2021-43015",
-            "id": "pyup.io-43015",
+            "advisory": "H2o 3.34.0.7 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/h2oai/h2o-3/commit/85dc8a3fdbfef002919d15764b1ad99b3c39f851",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43398",
             "specs": [
-                "<2.1.2"
+                "<3.34.0.7"
             ],
-            "v": "<2.1.2"
+            "v": "<3.34.0.7"
         },
         {
-            "advisory": "The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.",
-            "cve": "CVE-2021-28363",
-            "id": "pyup.io-40425",
+            "advisory": "H2o 3.36.0.1 updates its dependency 'log4j' to v2.17.1 to fix a medium severity vulnerability.\r\nhttps://github.com/h2oai/h2o-3/commit/fc062c08bb35146dcb6b8f156fb851051543dd7c",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44451",
             "specs": [
-                "<2.1.2"
+                "<3.36.0.1"
             ],
-            "v": "<2.1.2"
+            "v": "<3.36.0.1"
         }
     ],
-    "dnsupdate": [
+    "hail": [
         {
-            "advisory": "Dnsupdate version 0.4 includes a security patch for the function '_load_cache' in 'dnsupdate.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/lopsided98/dnsupdate/commit/f708d0b6c7340334199b3a91bdbb626b5da09633#diff-bbb8416d14c72839288c2df5695624f5b1810a9fb4d94ab83750725cddfda472",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41318",
+            "advisory": "Hail 0.2.80 updates dependencies related to 'log4j' to fix critical and severe vulnerabilities.\r\nhttps://github.com/hail-is/hail/commit/1ad3b9822d4f2d77442d6da93ea4d9ca87796d22",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43597",
             "specs": [
-                "<0.4"
+                "<0.2.80"
             ],
-            "v": "<0.4"
-        }
-    ],
-    "docassemble": [
+            "v": "<0.2.80"
+        },
         {
-            "advisory": "Docassemble 0.3.35 includes a more robust code injection detection mechanism.",
-            "cve": "PVE-2021-38925",
-            "id": "pyup.io-38925",
+            "advisory": "Hail 0.2.80 updates dependencies related to 'log4j' to fix critical and severe vulnerabilities.\r\nhttps://github.com/hail-is/hail/commit/1ad3b9822d4f2d77442d6da93ea4d9ca87796d22",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43598",
             "specs": [
-                "<0.3.35"
+                "<0.2.80"
             ],
-            "v": "<0.3.35"
+            "v": "<0.2.80"
         },
         {
-            "advisory": "Docassemble 0.5.105 upgrades 'bleach' due to security vulnerability",
-            "cve": "PVE-2021-37941",
-            "id": "pyup.io-37941",
+            "advisory": "Hail 0.2.81 updates dependencies related to 'log4j' to fix critical and severe vulnerabilities.\r\nhttps://github.com/hail-is/hail/commit/1ad3b9822d4f2d77442d6da93ea4d9ca87796d22",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-43599",
             "specs": [
-                "<0.5.105"
+                "<0.2.81"
             ],
-            "v": "<0.5.105"
+            "v": "<0.2.81"
         },
         {
-            "advisory": "Docassemble 1.0.12 includes an important fix for a security vulnerability.",
-            "cve": "PVE-2021-40418",
-            "id": "pyup.io-40418",
+            "advisory": "Hail 0.2.81 and prior uses a Debian image affected by a medium severity vulnerability.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44460",
             "specs": [
-                "<1.0.12"
+                "<=0.2.81"
             ],
-            "v": "<1.0.12"
-        },
+            "v": "<=0.2.81"
+        }
+    ],
+    "handprint": [
         {
-            "advisory": "Docassemble 1.1.113 includes an important fix for a security vulnerability.",
-            "cve": "PVE-2021-40417",
-            "id": "pyup.io-40417",
+            "advisory": "Handprint 1.5.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
+            "cve": "CVE-2020-26137",
+            "id": "pyup.io-40823",
             "specs": [
-                "<1.1.113"
+                "<1.5.0"
             ],
-            "v": "<1.1.113"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Docassemble 1.2.65 includes a fix for an important security vulnerability.",
-            "cve": "PVE-2021-40397",
-            "id": "pyup.io-40397",
+            "advisory": "Handprint 1.5.0 updates the underlying 'urllib3' library to v1.26.5 to include security fixes.",
+            "cve": "CVE-2020-7212",
+            "id": "pyup.io-43016",
             "specs": [
-                "<1.2.65"
+                "<1.5.0"
             ],
-            "v": "<1.2.65"
+            "v": "<1.5.0"
         }
     ],
-    "doccano": [
+    "hardline": [
         {
-            "advisory": "Doccano 1.0.1 adds X-Frame-Options header to prevent clickjacking.",
-            "cve": "PVE-2021-42228",
-            "id": "pyup.io-42228",
+            "advisory": "Hardline 0.12 contains privacy enchantments for hashID domain names.",
+            "cve": "PVE-2021-39435",
+            "id": "pyup.io-39435",
             "specs": [
-                "<1.0.1"
+                "<0.12"
             ],
-            "v": "<1.0.1"
+            "v": "<0.12"
         },
         {
-            "advisory": "Doccano 1.0.3updates nginx.conf to enhance security.",
-            "cve": "PVE-2021-39243",
-            "id": "pyup.io-39243",
+            "advisory": "Hardline 0.13 uses rolling-code to slightly deter certain fingerprinting attacks on networks with strong client isolation.",
+            "cve": "PVE-2021-40590",
+            "id": "pyup.io-40590",
             "specs": [
-                "<1.0.3"
+                "<0.13"
             ],
-            "v": "<1.0.3"
+            "v": "<0.13"
         }
     ],
-    "docker": [
+    "hashers": [
         {
-            "advisory": "docker 3.5.1 bumps version of `pyOpenSSL` in `requirements.txt` and `setup.py` to prevent\r\n  installation of a vulnerable version.",
-            "cve": "PVE-2021-36783",
-            "id": "pyup.io-36783",
+            "advisory": "Hashers 0.2.11 adds protection against time-attacks on string comparisons.",
+            "cve": "PVE-2021-39643",
+            "id": "pyup.io-39643",
             "specs": [
-                "<3.5.1"
+                "<0.2.11"
             ],
-            "v": "<3.5.1"
+            "v": "<0.2.11"
         }
     ],
-    "docker-registry": [
+    "hassmart-homeassistant": [
         {
-            "advisory": "docker-registry 0.8.1 has security fixes (path traversing prevention and token validation).",
-            "cve": "PVE-2021-25805",
-            "id": "pyup.io-25805",
+            "advisory": "Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.",
+            "cve": "CVE-2018-21019",
+            "id": "pyup.io-42256",
             "specs": [
-                "<0.8.1"
+                "<0.67.0"
             ],
-            "v": "<0.8.1"
+            "v": "<0.67.0"
         }
     ],
-    "docutils-glep": [
+    "heedy": [
         {
-            "advisory": "Docutils-glep version 1.2 includes a security patch for the function 'parse' in 'docutils_glep/reader.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/mgorny/docutils-glep/commit/d407ea56b1b91a0ac2450fe13306a0be8cffce41",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41319",
+            "advisory": "Heedy 0.3.0a1 reports it its changelog: There might [...] be security issues. Use at your own risk.",
+            "cve": "PVE-2021-37687",
+            "id": "pyup.io-37687",
             "specs": [
-                "<1.2"
+                "<0.3.0a1"
             ],
-            "v": "<1.2"
+            "v": "<0.3.0a1"
         }
     ],
-    "dogtag-pki": [
+    "henosis": [
         {
-            "advisory": "In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1. See: CVE-2020-15720.",
-            "cve": "CVE-2020-15720",
-            "id": "pyup.io-38574",
+            "advisory": "henosis before 0.0.11 included a vulnerability that was opened by using `yaml.load` as opposed to `yaml.safe_load` ([issue 22](https://github.com/vc1492a/henosis/issues/22)).",
+            "cve": "PVE-2021-36303",
+            "id": "pyup.io-36303",
             "specs": [
-                "<=10.8.3"
+                "<0.0.11"
             ],
-            "v": "<=10.8.3"
+            "v": "<0.0.11"
         }
     ],
-    "domonic": [
+    "hhpy": [
         {
-            "advisory": "Domonic 0.2.17 includes a security fix pushed by the 'Dependabot'.",
-            "cve": "PVE-2021-40325",
-            "id": "pyup.io-40325",
+            "advisory": "Hhpy 0.1.8 includes an upgrade of bleach for security reasons.",
+            "cve": "PVE-2021-38480",
+            "id": "pyup.io-38480",
             "specs": [
-                "<0.2.17"
+                "<0.1.8"
             ],
-            "v": "<0.2.17"
+            "v": "<0.1.8"
         }
     ],
-    "donfig": [
+    "hisock": [
         {
-            "advisory": "An issue was discovered in Donfig 0.3.0. There is a vulnerability in the collect_yaml method in config_obj.py. It can execute arbitrary Python commands, resulting in command execution.",
-            "cve": "CVE-2019-7537",
-            "id": "pyup.io-36976",
+            "advisory": "Hisock 1.0 updates its dependency 'cryptography' to v35.0.0 to include security patches.",
+            "cve": "PVE-2021-42144",
+            "id": "pyup.io-42144",
             "specs": [
-                "==0.3.0"
+                "<1.0"
             ],
-            "v": "==0.3.0"
+            "v": "<1.0"
         }
     ],
-    "dosma": [
+    "hivemind": [
         {
-            "advisory": "Dosma version 0.0.13 includes a security patch for the function 'init' in 'dosma/defaults.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/ad12/DOSMA/commit/44457025faac9f09ac0bd26c93185adc612da7dc#",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41320",
+            "advisory": "Hivemind 0.9.5 includes fixes for several known bugs and security vulnerabilities.",
+            "cve": "PVE-2021-40150",
+            "id": "pyup.io-40150",
             "specs": [
-                "<0.0.13"
+                "<0.9.5"
             ],
-            "v": "<0.0.13"
+            "v": "<0.9.5"
         }
     ],
-    "dpaste": [
+    "hkjournalist": [
         {
-            "advisory": "Dpaste 2.8 fixes a XSS bug where HTML tags were not properly escaped with the simple  \"code\" lexer.\r\nhttps://github.com/bartTC/dpaste/commit/497e5f0c28d575b3e92ef65b70384314a9e330da",
-            "cve": "PVE-2021-25807",
-            "id": "pyup.io-25807",
+            "advisory": "Hkjournalist version 0.0.8 includes a security patch for the function 'report' in 'hkjournalist/journalist.py'. It contained an OS injection vulnerability: subprocess call with shell=True.\r\nhttps://github.com/li-xin-yi/HK-journalist/commit/ec95050b13fed27f77ac3ab7ecbc7b1f27f50921",
+            "cve": "PVE-2021-41327",
+            "id": "pyup.io-41327",
             "specs": [
-                "<2.8"
+                "<0.0.8"
             ],
-            "v": "<2.8"
+            "v": "<0.0.8"
         }
     ],
-    "dplib": [
+    "holepunch": [
         {
-            "advisory": "dplib 1.4 fixes some security issues and added support for mapchange and namechange events",
-            "cve": "PVE-2021-35851",
-            "id": "pyup.io-35851",
+            "advisory": "Holepunch 1.0.0 drops support for Python 2 and 3 < 3.6. These versions are not receiving security updates anymore.",
+            "cve": "CVE-2020-27619",
+            "id": "pyup.io-43392",
             "specs": [
-                "<1.4"
+                "<1.0.0"
             ],
-            "v": "<1.4"
-        }
-    ],
-    "dpymenus": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Dpymenus 2.1.5 fixes a security issue in the 'urllib3' dependency for versions prior to 1.26.5.",
-            "cve": "PVE-2021-40583",
-            "id": "pyup.io-40583",
+            "advisory": "Holepunch 1.0.0 drops support for Python 2 and 3 < 3.6. These versions are not receiving security updates anymore.",
+            "cve": "CVE-2020-8492",
+            "id": "pyup.io-43394",
             "specs": [
-                "<2.1.5"
+                "<1.0.0"
             ],
-            "v": "<2.1.5"
-        }
-    ],
-    "draft-kings": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.",
-            "cve": "CVE-2020-26137",
-            "id": "pyup.io-39238",
+            "advisory": "Holepunch 1.0.0 drops support for Python 2 and 3 < 3.6. These versions are not receiving security updates anymore.",
+            "cve": "CVE-2021-3177",
+            "id": "pyup.io-43376",
             "specs": [
-                "<2.0.3"
+                "<1.0.0"
             ],
-            "v": "<2.0.3"
-        }
-    ],
-    "drf-api-logger": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Drf-api-logger 0.0.7 includes the warning that 'allowed hosts protection' is skipped when a RAW_URI value is used for DRF_API_LOGGER_PATH_TYPE. Consequently, an insecure URI may be returned.",
-            "cve": "PVE-2021-39108",
-            "id": "pyup.io-39108",
+            "advisory": "Holepunch 1.0.0 drops support for Python 2 and 3 < 3.6. These versions are not receiving security updates anymore.",
+            "cve": "CVE-2021-3737",
+            "id": "pyup.io-43393",
             "specs": [
-                "<=0.0.7"
+                "<1.0.0"
             ],
-            "v": "<=0.0.7"
+            "v": "<1.0.0"
         }
     ],
-    "drf-extra-fields": [
+    "holocron": [
         {
-            "advisory": "Drf-extra-fields 2.0.0 upgrades Pillow to 6.2.1 to fix a security vulnerability.",
-            "cve": "PVE-2021-38809",
-            "id": "pyup.io-38809",
+            "advisory": "holocron 0.2.0 fixed a security issue when content author may steal private data through content's meta header.",
+            "cve": "PVE-2021-25844",
+            "id": "pyup.io-25844",
             "specs": [
-                "<2.0.0"
+                "<0.2.0"
             ],
-            "v": "<2.0.0"
+            "v": "<0.2.0"
         }
     ],
-    "drf-jwt": [
+    "homeassistant": [
         {
-            "advisory": "An issue was discovered in drf-jwt 1.15.x before 1.15.1. It allows attackers with access to a notionally invalidated token to obtain a new, working token via the refresh endpoint, because the blacklist protection mechanism is incompatible with the token-refresh feature. NOTE: drf-jwt is a fork of jpadilla/django-rest-framework-jwt, which is unmaintained. See: CVE-2020-10594.",
-            "cve": "CVE-2020-10594",
-            "id": "pyup.io-38073",
+            "advisory": "homeassistant before 0.37 uses a weak random number generator to create access tokens for camera feeds which could be brute force attacked in 2.5 weeks",
+            "cve": "PVE-2021-34222",
+            "id": "pyup.io-34222",
             "specs": [
-                ">=1.15.0,<1.15.1"
+                "<0.37"
             ],
-            "v": ">=1.15.0,<1.15.1"
-        }
-    ],
-    "drf-renderer-xlsx": [
+            "v": "<0.37"
+        },
         {
-            "advisory": "Drf-renderer-xlsx 0.4.1 includes proper escaping for possible malicious characters.",
-            "cve": "PVE-2021-42526",
-            "id": "pyup.io-42526",
+            "advisory": "homeassistant before 0.73.2 and >=0.56 is vulnerable to a man in the middle attack since SSL verification was disabled for **outgoing** requests that were done using the shared aiohttp session.",
+            "cve": "PVE-2021-36326",
+            "id": "pyup.io-36326",
             "specs": [
-                "<0.4.1"
+                ">=0.56,<0.73.2"
             ],
-            "v": "<0.4.1"
-        }
-    ],
-    "drf-tracking": [
+            "v": ">=0.56,<0.73.2"
+        },
         {
-            "advisory": "drf-tracking before 1.3.0",
-            "cve": "PVE-2021-34856",
-            "id": "pyup.io-34856",
+            "advisory": "The markdown renderer in homeassistant 0.98 is vulnerable to an XSS attack if exposed to specially crafted markdown. This was fixed in 0.98.5.\r\nhttps://github.com/home-assistant/home-assistant-polymer/pull/3640",
+            "cve": "PVE-2021-37453",
+            "id": "pyup.io-37453",
             "specs": [
-                "<1.3.0"
+                ">=0.98,<0.98.5"
             ],
-            "v": "<1.3.0"
+            "v": ">=0.98,<0.98.5"
         }
     ],
-    "droopescan": [
+    "honeycomb-beeline": [
         {
-            "advisory": "Droopescan 1.33.1 includes an update of Joomla because of an unauthenticated SQL injection vulnerability.",
-            "cve": "PVE-2021-39049",
-            "id": "pyup.io-39049",
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'jinja2' to v2.11.3 to include a security fix.",
+            "cve": "CVE-2020-28493",
+            "id": "pyup.io-44537",
             "specs": [
-                "<1.33.1"
+                "<3.0.0"
             ],
-            "v": "<1.33.1"
-        }
-    ],
-    "drt": [
+            "v": "<3.0.0"
+        },
+        {
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'sqlparse' to v0.4.2 to include a security fix.",
+            "cve": "CVE-2021-32839",
+            "id": "pyup.io-44538",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        },
+        {
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'Django' minimum version to v2.2.26 to include security fixes.",
+            "cve": "CVE-2021-44420",
+            "id": "pyup.io-44539",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        },
+        {
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'Django' minimum version to v2.2.26 to include security fixes.",
+            "cve": "CVE-2021-33203",
+            "id": "pyup.io-44540",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        },
+        {
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'Django' minimum version to v2.2.26 to include security fixes.",
+            "cve": "CVE-2021-28658",
+            "id": "pyup.io-44541",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        },
+        {
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'Django' minimum version to v2.2.26 to include security fixes.",
+            "cve": "CVE-2021-23336",
+            "id": "pyup.io-44542",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        },
+        {
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'Django' minimum version to v2.2.26 to include security fixes.",
+            "cve": "CVE-2021-3281",
+            "id": "pyup.io-44543",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        },
+        {
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'Django' minimum version to v2.2.26 to include security fixes.",
+            "cve": "CVE-2021-33571",
+            "id": "pyup.io-44544",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        },
+        {
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'Django' minimum version to v2.2.26 to include security fixes.",
+            "cve": "CVE-2021-32052",
+            "id": "pyup.io-44545",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
+        },
         {
-            "advisory": "Drt version 1.2.1 includes a security patch for the function 'readConfig' in 'drt/configfile.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/ccdale/drt/commit/2fffc617a9ddac040182d54a3227c87eb268b8ed",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41321",
+            "advisory": "Honeycomb-beeline 3.0.0 updates its dependency 'Django' minimum version to v2.2.26 to include security fixes.",
+            "cve": "CVE-2021-31542",
+            "id": "pyup.io-44546",
             "specs": [
-                "<1.2.1"
+                "<3.0.0"
             ],
-            "v": "<1.2.1"
+            "v": "<3.0.0"
         },
         {
-            "advisory": "Drt throughout version 1.2.1 uses unsafe \"os.system\" in \"drt/dvddisc.py\". Under non-trusted input, it could lead to OS injection.",
-            "cve": "PVE-2021-41760",
-            "id": "pyup.io-41760",
+            "advisory": "Honeycomb-beeline 3.0.0 drops support for Python 2.7, version that doesn't receive security patches anymore since 2020.",
+            "cve": "PVE-2021-42379",
+            "id": "pyup.io-44547",
             "specs": [
-                "<=1.2.1"
+                "<3.0.0"
             ],
-            "v": "<=1.2.1"
-        }
-    ],
-    "dtale": [
+            "v": "<3.0.0"
+        },
         {
-            "advisory": "Dtale 1.9.1 includes a fix for USE_COLAB to prevent colab proxy endpoint injection.",
-            "cve": "PVE-2021-38928",
-            "id": "pyup.io-38928",
+            "advisory": "Honeycomb-beeline 3.0.0 drops support for Python 2.7, version that doesn't receive security patches anymore since 2020.",
+            "cve": "CVE-2020-26116",
+            "id": "pyup.io-44548",
             "specs": [
-                "<1.9.1"
+                "<3.0.0"
             ],
-            "v": "<1.9.1"
-        }
-    ],
-    "dulwich": [
+            "v": "<3.0.0"
+        },
         {
-            "advisory": "Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.",
-            "cve": "CVE-2015-0838",
-            "id": "pyup.io-25808",
+            "advisory": "Honeycomb-beeline 3.0.0 drops support for Python 2.7, version that doesn't receive security patches anymore since 2020.",
+            "cve": "CVE-2021-23336",
+            "id": "pyup.io-44549",
             "specs": [
-                "<0.9.920150320"
+                "<3.0.0"
             ],
-            "v": "<0.9.920150320"
-        }
-    ],
-    "dynamixel-sdk": [
+            "v": "<3.0.0"
+        },
         {
-            "advisory": "ROBOTIS Dynamixel SDK through 3.7.11 has a buffer overflow via a large rxpacket.",
-            "cve": "CVE-2019-15786",
-            "id": "pyup.io-42263",
+            "advisory": "Honeycomb-beeline 3.0.0 drops support for Python 2.7, version that doesn't receive security patches anymore since 2020.",
+            "cve": "CVE-2013-7040",
+            "id": "pyup.io-44551",
             "specs": [
-                "<=3.7.11"
+                "<3.0.0"
             ],
-            "v": "<=3.7.11"
+            "v": "<3.0.0"
         }
     ],
-    "dynamo-release": [
+    "hooktest": [
         {
-            "advisory": "Dynamo-release 0.99 includes fixes for various vulnerabilities.",
-            "cve": "PVE-2021-40192",
-            "id": "pyup.io-40192",
+            "advisory": "Hooktest 1.3.1 updates its dependency \"validators\" to fix a security leak.",
+            "cve": "PVE-2021-41910",
+            "id": "pyup.io-41910",
             "specs": [
-                "<0.99"
+                "<1.3.1"
             ],
-            "v": "<0.99"
+            "v": "<1.3.1"
         }
     ],
-    "easy-install": [
+    "horizon": [
         {
-            "advisory": "easy_install in setuptools before 0.7 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to the default use of the product.",
-            "cve": "PVE-2021-33124",
-            "id": "pyup.io-33124",
+            "advisory": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL. See CVE-2020-29565.",
+            "cve": "CVE-2020-29565",
+            "id": "pyup.io-39226",
             "specs": [
-                "<0.7"
+                "<15.3.2",
+                ">=17.0,<18.3.3",
+                ">=16.0.0.0b1,<16.2.1"
             ],
-            "v": "<0.7"
+            "v": "<15.3.2,>=17.0,<18.3.3,>=16.0.0.0b1,<16.2.1"
         }
     ],
-    "easy-xml": [
+    "hotaru": [
         {
-            "advisory": "The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows an attacker to expose sensitive data or perform a denial of service (DOS) via a crafted external entity entered into the XML content as input. See CVE-2020-26705.\r\nhttps://github.com/darkfoxprime/python-easy_xml/issues/1",
-            "cve": "CVE-2020-26705",
-            "id": "pyup.io-42417",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15211",
+            "id": "pyup.io-38822",
             "specs": [
-                "==0.5.0"
+                "<3.2.4"
             ],
-            "v": "==0.5.0"
-        }
-    ],
-    "ebookmaker": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Ebookmaker version 0.11.14 requires a version of its dependency 'pillow' >=8.3.2 to include security fixes.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-43550",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15207",
+            "id": "pyup.io-43835",
             "specs": [
-                "<0.11.14"
+                "<3.2.4"
             ],
-            "v": "<0.11.14"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "Ebookmaker version 0.11.14 requires a version of its dependency 'pillow' >=8.3.2 to include security fixes.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-42213",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15195",
+            "id": "pyup.io-43836",
             "specs": [
-                "<0.11.14"
+                "<3.2.4"
             ],
-            "v": "<0.11.14"
-        }
-    ],
-    "ec2-metadata": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Ec2-metadata 2.2.0 moves to use Instance Metadata Service version 2 due to its increased security - see: https://github.com/adamchainz/ec2-metadata/issues/150",
-            "cve": "PVE-2021-38053",
-            "id": "pyup.io-38053",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15203",
+            "id": "pyup.io-43838",
             "specs": [
-                "<2.2.0"
+                "<3.2.4"
             ],
-            "v": "<2.2.0"
-        }
-    ],
-    "ecdsa": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "A flaw was found in all python-ecdsa versions before 0.13.3, where it did not correctly verify whether signatures used DER encoding. Without this verification, a malformed signature could be accepted, making the signature malleable. Without proper verification, an attacker could use a malleable signature to create false transactions. See: CVE-2019-14859.",
-            "cve": "CVE-2019-14859",
-            "id": "pyup.io-37763",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15358",
+            "id": "pyup.io-43843",
             "specs": [
-                "<0.13.3"
+                "<3.2.4"
             ],
-            "v": "<0.13.3"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "An error-handling flaw was found in python-ecdsa before version 0.13.3. During signature decoding, malformed DER signatures could raise unexpected exceptions (or no exceptions at all), which could lead to a denial of service. See CVE-2019-14853.",
-            "cve": "CVE-2019-14853",
-            "id": "pyup.io-37762",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15191",
+            "id": "pyup.io-43844",
             "specs": [
-                "<0.13.3"
+                "<3.2.4"
             ],
-            "v": "<0.13.3"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "In ecdsa 0.14, deterministic signatures verify that the signature won't leak private key through very unlikely selection of `k` value (the nonce). Nonce bit size hiding was added (hardening against Minerva attack). Please note that it DOES NOT make library secure against side channel attacks (timing attacks).",
-            "cve": "PVE-2021-37637",
-            "id": "pyup.io-37637",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-11656",
+            "id": "pyup.io-43845",
             "specs": [
-                "<0.14"
+                "<3.2.4"
             ],
-            "v": "<0.14"
-        }
-    ],
-    "edapy": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Edapy version 0.3.0 includes a security patch for the function '_read_yaml' in 'edapy/csv/init.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/MartinThoma/edapy/commit/47b958781a702e176ea72fe59ab8596ad93aabdc#diff-150063df356bdd6b5d718194a9ccb7750d86f8608959d31cef59012a8471709f",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41322",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-13434",
+            "id": "pyup.io-43847",
             "specs": [
-                "<0.3.0"
+                "<3.2.4"
             ],
-            "v": "<0.3.0"
-        }
-    ],
-    "edrn-sync": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Edrn-sync version 1.0.5 addresses a vulnerability created by weak default passwords sync'd from the DMCC users list. It generates more secure random passwords for new users and also provides a utility for detecting old weak passwords and changing them to something randomized.",
-            "cve": "PVE-2021-41918",
-            "id": "pyup.io-41918",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-13871",
+            "id": "pyup.io-43849",
             "specs": [
-                "<1.0.5"
+                "<3.2.4"
             ],
-            "v": "<1.0.5"
-        }
-    ],
-    "edrnsite.policy": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.",
-            "cve": "CVE-2011-0720",
-            "id": "pyup.io-25810",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-13631",
+            "id": "pyup.io-43850",
             "specs": [
-                "<1.0.5"
+                "<3.2.4"
             ],
-            "v": "<1.0.5"
-        }
-    ],
-    "edx-ecommerce-worker": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Edx-ecommerce-worker 0.8.3 updates its dependency 'pyyaml' to v5.1 to include a security fix.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-38792",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-9327",
+            "id": "pyup.io-43851",
             "specs": [
-                "<0.8.3"
+                "<3.2.4"
             ],
-            "v": "<0.8.3"
-        }
-    ],
-    "edx-proctoring": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Edx-proctoring version 4.1.0 adds encryption to video review urls.",
-            "cve": "PVE-2021-42048",
-            "id": "pyup.io-42048",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15193",
+            "id": "pyup.io-43853",
             "specs": [
-                "<4.1.0"
+                "<3.2.4"
             ],
-            "v": "<4.1.0"
-        }
-    ],
-    "egon": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Egon 0.4.1 improves security and provides improved performance.",
-            "cve": "PVE-2021-40568",
-            "id": "pyup.io-40568",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15213",
+            "id": "pyup.io-43854",
             "specs": [
-                "<0.4.1"
+                "<3.2.4"
             ],
-            "v": "<0.4.1"
-        }
-    ],
-    "eh": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "eh 0.2.8 changes: Fixed pyyaml security issue",
-            "cve": "PVE-2021-37217",
-            "id": "pyup.io-37217",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15210",
+            "id": "pyup.io-43855",
             "specs": [
-                "<0.2.8"
+                "<3.2.4"
             ],
-            "v": "<0.2.8"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "Eh 1.3.0 fixes a pyyaml security issue.",
-            "cve": "PVE-2021-37500",
-            "id": "pyup.io-37500",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15192",
+            "id": "pyup.io-43852",
             "specs": [
-                "<1.3.0"
+                "<3.2.4"
             ],
-            "v": "<1.3.0"
-        }
-    ],
-    "ekuiper": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Ekuiper 1.1.2 runs build process/container as 'kuiper' user to avoid security risks.\r\nhttps://github.com/lf-edge/ekuiper/commit/1327eb69d0173c8d4a2070a835be6894f5a90b2b",
-            "cve": "PVE-2021-42963",
-            "id": "pyup.io-42963",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15208",
+            "id": "pyup.io-43833",
             "specs": [
-                "<1.1.2"
+                "<3.2.4"
             ],
-            "v": "<1.1.2"
-        }
-    ],
-    "elastic-apm": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "When the Elastic APM agent for Python versions before 5.1.0 is run as a CGI script, there is a variable name clash flaw if a remote attacker can control the proxy header. This could result in an attacker redirecting collected APM data to a proxy of their choosing. See: CVE-2019-7617.",
-            "cve": "CVE-2019-7617",
-            "id": "pyup.io-37398",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15204",
+            "id": "pyup.io-43829",
             "specs": [
-                "<5.1.0"
+                "<3.2.4"
             ],
-            "v": "<5.1.0"
-        }
-    ],
-    "electrumsv-secp256k1": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Electrumsv-secp256k1 version 8.0.0 makes build system support new GitHub & PyPI security requirements.",
-            "cve": "PVE-2021-42043",
-            "id": "pyup.io-42043",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15205",
+            "id": "pyup.io-43830",
             "specs": [
-                "<8.0.0"
+                "<3.2.4"
             ],
-            "v": "<8.0.0"
-        }
-    ],
-    "electrumx": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "electrumx before 1.4.1 did not use PROTOCOL_MIN to 1.0; this did not prevent 2.9.x clients from connecting\r\n  and encouraging upgrades to more recent clients without the security hole.",
-            "cve": "PVE-2021-36324",
-            "id": "pyup.io-36324",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15202",
+            "id": "pyup.io-43831",
             "specs": [
-                "<1.4.1"
+                "<3.2.4"
             ],
-            "v": "<1.4.1"
-        }
-    ],
-    "elkm1": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Elkm1 v1.0.0 adds support for TLS 1.2 secure connection mode.",
-            "cve": "PVE-2021-42011",
-            "id": "pyup.io-42011",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15206",
+            "id": "pyup.io-43832",
             "specs": [
-                "<1.0.0"
+                "<3.2.4"
             ],
-            "v": "<1.0.0"
-        }
-    ],
-    "elyra": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Elyra 2.2.3 allows secure connections to S3 object storage.",
-            "cve": "PVE-2021-40313",
-            "id": "pyup.io-40313",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15209",
+            "id": "pyup.io-43834",
             "specs": [
-                "<2.2.3"
+                "<3.2.4"
             ],
-            "v": "<2.2.3"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "Elyra 2.3.0b0 allows secure connections to S3 object storage.",
-            "cve": "PVE-2021-40312",
-            "id": "pyup.io-40312",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15190",
+            "id": "pyup.io-43837",
             "specs": [
-                "<2.3.0b0"
+                "<3.2.4"
             ],
-            "v": "<2.3.0b0"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.",
-            "cve": "CVE-2021-33503",
-            "id": "pyup.io-41074",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15212",
+            "id": "pyup.io-43839",
             "specs": [
-                "<3.0.0"
+                "<3.2.4"
             ],
-            "v": "<3.0.0"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "Elyra 3.0.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
-            "cve": "CVE-2020-26137",
-            "id": "pyup.io-42728",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-13630",
+            "id": "pyup.io-43840",
             "specs": [
-                "<3.0.0"
+                "<3.2.4"
             ],
-            "v": "<3.0.0"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "Elyra 3.0.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
-            "cve": "CVE-2019-11236",
-            "id": "pyup.io-42729",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15194",
+            "id": "pyup.io-43841",
             "specs": [
-                "<3.0.0"
+                "<3.2.4"
             ],
-            "v": "<3.0.0"
+            "v": "<3.2.4"
         },
         {
-            "advisory": "Elyra 3.0.0 updates its dependency 'requests' to v2.25.1 to include a security fix.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-42730",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-15214",
+            "id": "pyup.io-43842",
             "specs": [
-                "<3.0.0"
+                "<3.2.4"
             ],
-            "v": "<3.0.0"
-        }
-    ],
-    "emcache": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "Emcache 1.3.6 fixes a security vulnerability by sanitizing key input.",
-            "cve": "PVE-2021-38331",
-            "id": "pyup.io-38331",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-11655",
+            "id": "pyup.io-43846",
             "specs": [
-                "<1.3.6"
+                "<3.2.4"
             ],
-            "v": "<1.3.6"
-        }
-    ],
-    "emesene": [
+            "v": "<3.2.4"
+        },
         {
-            "advisory": "emesenelib/ProfileManager.py in emesene before 1.6.2 allows local users to overwrite arbitrary files via a symlink attack on the emsnpic temporary file.",
-            "cve": "CVE-2010-2053",
-            "id": "pyup.io-42233",
+            "advisory": "Hotaru 3.2.4 updates Tensorflow to >= 2.2.1 to include security fixes.",
+            "cve": "CVE-2020-13435",
+            "id": "pyup.io-43848",
             "specs": [
-                "<1.6.2"
+                "<3.2.4"
             ],
-            "v": "<1.6.2"
+            "v": "<3.2.4"
         }
     ],
-    "emitter-io": [
+    "hover": [
         {
-            "advisory": "Emitter-io 2.704 fixes a security issue by disallowing pub/sub on extended keys.",
-            "cve": "PVE-2021-38320",
-            "id": "pyup.io-38320",
+            "advisory": "Hover 0.4.0 was released with the acknowledgement that it (and previous versions?) includes a potential security concern. In particular, it displays traceback information if something breaks in the scope of the recipe.",
+            "cve": "PVE-2021-39389",
+            "id": "pyup.io-39389",
             "specs": [
-                "<2.704"
+                "<=0.4.0"
             ],
-            "v": "<2.704"
+            "v": "<=0.4.0"
         }
     ],
-    "emrt.necd.content": [
+    "hpack": [
         {
-            "advisory": "Emrt.necd.content 2.0.15 fixes a possible JavaScript injection.",
-            "cve": "PVE-2021-40547",
-            "id": "pyup.io-40547",
+            "advisory": "A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.",
+            "cve": "CVE-2016-6580",
+            "id": "pyup.io-35679",
             "specs": [
-                "<2.0.15"
+                "<1.2.0"
             ],
-            "v": "<2.0.15"
-        }
-    ],
-    "encapsia-api": [
+            "v": "<1.2.0"
+        },
         {
-            "advisory": "Encapsia-api 0.2.9 updates dependencies for security reasons.",
-            "cve": "PVE-2021-39689",
-            "id": "pyup.io-39689",
+            "advisory": "A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called \"HPACK Bomb\" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.",
+            "cve": "CVE-2016-6581",
+            "id": "pyup.io-35680",
             "specs": [
-                "<0.2.9"
+                "<2.3.0"
             ],
-            "v": "<0.2.9"
-        }
-    ],
-    "engineio-client": [
+            "v": "<2.3.0"
+        },
         {
-            "advisory": "engineio-client 3.1.2 - Bumps ws to version 1.1.2 (vulnerability fix) (539)",
-            "cve": "PVE-2021-36801",
-            "id": "pyup.io-36801",
+            "advisory": "Hhpack 2.3.0 enforces a maximum value of the decompressed size of the header list. This is to avoid the so-called \"HPACK Bomb\" vulnerability, which is caused when a malicious peer sends a compressed HPACK body that decompresses to a gigantic header list size. See: CVE-2016-6581.\r\n\r\nHhpack 2.3.0 also adds a 'OversizedHeaderListError', which is thrown by the 'decode' method if the maximum header list size is being violated. This places the HPACK decoder into a broken state: it must not be used after this exception is thrown.\r\n\r\nLastly, hhpack 2.3.0 adds a 'max_header_list_size' to the 'Decoder' object. This controls the maximum allowable decompressed size of the header list. By default this is set to 64kB.",
+            "cve": "CVE-2016-6581",
+            "id": "pyup.io-38742",
             "specs": [
-                "<3.1.2"
+                "<2.3.0"
             ],
-            "v": "<3.1.2"
-        },
+            "v": "<2.3.0"
+        }
+    ],
+    "hpim-dm": [
         {
-            "advisory": "engineio-client 3.1.2 removes the parsejson dependency, which is vulnerable to a Regular Expression Denial of Service (NSP advisory [528](https://nodesecurity.io/advisories/528)). Please update as soon as possible.",
-            "cve": "PVE-2021-36800",
-            "id": "pyup.io-36800",
+            "advisory": "hpim-dm 1.0 includes dissertation work and security implementation",
+            "cve": "PVE-2021-37836",
+            "id": "pyup.io-37836",
             "specs": [
-                "<3.1.2"
+                "<1.0"
             ],
-            "v": "<3.1.2"
+            "v": "<1.0"
         },
         {
-            "advisory": "engineio-client 3.1.4 updates the `ws` package, as the previous version was vulnerable to a Regular Expression Denial of Service (NSP advisory [#550](https://nodesecurity.io/advisories/550)). Please update as soon as possible.",
-            "cve": "PVE-2021-36799",
-            "id": "pyup.io-36799",
+            "advisory": "Hpim-dm 1.4 fixes security issues on IPv6 HPIM-DM interfaces.",
+            "cve": "PVE-2021-39387",
+            "id": "pyup.io-39387",
             "specs": [
-                "<3.1.4"
+                "<1.4"
             ],
-            "v": "<3.1.4"
+            "v": "<1.4"
         }
     ],
-    "enrocrypt": [
+    "html-to-csv": [
         {
-            "advisory": "Enrocrypt 1.1.4 includes a fix for CVE-2021-39182: Prior to version 1.1.4, EnroCrypt used the MD5 hashing algorithm in the hashing file. Beginners who are unfamiliar with hashes can face problems as MD5 is considered an insecure hashing algorithm. As a workaround, users can remove the 'MD5' hashing function from the file 'hashing.py'.\r\nhttps://github.com/Morgan-Phoenix/EnroCrypt/security/advisories/GHSA-35m5-8cvj-8783\r\nhttps://github.com/Morgan-Phoenix/EnroCrypt/commit/e652d56ac60eadfc26489ab83927af13a9b9d8ce",
-            "cve": "CVE-2021-39182",
-            "id": "pyup.io-42519",
+            "advisory": "All versions of html-to-csv are affected by CVE-2021-23654: When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this, a malicious actor can embed or generate a malicious link or execute commands via CSV files.\r\nhttps://github.com/hanwentao/html2csv/blob/master/html2csv/converter.py",
+            "cve": "CVE-2021-23654",
+            "id": "pyup.io-42868",
             "specs": [
-                "<1.1.4"
+                ">0"
             ],
-            "v": "<1.1.4"
+            "v": ">0"
         }
     ],
-    "entente": [
+    "html5": [
         {
-            "advisory": "Entente version 0.11.0 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/lace/entente/commit/bbbf1985cbb38f749e7dd998bbf42b72c4d1d99c#diff-52de9aa5fb74fe3cdb1d128e9e6b246c69003cf86a181c79f22ec2510dc19b3e",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41324",
+            "advisory": "Html5 0.99999999 fixes a XSS vulnerability exploitable when using legacy browsers. This release alters the API so that quote_attr_values is now a ternary setting, choosing between legacy-safe behavior, spec behavior, and always quoting.\r\nhttps://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7",
+            "cve": "PVE-2021-25845",
+            "id": "pyup.io-25845",
             "specs": [
-                "<0.11.0"
+                "<0.99999999"
             ],
-            "v": "<0.11.0"
+            "v": "<0.99999999"
         }
     ],
-    "envyconfig": [
+    "html5lib": [
         {
-            "advisory": "Envyconfig 1.1.4 upgrades underlying libraries with security alerts.",
-            "cve": "PVE-2021-40257",
-            "id": "pyup.io-40257",
+            "advisory": "The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909.\r\nhttps://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7",
+            "cve": "CVE-2016-9910",
+            "id": "pyup.io-35694",
             "specs": [
-                "<1.1.4"
+                "<0.99999999",
+                ">=1.0b1,<1.0b9"
             ],
-            "v": "<1.1.4"
-        }
-    ],
-    "epsagon": [
+            "v": "<0.99999999,>=1.0b1,<1.0b9"
+        },
         {
-            "advisory": "Epsagon 1.5.0 updates several dependencies in package.json due to vulnerabilities.",
-            "cve": "PVE-2021-39030",
-            "id": "pyup.io-39030",
+            "advisory": "The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.\r\nhttps://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7",
+            "cve": "CVE-2016-9909",
+            "id": "pyup.io-35693",
             "specs": [
-                "<1.5.0"
+                "<0.99999999",
+                ">=1.0b1,<1.0b9"
             ],
-            "v": "<1.5.0"
+            "v": "<0.99999999,>=1.0b1,<1.0b9"
         }
     ],
-    "epyk": [
+    "httpauth": [
         {
-            "advisory": "Epyk 1.5.6 fixes an external JavaScript text injection issue.",
-            "cve": "PVE-2021-40189",
-            "id": "pyup.io-40189",
+            "advisory": "httpauth 0.2 fixes a security issue: Invalid username + empty password were being accepted.",
+            "cve": "PVE-2021-25847",
+            "id": "pyup.io-25847",
             "specs": [
-                "<1.5.6"
+                "<0.2"
             ],
-            "v": "<1.5.6"
+            "v": "<0.2"
         }
     ],
-    "errbot": [
+    "httpie": [
         {
-            "advisory": "errbot 1.3.0 fixes a security issue: the plugin directory permissions were too lax.",
-            "cve": "PVE-2021-25812",
-            "id": "pyup.io-25812",
+            "advisory": "Httpie 1.0.3 fixes CVE-2019-10751. The way the output filename is generated for ``--download`` requests without ``--output`` resulting in a redirect has been changed to only consider the initial URL as the base for the generated filename, and not the final one. See: <https://github.com/jakubroztocil/httpie/releases/tag/1.0.3>.",
+            "cve": "CVE-2019-10751",
+            "id": "pyup.io-37405",
             "specs": [
-                "<1.3.0"
+                "<1.0.3"
             ],
-            "v": "<1.3.0"
+            "v": "<1.0.3"
         }
     ],
-    "ert-storage": [
+    "httplib2": [
         {
-            "advisory": "Ert-storage 0.1.8 enables token-based security for the 'ert-storage'.",
-            "cve": "PVE-2021-40562",
-            "id": "pyup.io-40562",
+            "advisory": "In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0. See CVE-2020-11078.",
+            "cve": "CVE-2020-11078",
+            "id": "pyup.io-38368",
             "specs": [
-                "<0.1.8"
+                "<0.18.0"
             ],
-            "v": "<0.1.8"
-        }
-    ],
-    "espeakng": [
+            "v": "<0.18.0"
+        },
         {
-            "advisory": "Espeakng 1.49.0 fixes many security issues. No details were given.",
-            "cve": "PVE-2021-38581",
-            "id": "pyup.io-38581",
+            "advisory": "Httplib2 0.18.0 is an important security update to patch a CWE-93 CRLF injection vulnerability which forces %xx quote of space, CR, LF characters in uri. See: <https://cwe.mitre.org/data/definitions/93.html>.",
+            "cve": "PVE-2021-38303",
+            "id": "pyup.io-38303",
             "specs": [
-                "<1.49.0"
+                "<0.18.0"
             ],
-            "v": "<1.49.0"
+            "v": "<0.18.0"
         },
         {
-            "advisory": "Espeakng 1.50 includes the following security fixes:\r\n\r\n*  Fix several crashes in the emoji support.\r\n*  Fix several static analysis issues detected by Coverity Scan.\r\n*  Fix several static analysis issues detected by Microsoft Visual C++ `/analyze`.\r\n*  `oss-fuzz` support for the SSML logic.\r\n*  Fix running `make check` with `-fsanitize=address` (LLVM AddressSanitizer).",
-            "cve": "PVE-2021-38580",
-            "id": "pyup.io-38580",
+            "advisory": "httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. See CVE-2021-21240.",
+            "cve": "CVE-2021-21240",
+            "id": "pyup.io-39608",
             "specs": [
-                "<1.50"
+                "<0.19.0"
             ],
-            "v": "<1.50"
+            "v": "<0.19.0"
+        },
+        {
+            "advisory": "httplib2 before and including 0.9.2 on \"SSL certificate hostname mismatch\" it is checked only once: https://github.com/httplib2/httplib2/issues/5",
+            "cve": "PVE-2021-25848",
+            "id": "pyup.io-25848",
+            "specs": [
+                "<=0.9.2"
+            ],
+            "v": "<=0.9.2"
         }
     ],
-    "esphome": [
+    "httprunner": [
         {
-            "advisory": "Esphome 1.15.0b1 includes a fix for an http_request ESP32 insecure requests that may return the address of local variable. See: <https://github.com/esphome/issues/issues/1175>.",
-            "cve": "PVE-2021-38623",
-            "id": "pyup.io-38623",
+            "advisory": "Httprunner 2.0.5 fixes XSS in response json.\r\nhttps://github.com/httprunner/httprunner/commit/6cd930ce0d37a3f92bb4f4b9689c7617e610ff43",
+            "cve": "PVE-2021-36945",
+            "id": "pyup.io-36945",
             "specs": [
-                "<1.15.0b1"
+                "<2.0.5"
             ],
-            "v": "<1.15.0b1"
+            "v": "<2.0.5"
         },
         {
-            "advisory": "ESPHome is a system to control the ESP8266/ESP32. Anyone with web_server enabled and HTTP basic auth configured on version 2021.9.1 or older is vulnerable to an issue in which `web_server` allows over-the-air (OTA) updates without checking user defined basic auth username & password. This issue is patched in version 2021.9.2. As a workaround, one may disable or remove `web_server`.",
-            "cve": "CVE-2021-41104",
-            "id": "pyup.io-42322",
+            "advisory": "Httprunner 2.1.3 replaces eval() with builtins to prevent security vulnerabilities.\r\nhttps://github.com/httprunner/httprunner/pull/608/commits/9e6c3b6aa4220f6ffbb13604767ee7e1b525c0de",
+            "cve": "PVE-2021-37216",
+            "id": "pyup.io-37216",
             "specs": [
-                "<=2021.9.1"
+                "<2.1.3"
             ],
-            "v": "<=2021.9.1"
+            "v": "<2.1.3"
         }
     ],
-    "esptool": [
+    "httpsig": [
         {
-            "advisory": "esptool before 2.5.0 `digest_secure_bootloader` could produce incorrect digest.",
-            "cve": "PVE-2021-36328",
-            "id": "pyup.io-36328",
+            "advisory": "httpsig 1.0.0 removed suport for reading keyfiles from disk as this is a huge security hole if this is used in a server framework like drf-httpsig.",
+            "cve": "PVE-2021-25849",
+            "id": "pyup.io-25849",
             "specs": [
-                "<2.5.0"
+                "<1.0.0"
             ],
-            "v": "<2.5.0"
+            "v": "<1.0.0"
         }
     ],
-    "eth-hash": [
+    "httpsig-cffi": [
         {
-            "advisory": "eth-hash before 0.1.5 used an unsafe version of `pycryptodome`. 0.1.5 upgrades `pycryptodome` to `>=3.6.6,<4` to fix this recently discovered vulnerability",
-            "cve": "PVE-2021-36438",
-            "id": "pyup.io-36438",
+            "advisory": "httpsig-cffi 1.0.0 removed suport for reading keyfiles from disk as this is a huge security hole if this is used in a server framework like drf-httpsig.",
+            "cve": "PVE-2021-25850",
+            "id": "pyup.io-25850",
             "specs": [
-                "<0.1.5"
+                "<1.0.0"
             ],
-            "v": "<0.1.5"
+            "v": "<1.0.0"
         }
     ],
-    "etherweaver": [
+    "httpx-socks": [
         {
-            "advisory": "Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.",
-            "cve": "CVE-2018-1000805",
-            "id": "pyup.io-36549",
+            "advisory": "Httpx-socks 0.7.2 adds support for SSL secure connections.\r\nhttps://github.com/romis2012/httpx-socks/commit/c7fab549cdfbb4ad37aacb67364b32194fe65e76",
+            "cve": "PVE-2021-42827",
+            "id": "pyup.io-42827",
             "specs": [
-                "<0.3.0"
+                "<0.7.2"
             ],
-            "v": "<0.3.0"
+            "v": "<0.7.2"
         }
     ],
-    "ethically": [
+    "hub": [
         {
-            "advisory": "Ethically 0.0.3 fixes security issues with dependencies.",
-            "cve": "PVE-2021-37042",
-            "id": "pyup.io-37042",
+            "advisory": "Hub 0.9.0 upgrades urllib3 to urllib3[secure].",
+            "cve": "PVE-2021-39217",
+            "id": "pyup.io-39217",
             "specs": [
-                "<0.0.3"
+                "<0.9.0"
             ],
-            "v": "<0.0.3"
+            "v": "<0.9.0"
         }
     ],
-    "ethsnarks": [
+    "hubitatmaker": [
         {
-            "advisory": "Ethsnarks 0.18.10.1 fixes security bugs in MiMC-p/p and Miximus.",
-            "cve": "PVE-2021-37387",
-            "id": "pyup.io-37387",
+            "advisory": "Hubitatmaker 0.5.4 updates its dependency 'pyyaml' to v5.4 to include a security fix.",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-40101",
             "specs": [
-                "<0.18.10.1"
+                "<0.5.4"
             ],
-            "v": "<0.18.10.1"
+            "v": "<0.5.4"
+        },
+        {
+            "advisory": "Hubitatmaker 0.5.4 updates its dependency 'aiohttp' to v3.7.4 to include a security fix.",
+            "cve": "CVE-2021-21330",
+            "id": "pyup.io-44626",
+            "specs": [
+                "<0.5.4"
+            ],
+            "v": "<0.5.4"
         }
     ],
-    "etlstat": [
+    "hug": [
         {
-            "advisory": "etlstat 0.6.1 updates SQLAlchemy in requirements.txt to fix moderate security issues",
-            "cve": "PVE-2021-37878",
-            "id": "pyup.io-37878",
+            "advisory": "hug 2.3.0 fixes a vulnerability in the static file router that allows files in parent directory to be accessed.",
+            "cve": "PVE-2021-34472",
+            "id": "pyup.io-34472",
             "specs": [
-                "<0.6.1"
+                "<2.3.0"
             ],
-            "v": "<0.6.1"
+            "v": "<2.3.0"
         }
     ],
-    "euphorie": [
+    "humblesetuptools": [
         {
-            "advisory": "Euphorie 11.1.2 tightens the security on several client views.",
-            "cve": "PVE-2021-37459",
-            "id": "pyup.io-37459",
+            "advisory": "humblesetuptools 0.9.5 fixes a security vulnerability in SSL certificate validation.",
+            "cve": "PVE-2021-25851",
+            "id": "pyup.io-25851",
             "specs": [
-                "<11.1.2"
+                "<0.9.5"
             ],
-            "v": "<11.1.2"
+            "v": "<0.9.5"
         },
         {
-            "advisory": "Euphorie 11.7.1 introduces a new view 'get-resources-timestamp' to not use the protected view 'refresh-resources-timestamp' which will be forbidden by the latest security hot fix.",
-            "cve": "PVE-2021-40574",
-            "id": "pyup.io-40574",
+            "advisory": "humblesetuptools 1.3 adresses a security vulnerability in SSL match_hostname check as reported in  Python #17997.",
+            "cve": "PVE-2021-25852",
+            "id": "pyup.io-25852",
             "specs": [
-                "<11.7.1"
+                "<1.3"
             ],
-            "v": "<11.7.1"
-        },
+            "v": "<1.3"
+        }
+    ],
+    "hxl-proxy": [
         {
-            "advisory": "Euphorie 13.0.0 fixes an XSS vulnerability in the text entered by the user (description, measure text).\r\nhttps://github.com/euphorie/Euphorie/commit/8f3c3de271b274b45caad40b17db41c2f795e933",
-            "cve": "PVE-2021-43089",
-            "id": "pyup.io-43089",
+            "advisory": "Hxl-proxy 1.22 updates to libhxl=4.22 for security reasons.",
+            "cve": "PVE-2021-40296",
+            "id": "pyup.io-40296",
             "specs": [
-                "<13.0.0"
+                "<1.22"
             ],
-            "v": "<13.0.0"
+            "v": "<1.22"
+        }
+    ],
+    "hydroshare": [
+        {
+            "advisory": "hydroshare before 1.9.5 has multiple - undisclosed - security issues.",
+            "cve": "PVE-2021-34264",
+            "id": "pyup.io-34264",
+            "specs": [
+                "<1.9.5"
+            ],
+            "v": "<1.9.5"
         },
         {
-            "advisory": "euphorie 6.1 fixes a security issue: modify client to always check if a survey session belongs to the current user.",
-            "cve": "PVE-2021-25813",
-            "id": "pyup.io-25813",
+            "advisory": "hydroshare before 1.9.6 has multiple - undisclosed - security issues.",
+            "cve": "PVE-2021-34265",
+            "id": "pyup.io-34265",
             "specs": [
-                "<6.1"
+                "<1.9.6"
             ],
-            "v": "<6.1"
+            "v": "<1.9.6"
         }
     ],
-    "evalne": [
+    "hyper-kube-config": [
         {
-            "advisory": "Evalne version 0.3.3 includes a security patch for the function '_evaluate_ee_e2e_cmd' in 'evalne/evaluation/evaluator.py'. It contained an OS injection vulnerability: subprocess call with shell=True.\r\nhttps://github.com/Dru-Mara/EvalNE/commit/7041dbb701eb622f6ce38b4ab529b14d86656a26#diff-2279cc18e0f5d8bb6d8fc4820ab5190a43df3a2b6135d860204bcb3b2bc993e0",
-            "cve": "PVE-2021-41325",
-            "id": "pyup.io-41325",
+            "advisory": "Hyper-kube-config 0.6.1 includes an update of Cryptography to mitigate CVE-2020-25659.",
+            "cve": "CVE-2020-25659",
+            "id": "pyup.io-38968",
             "specs": [
-                "<0.3.3"
+                "<0.6.1"
             ],
-            "v": "<0.3.3"
+            "v": "<0.6.1"
         }
     ],
-    "eve-alpha": [
+    "hyperkitty": [
         {
-            "advisory": "Ave-alpha 0.0.7 adds the `MONGO_QUERY_BLACKLIST` option. This allows blacklisting of mongo query operators that should not be allowed in resource queries (``?where=``). Defaults to ['$where', '$regex']. Mongo Javascript operators are disabled by default as they might be used as vectors for injection attacks. Javascript queries also tend to be slow and generally can be easily replaced with the /(very rich) Mongo query dialect.",
-            "cve": "PVE-2021-37162",
-            "id": "pyup.io-37162",
+            "advisory": "An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.",
+            "cve": "CVE-2021-33038",
+            "id": "pyup.io-42316",
             "specs": [
-                "<0.0.7"
+                "<1.3.4"
             ],
-            "v": "<0.0.7"
+            "v": "<1.3.4"
         }
     ],
-    "event-scheduler": [
+    "hypothesis": [
         {
-            "advisory": "An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.",
-            "cve": "CVE-2021-33503",
-            "id": "pyup.io-40343",
+            "advisory": "Hypothesis 3.69.8 moves away from using pickle module and replaces it with json to prevent possible security issues.",
+            "cve": "PVE-2021-39447",
+            "id": "pyup.io-39447",
+            "specs": [
+                "<3.69.8"
+            ],
+            "v": "<3.69.8"
+        }
+    ],
+    "ib-client": [
+        {
+            "advisory": "Ib-client 0.1.2 updates its dependency 'Jinja2' to v2.10.1 to include a security fix.",
+            "cve": "CVE-2019-10906",
+            "id": "pyup.io-37047",
             "specs": [
                 "<0.1.2"
             ],
             "v": "<0.1.2"
         }
     ],
-    "event-tracking": [
+    "idchecker": [
         {
-            "advisory": "event-tracking 0.2.9 changes: This upgrade will fix the security vulnerability in the old versions of jinja2.",
-            "cve": "PVE-2021-37232",
-            "id": "pyup.io-37232",
+            "advisory": "Idchecker 1.1.1 was re-created for security reasons.",
+            "cve": "PVE-2021-40134",
+            "id": "pyup.io-40134",
             "specs": [
-                "<0.2.9"
+                "<1.1.1"
             ],
-            "v": "<0.2.9"
+            "v": "<1.1.1"
         }
     ],
-    "eventlet": [
+    "ihatemoney": [
         {
-            "advisory": "Eventlet 0.31.0 includes an important security fix (websocket: Limit maximum uncompressed frame length to 8MiB).",
-            "cve": "PVE-2021-40399",
-            "id": "pyup.io-40399",
+            "advisory": "In \"I hate money\" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. See CVE-2020-15120.",
+            "cve": "CVE-2020-15120",
+            "id": "pyup.io-42278",
             "specs": [
-                "<0.31.0"
+                "<4.1.5"
             ],
-            "v": "<0.31.0"
+            "v": "<4.1.5"
         },
         {
-            "advisory": "A websocket peer may exhaust memory on Eventlet side by sending very large websocket frames. Malicious peer may exhaust memory on Eventlet side by sending highly compressed data frame. A patch in version 0.31.0 restricts websocket frame to reasonable limits. As a workaround, restricting memory usage via OS limits would help against overall machine exhaustion, but there is no workaround to protect Eventlet process.",
-            "cve": "CVE-2021-21419",
-            "id": "pyup.io-40416",
+            "advisory": "Ihatemoney version 5.0.0 includes several security fixes/improvements:\r\n- Adds CSRF validation on destructive actions.\r\n- Asks for private code to delete project or project history.\r\n- Adds headers to mitigate Clickjacking, XSS, and other attacks.\r\n- Adds URL validation to external link to prevent XSS.",
+            "cve": "PVE-2021-42349",
+            "id": "pyup.io-42349",
             "specs": [
-                "<0.31.0"
+                "<5.0.0"
             ],
-            "v": "<0.31.0"
+            "v": "<5.0.0"
         }
     ],
-    "eventmq": [
+    "im": [
         {
-            "advisory": "Eventmq 0.3.13rc1 upgrades the psutil dependency to a more secure version.",
-            "cve": "PVE-2021-38402",
-            "id": "pyup.io-38402",
+            "advisory": "im 1.5.0 removes use of insecure Pickle data.",
+            "cve": "PVE-2021-36819",
+            "id": "pyup.io-36819",
             "specs": [
-                "<0.3.13rc1"
+                "<1.5.0"
             ],
-            "v": "<0.3.13rc1"
+            "v": "<1.5.0"
         }
     ],
-    "exgrex-py": [
+    "imageedit": [
         {
-            "advisory": "Exgrex-py 0.3a2 updates its dependency 'pygments' to v2.7.4 to include security fixes.",
-            "cve": "CVE-2021-27291",
-            "id": "pyup.io-40142",
+            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-42439",
             "specs": [
-                "<0.3a2"
+                "<2021"
             ],
-            "v": "<0.3a2"
+            "v": "<2021"
         },
         {
-            "advisory": "Exgrex-py 0.3a2 updates its dependency 'pygments' to v2.7.4 to include security fixes.",
-            "cve": "CVE-2021-20270",
-            "id": "pyup.io-42748",
+            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-42638",
             "specs": [
-                "<0.3a2"
+                "<2021"
             ],
-            "v": "<0.3a2"
+            "v": "<2021"
         },
         {
-            "advisory": "Exgrex-py 0.3a2 updates its dependency 'bleach' to v3.3.0 to include a security fix.",
-            "cve": "CVE-2021-23980",
-            "id": "pyup.io-42749",
+            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-42639",
             "specs": [
-                "<0.3a2"
+                "<2021"
             ],
-            "v": "<0.3a2"
+            "v": "<2021"
         },
         {
-            "advisory": "Exgrex-py 0.3a2 updates its dependency 'cryptography' to v3.3.2 to include a security fix.",
-            "cve": "CVE-2020-36242",
-            "id": "pyup.io-42750",
+            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-42640",
             "specs": [
-                "<0.3a2"
+                "<2021"
             ],
-            "v": "<0.3a2"
+            "v": "<2021"
         },
         {
-            "advisory": "Exgrex-py 0.3a2 updates its dependency 'urllib3' to v1.26.4 to include a security fix.",
-            "cve": "CVE-2021-28363",
-            "id": "pyup.io-42751",
-            "specs": [
-                "<0.3a2"
-            ],
-            "v": "<0.3a2"
-        }
-    ],
-    "exgrex-pytest": [
-        {
-            "advisory": "Exgrex-pytest 0.1a2 updates underlying dependencies for security reasons: bleach -> 3.3.0.",
-            "cve": "CVE-2021-23980",
-            "id": "pyup.io-43013",
+            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-42636",
             "specs": [
-                "<0.1a2"
+                "<2021"
             ],
-            "v": "<0.1a2"
+            "v": "<2021"
         },
         {
-            "advisory": "Exgrex-pytest 0.1a2 updates underlying dependencies for security reasons: cryptography -> 3.3.2.",
-            "cve": "CVE-2020-36242",
-            "id": "pyup.io-43012",
+            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-42637",
             "specs": [
-                "<0.1a2"
+                "<2021"
             ],
-            "v": "<0.1a2"
-        },
+            "v": "<2021"
+        }
+    ],
+    "imageio": [
         {
-            "advisory": "Exgrex-pytest 0.1a2 updates its dependency 'urllib3' to v1.26.4 to include a security fix.",
-            "cve": "CVE-2021-28363",
-            "id": "pyup.io-40148",
+            "advisory": "imageio 2.6.0 fixes a security vulnerability for Windows users that have dcmtk installed, and where an attacker can set the filename",
+            "cve": "PVE-2021-37902",
+            "id": "pyup.io-37902",
             "specs": [
-                "<0.1a2"
+                "<2.6.0"
             ],
-            "v": "<0.1a2"
+            "v": "<2.6.0"
         }
     ],
-    "exoskeleton": [
+    "imgstore": [
         {
-            "advisory": "Exoskeleton 1.2.1 requires lxml version >= 4.6.2 (released 2020-11-26) as it fixes a vulnerability.",
-            "cve": "PVE-2021-39207",
-            "id": "pyup.io-39207",
+            "advisory": "Imgstore version 0.2.9 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/loopbio/imgstore/commit/06b49a519b687ff3cd20b06c4c797818df812d06#diff-9e38eed8462f9c72f080c6c96c054a06d828dbd0ebca39f3738471d4557c704a",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41330",
             "specs": [
-                "<1.2.1"
+                "<0.2.9"
             ],
-            "v": "<1.2.1"
-        },
+            "v": "<0.2.9"
+        }
+    ],
+    "imio.dashboard": [
         {
-            "advisory": "Exoskeleton 1.2.5 updates the 'lxml' dependency to '4.6.3' (security update).",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-40224",
+            "advisory": "Imio.dashboard 2.2 secures attribute get in DashboardPODTemplateMigrator.\r\nhttps://github.com/IMIO/imio.dashboard/commit/622147062b4c0cc9f5a0c36cb81b74bec4eb8e3a",
+            "cve": "PVE-2022-44446",
+            "id": "pyup.io-44446",
             "specs": [
-                "<1.2.5"
+                "<2.2"
             ],
-            "v": "<1.2.5"
+            "v": "<2.2"
         }
     ],
-    "experimaestro": [
+    "impalacli": [
         {
-            "advisory": "Experimaestro 0.7.11 includes an NPM packages update (for security proposes).",
-            "cve": "PVE-2021-39420",
-            "id": "pyup.io-39420",
+            "advisory": "Impalacli 0.1.6 updates dependencies to fix vulnerabilities.",
+            "cve": "PVE-2021-41936",
+            "id": "pyup.io-41936",
             "specs": [
-                "<0.7.11"
+                "<0.1.6"
             ],
-            "v": "<0.7.11"
+            "v": "<0.1.6"
         }
     ],
-    "extensiveautomation-server": [
+    "in-toto": [
         {
-            "advisory": "Extensiveautomation-server 12.1.0 reactivates SSLv3 cipher to support Linux client in python 2.6, fixes a security issue on folder creation in repository (no more full rights), and fixes a security issue on web services (bad  handle of the level access).",
-            "cve": "PVE-2021-37348",
-            "id": "pyup.io-37348",
+            "advisory": "In-toto version 1.0.1 updates its dependency \"cryptography\" to include a security fix.",
+            "cve": "CVE-2020-36242",
+            "id": "pyup.io-41832",
             "specs": [
-                "<12.1.0"
+                "<1.0.1"
             ],
-            "v": "<12.1.0"
-        },
+            "v": "<1.0.1"
+        }
+    ],
+    "indico": [
         {
-            "advisory": "Extensiveautomation-server 13.0.0 includes various security improvements:\r\n- No longer uses truncate tables.\r\n- No longer creates folders with 777 mode.\r\n- Includes a new script to secure the server after a from-scratch installation.\r\n- Dumps mysql user in settings file, with updates on all services.",
-            "cve": "PVE-2021-37347",
-            "id": "pyup.io-37347",
+            "advisory": "indico before 2.0.2 uses a insecure transitive dependency (bleach).",
+            "cve": "PVE-2021-35802",
+            "id": "pyup.io-35802",
             "specs": [
-                "<13.0.0"
+                "<2.0.2"
             ],
-            "v": "<13.0.0"
+            "v": "<2.0.2"
         },
         {
-            "advisory": "Extensiveautomation-server 14.0.0 includes various security updates:\r\n- It has a minor improvement to secure the product (php and apache).\r\n- It encrypts test environment data.\r\n- It no longer run server as root.\r\n- It no longer uses the root account for database access.",
-            "cve": "PVE-2021-37346",
-            "id": "pyup.io-37346",
+            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
+            "cve": "CVE-2020-5310",
+            "id": "pyup.io-38163",
             "specs": [
-                "<14.0.0"
+                "<2.2.8"
             ],
-            "v": "<14.0.0"
+            "v": "<2.2.8"
         },
         {
-            "advisory": "Extensiveautomation-server 16.0.0 fixes a security issue on rest API: it fixes the error on the get variables listing.",
-            "cve": "PVE-2021-37345",
-            "id": "pyup.io-37345",
-            "specs": [
-                "<16.0.0"
-            ],
-            "v": "<16.0.0"
-        }
-    ],
-    "extractor": [
-        {
-            "advisory": "Multiple heap-based buffer overflows in Libextractor 0.5.13 and earlier allow remote attackers to execute arbitrary code via (1) the asf_read_header function in the ASF plugin (plugins/asfextractor.c), and (2) the parse_trak_atom function in the QT plugin (plugins/qtextractor.c).",
-            "cve": "CVE-2006-2458",
-            "id": "pyup.io-42232",
+            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
+            "cve": "CVE-2020-5311",
+            "id": "pyup.io-43462",
             "specs": [
-                "<0.5.13"
+                "<2.2.8"
             ],
-            "v": "<0.5.13"
-        }
-    ],
-    "eyed3": [
+            "v": "<2.2.8"
+        },
         {
-            "advisory": "tag.py in eyeD3 (aka python-eyed3) 7.0.3, 0.6.18, and earlier for Python allows local users to modify arbitrary files via a symlink attack on a temporary file.",
-            "cve": "CVE-2014-1934",
-            "id": "pyup.io-35538",
+            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
+            "cve": "CVE-2020-5312",
+            "id": "pyup.io-43463",
             "specs": [
-                "<0.6.18"
+                "<2.2.8"
             ],
-            "v": "<0.6.18"
-        }
-    ],
-    "faker": [
+            "v": "<2.2.8"
+        },
         {
-            "advisory": "Faker 0.1 includes the message: \"`bundler-audit` has identified that i18 has fix a security vulnerability, that has been fixed in the 0.8 version.\"",
-            "cve": "PVE-2021-37386",
-            "id": "pyup.io-37386",
+            "advisory": "Indico 2.2.8 updates its dependency 'bleach' to v3.1.4 to include security fixes.",
+            "cve": "CVE-2020-6817",
+            "id": "pyup.io-43466",
             "specs": [
-                "<0.1"
+                "<2.2.8"
             ],
-            "v": "<0.1"
-        }
-    ],
-    "fangfrisch": [
+            "v": "<2.2.8"
+        },
         {
-            "advisory": "Fangfrisch 1.4.0 removes 'url_doppelstern' and 'url_crdfam_clamav' from Sanesecurity's provider section because the related signatures are no longer maintained and/or no longer distributed by Sanesecurity.",
-            "cve": "PVE-2021-39615",
-            "id": "pyup.io-39615",
+            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
+            "cve": "CVE-2020-5313",
+            "id": "pyup.io-43464",
             "specs": [
-                "<1.4.0"
+                "<2.2.8"
             ],
-            "v": "<1.4.0"
-        }
-    ],
-    "faraday-agent-dispatcher": [
+            "v": "<2.2.8"
+        },
         {
-            "advisory": "Faraday-agent-dispatcher 1.2.1 escapes user-controlled executor parameters in order to prevent OS argument injection (not command injection).",
-            "cve": "PVE-2021-39351",
-            "id": "pyup.io-39351",
+            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
+            "cve": "CVE-2019-19911",
+            "id": "pyup.io-43465",
             "specs": [
-                "<1.2.1"
+                "<2.2.8"
             ],
-            "v": "<1.2.1"
-        }
-    ],
-    "fast-curator": [
+            "v": "<2.2.8"
+        },
         {
-            "advisory": "Fast-curator 0.2.2 switches to pyyaml `safe_load` for better security.",
-            "cve": "PVE-2021-37514",
-            "id": "pyup.io-37514",
+            "advisory": "Indico 2.2.8 updates its dependency 'bleach' to v3.1.4 to include security fixes.",
+            "cve": "CVE-2020-6816",
+            "id": "pyup.io-43467",
             "specs": [
-                "<0.2.2"
+                "<2.2.8"
             ],
-            "v": "<0.2.2"
-        }
-    ],
-    "fastapi": [
+            "v": "<2.2.8"
+        },
         {
-            "advisory": "Fastapi 0.18.0 updates dependencies for security reasons.",
-            "cve": "PVE-2021-37084",
-            "id": "pyup.io-37084",
+            "advisory": "Indico 2.3.4 fixes some open redirects which could help making harmful URLs look more trustworthy by linking to Indico and having it redirect the user to a malicious site. Also, the :data:`BASE_URL` is now always enforced and requests whose Host header does not match are rejected. This prevents malicious actors from tricking Indico into sending e.g. a password reset link to a user that points to a host controlled by the attacker instead of the actual Indico host.",
+            "cve": "PVE-2021-40431",
+            "id": "pyup.io-40431",
             "specs": [
-                "<0.18.0"
+                "<2.3.4"
             ],
-            "v": "<0.18.0"
+            "v": "<2.3.4"
         },
         {
-            "advisory": "Fastapi 0.30.0 avoids/fixes a potential security issue: as the returned object is passed directly to Pydantic, if the returned object was a subclass of the `response_model` (e.g. you return a `UserInDB` that inherits from `User` but contains extra fields, like `hashed_password`, and `User` is used in the `response_model`), it would still pass the validation (because `UserInDB` is a subclass of `User`) and the object would be returned as-is, including the `hashed_password`. To fix this, the declared `response_model` is cloned, if it is a Pydantic model class (or contains Pydantic model classes in it, e.g. in a `List[Item]`), the Pydantic model class(es) will be a different one (the \"cloned\" one). So, an object that is a subclass won't simply pass the validation and returned as-is, because it is no longer a sub-class of the cloned `response_model`. Instead, a new Pydantic model object will be created with the contents of the returned object. So, it will be a new object (made with the data from the returned one), and will be filtered by the cloned `response_model`, containing only the declared fields as normally.",
-            "cve": "PVE-2021-37231",
-            "id": "pyup.io-37231",
+            "advisory": "Indico 2.3.5 fixes XSS vulnerabilities in the category picker (via category titles), location widget (via room and venue names defined by an Indico administrator) and the \"Indico Weeks View\" timetable theme (via contribution/break titles defined by an event organizer).\r\nhttps://github.com/indico/indico/pull/4897",
+            "cve": "PVE-2021-40430",
+            "id": "pyup.io-40430",
             "specs": [
-                "<0.30.0"
+                "<2.3.5"
             ],
-            "v": "<0.30.0"
+            "v": "<2.3.5"
         },
         {
-            "advisory": "Fastapi 0.37.0 fixes a security issue: when returning a sub-class of a response model and using `skip_defaults` it could leak information. See: https://github.com/tiangolo/fastapi/pull/485",
-            "cve": "PVE-2021-37428",
-            "id": "pyup.io-37428",
+            "advisory": "Indico 3.0 improves security for the 'OAuth' provider module.",
+            "cve": "PVE-2021-40429",
+            "id": "pyup.io-40429",
             "specs": [
-                "<0.37.0"
+                "<3.0"
             ],
-            "v": "<0.37.0"
+            "v": "<3.0"
         },
         {
-            "advisory": "Fastapi 0.60.2 fixes typos in docs for 'security' chapter.",
-            "cve": "PVE-2021-38670",
-            "id": "pyup.io-38670",
+            "advisory": "Indico 3.0rc1 re-implements the 'OAuth' provider module based on a more modern library ('authlib'). Support for the somewhat insecure *implicit flow* has been removed in favor of the code-with-PKCE flow. Tokens are now stored more securely as a hash instead of plaintext.",
+            "cve": "PVE-2021-40856",
+            "id": "pyup.io-40856",
             "specs": [
-                "<0.60.2"
+                "<3.0rc1"
             ],
-            "v": "<0.60.2"
+            "v": "<3.0rc1"
         },
         {
-            "advisory": "Fastapi 0.65.1 upgrades pydantic pin, to handle CVE-2021-29510.",
-            "cve": "CVE-2021-29510",
-            "id": "pyup.io-40443",
+            "advisory": "Indico 2.0.3 no longer shows contribution information (metadata including title, speakers and a partial description) in the contribution list unless the user has access to a contribution.",
+            "cve": "PVE-2021-37568",
+            "id": "pyup.io-37568",
             "specs": [
-                "<0.65.1"
+                ">=2.0.0,<2.0.3"
             ],
-            "v": "<0.65.1"
+            "v": ">=2.0.0,<2.0.3"
         },
         {
-            "advisory": "Fastapi version 0.65.2 includes a security fix for CVE-2021-32677: FastAPI versions lower than 0.65.2 that used cookies for authentication in path operations that received JSON payloads sent by browsers were vulnerable to a Cross-Site Request Forgery (CSRF) attack. In versions lower than 0.65.2, FastAPI would try to read the request payload as JSON even if the content-type header sent was not set to application/json or a compatible JSON media type (e.g. application/geo+json). A request with a content type of text/plain containing JSON data would be accepted and the JSON data would be extracted. Requests with content type text/plain are exempt from CORS preflights, for being considered Simple requests. The browser will execute them right away including cookies, and the text content could be a JSON string that would be parsed and accepted by the FastAPI application. The request data is now parsed as JSON only if the content-type header is application/json or another JSON compatible media type like application/geo+json. It's best to upgrade to the latest FastAPI, but if updating is not possible then a middleware or a dependency that checks the content-type header and aborts the request if it is not application/json or another JSON compatible content type can act as a mitigating workaround.\r\nhttps://github.com/tiangolo/fastapi/security/advisories/GHSA-8h2j-cgx8-6xv7\r\nhttps://github.com/tiangolo/fastapi/commit/fa7e3c996edf2d5482fff8f9d890ac2390dede4d",
-            "cve": "CVE-2021-32677",
-            "id": "pyup.io-40643",
+            "advisory": "Indico 2.1.11 fixes more places where LaTeX input was not correctly sanitized. While the biggest security impact (reading local files) has already been mitigated when fixing the initial vulnerability in the previous release, it is still strongly recommended to update.",
+            "cve": "PVE-2021-37570",
+            "id": "pyup.io-37570",
             "specs": [
-                "<0.65.2"
+                ">=2.1.0,<2.1.11"
             ],
-            "v": "<0.65.2"
-        }
-    ],
-    "fastapi-login": [
+            "v": ">=2.1.0,<2.1.11"
+        },
         {
-            "advisory": "Fastapi-login 1.4.0 fixes a security vulnerability found in uvicorn",
-            "cve": "PVE-2021-38783",
-            "id": "pyup.io-38783",
+            "advisory": "Indico 2.1.3\r\n- Only returns timetable entries for the current session when updating a session through the timetable (issue 3474)\r\n- Prevents session managers/coordinators from modifying certain timetable entries or scheduling contributions not assigned to their session\r\n- Restricts access to timetable entry details to users who are authorized to see them",
+            "cve": "PVE-1970-34153",
+            "id": "pyup.io-34153",
             "specs": [
-                "<1.4.0"
+                ">=2.1.0,<2.1.3"
             ],
-            "v": "<1.4.0"
+            "v": ">=2.1.0,<2.1.3"
         },
         {
-            "advisory": "Fastapi-login 1.6.0 updates underlying packages to fix security vulnerabilities.",
-            "cve": "PVE-2021-40234",
-            "id": "pyup.io-40234",
+            "advisory": "Indico 2.2.3 and 2.1.10\r\n- Strip ``@``, ``+``, ``-`` and ``=`` from the beginning of strings when exporting CSV files to avoid security issues when opening the CSV file in Excel.\r\n- Use 027 instead of 000 umask when temporarily changing it to get the current umask.\r\n- Fix LaTeX sanitization to prevent malicious users from running unsafe LaTeX commands through specially crafted abstracts or contribution descriptions, which could lead to the disclosure of local file contents.",
+            "cve": "PVE-2021-37567",
+            "id": "pyup.io-37567",
             "specs": [
-                "<1.6.0"
+                ">=2.2.0,<2.2.3",
+                ">=2.1.0,<2.1.10"
             ],
-            "v": "<1.6.0"
+            "v": ">=2.2.0,<2.2.3,>=2.1.0,<2.1.10"
         },
         {
-            "advisory": "Fastapi-login 1.6.1 includes updates of dependencies. This fixes several security issues found in dependencies.",
-            "cve": "PVE-2021-40652",
-            "id": "pyup.io-40652",
+            "advisory": "Indico 2.2.4 fixes more places where LaTeX input was not correctly sanitized. While the biggest security impact (reading local files) has already been mitigated when fixing the initial vulnerability in the previous release, it is still strongly recommended to update.",
+            "cve": "PVE-2021-37569",
+            "id": "pyup.io-37569",
             "specs": [
-                "<1.6.1"
+                ">=2.2.0,<2.2.4"
             ],
-            "v": "<1.6.1"
+            "v": ">=2.2.0,<2.2.4"
         }
     ],
-    "fastapi-restful": [
+    "indy-node": [
         {
-            "advisory": "Fastapi-restful 0.3.1 includes a fix for the 'pydantic' dependency (update is required).",
-            "cve": "CVE-2021-29510",
-            "id": "pyup.io-40814",
+            "advisory": "In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.",
+            "cve": "CVE-2020-11090",
+            "id": "pyup.io-42272",
             "specs": [
-                "<0.3.1"
+                "==1.12.2"
             ],
-            "v": "<0.3.1"
+            "v": "==1.12.2"
         }
     ],
-    "fastecdsa": [
+    "influx-prompt": [
         {
-            "advisory": "An issue was discovered in fastecdsa before 2.1.2. When using the NIST P-256 curve in the ECDSA implementation, the point at infinity is mishandled. This means that for an extreme value in k and s^-1, the signature verification fails even if the signature is correct. This behavior is not solely a usability problem. There are some threat models where an attacker can benefit by successfully guessing users for whom signature verification will fail.",
-            "cve": "CVE-2020-12607",
-            "id": "pyup.io-42273",
+            "advisory": "Influx-prompt version 0.0.3 updates its dependency 'requests' to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-42221",
             "specs": [
-                "<2.1.2"
+                "<0.0.3"
             ],
-            "v": "<2.1.2"
+            "v": "<0.0.3"
         },
         {
-            "advisory": "Fastecdsa 2.1.5 fixes the timing leakage from nonce bit length. This is also known as the 'Minerva' vulnerability. See: <https://minerva.crocs.fi.muni.cz/>.",
-            "cve": "PVE-2021-38743",
-            "id": "pyup.io-38743",
+            "advisory": "Influx-prompt version 0.1.0 updates its dependency 'urllib3' to include a security fix.",
+            "cve": "CVE-2018-20060",
+            "id": "pyup.io-42220",
             "specs": [
-                "<2.1.5"
+                "<0.1.0"
             ],
-            "v": "<2.1.5"
-        }
-    ],
-    "fbpcp": [
+            "v": "<0.1.0"
+        },
         {
-            "advisory": "Fbpcp 0.2.2 updates its dependency 'urllib3' to v1.26.7 to include security fixes.",
-            "cve": "CVE-2021-33503",
-            "id": "pyup.io-42988",
+            "advisory": "Influx-prompt 1.0.1 includes a security fix to mitigate CVE-2021-27291.",
+            "cve": "CVE-2021-27291",
+            "id": "pyup.io-40135",
             "specs": [
-                "<0.2.2"
+                "<1.0.1"
             ],
-            "v": "<0.2.2"
-        }
-    ],
-    "featureserver": [
+            "v": "<1.0.1"
+        },
         {
-            "advisory": "featureserver before 1.06 allowed JSON callbacks.",
-            "cve": "PVE-2021-25814",
-            "id": "pyup.io-25814",
+            "advisory": "Influx-prompt 1.0.1 updates its dependency 'pygments' to a version ~=2.7 to include security fixes.",
+            "cve": "CVE-2021-20270",
+            "id": "pyup.io-40147",
             "specs": [
-                "<1.06"
+                "<1.0.1"
             ],
-            "v": "<1.06"
+            "v": "<1.0.1"
         }
     ],
-    "fedcloudclient": [
+    "infracheck": [
         {
-            "advisory": "Fedcloudclient 1.1.0 improves error checking and enhances security.",
-            "cve": "PVE-2021-40139",
-            "id": "pyup.io-40139",
+            "advisory": "Infracheck 1.7.rc2 adds a `ssh-fingerprint` check, which verifies if any remote host fingerprint matches. This helps detecting man-in-the-middle and server takeover attacks.",
+            "cve": "PVE-2021-39200",
+            "id": "pyup.io-39200",
             "specs": [
-                "<1.1.0"
+                "<1.7.rc2"
             ],
-            "v": "<1.1.0"
+            "v": "<1.7.rc2"
         }
     ],
-    "fedmsg": [
+    "insecure-package": [
         {
-            "advisory": "FedMsg 0.18.1 and older is vulnerable to a message validation flaw resulting in message validation not being enabled if configured to be on.",
-            "cve": "CVE-2017-1000001",
-            "id": "pyup.io-34879",
+            "advisory": "This is an insecure package with lots of exploitable security vulnerabilities.",
+            "cve": "PVE-2021-25853",
+            "id": "pyup.io-25853",
             "specs": [
-                "<0.18.2"
+                "<0.2.0"
             ],
-            "v": "<0.18.2"
+            "v": "<0.2.0"
         }
     ],
-    "fedn": [
+    "inspetor": [
         {
-            "advisory": "Fedn 0.2.3 includes several bugfixes and security patches.",
-            "cve": "PVE-2021-40830",
-            "id": "pyup.io-40830",
+            "advisory": "Inspetor 2.3.1 updates `sprockets` in `Gemfile.lock` to fix security warnings.",
+            "cve": "PVE-2021-37343",
+            "id": "pyup.io-37343",
             "specs": [
-                "<0.2.3"
+                "<2.3.1"
             ],
-            "v": "<0.2.3"
+            "v": "<2.3.1"
         }
     ],
-    "fedora": [
+    "installtool": [
         {
-            "advisory": "Fedora 0.3.10 has some methods to help deal with CSRF, which is a vulnerability that can allow malicious web sites to execute server methods on behalf of an authenticated user.",
-            "cve": "PVE-2021-38173",
-            "id": "pyup.io-38173",
+            "advisory": "Installtool version 1.0 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/l0r3zz/public/commit/ab00de531d125629c11811473bfee9e4063572b2#diff-4f5fe0b656de6953412f12024a4e76b35b618409e88f79d86e52c52c020dac58",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41332",
             "specs": [
-                "<0.3.10"
+                "<1.0"
             ],
-            "v": "<0.3.10"
+            "v": "<1.0"
         }
     ],
-    "feedgen": [
+    "instana": [
         {
-            "advisory": "Feedgen (python feedgen) before 0.9.0 is susceptible to XML Denial of Service attacks. The *feedgen* library allows supplying XML as content for some of the available fields. This XML will be parsed and integrated into the existing XML tree. During this process, feedgen is vulnerable to XML Denial of Service Attacks (e.g. XML Bomb). This becomes a concern in particular if feedgen is used to include content from untrused sources and if XML (including XHTML) is directly included instead of providing plain tex content only. This problem has been fixed in feedgen 0.9.0 which disallows XML entity expansion and external resources. See: CVE-2020-5227.",
-            "cve": "CVE-2020-5227",
-            "id": "pyup.io-37778",
+            "advisory": "Instana 1.20.2 upgrades the `event-loop-lag` because of security vulnerabilities in its dependency tree.",
+            "cve": "PVE-2021-34809",
+            "id": "pyup.io-34809",
             "specs": [
-                "<0.9.0"
+                "<1.20.2"
             ],
-            "v": "<0.9.0"
+            "v": "<1.20.2"
         }
     ],
-    "feedparser": [
-        {
-            "advisory": "Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0 allows remote attackers to inject arbitrary web script or HTML via vectors involving nested CDATA stanzas.",
-            "cve": "CVE-2009-5065",
-            "id": "pyup.io-25815",
-            "specs": [
-                "<5.0"
-            ],
-            "v": "<5.0"
-        },
-        {
-            "advisory": "feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) before 5.0.1 allows remote attackers to cause a denial of service (application crash) via a malformed DOCTYPE declaration.",
-            "cve": "CVE-2011-1156",
-            "id": "pyup.io-33125",
-            "specs": [
-                "<5.0.1"
-            ],
-            "v": "<5.0.1"
-        },
-        {
-            "advisory": "Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via malformed XML comments.",
-            "cve": "CVE-2011-1157",
-            "id": "pyup.io-33126",
-            "specs": [
-                "<5.0.1"
-            ],
-            "v": "<5.0.1"
-        },
-        {
-            "advisory": "Cross-site scripting (XSS) vulnerability in feedparser.py in Universal Feed Parser (aka feedparser or python-feedparser) 5.x before 5.0.1 allows remote attackers to inject arbitrary web script or HTML via an unexpected URI scheme, as demonstrated by a javascript: URI.",
-            "cve": "CVE-2011-1158",
-            "id": "pyup.io-33127",
-            "specs": [
-                "<5.0.1"
-            ],
-            "v": "<5.0.1"
-        },
+    "instawow": [
         {
-            "advisory": "Universal Feed Parser (aka feedparser or python-feedparser) before 5.1.2 allows remote attackers to cause a denial of service (memory consumption) via a crafted XML ENTITY declaration in a non-ASCII encoded document.",
-            "cve": "CVE-2012-2921",
-            "id": "pyup.io-25819",
+            "advisory": "Instawow 1.35.0 improves security by refusing requests to the RPC API which do not originate from the Instawow client (same origin).\r\nhttps://github.com/layday/instawow/commit/478d86bd06819a099c679d4b64d739c0a70080a8",
+            "cve": "PVE-2021-43742",
+            "id": "pyup.io-43742",
             "specs": [
-                "<5.1.2"
+                "<1.35.0"
             ],
-            "v": "<5.1.2"
+            "v": "<1.35.0"
         }
     ],
-    "fiduswriter": [
-        {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-40866",
-            "specs": [
-                "<3.9.24"
-            ],
-            "v": "<3.9.24"
-        },
+    "intelmq": [
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'django' to v3.1.12 to include security fixes.",
-            "cve": "CVE-2021-32052",
-            "id": "pyup.io-43515",
+            "advisory": "Intelmq through 2.1.1 is not secure. Its backend incorrectly handles messages given by user-input in the \"send\" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the web server.",
+            "cve": "PVE-2021-38326",
+            "id": "pyup.io-38326",
             "specs": [
-                "<3.9.24"
+                "<=2.1.1"
             ],
-            "v": "<3.9.24"
-        },
+            "v": "<=2.1.1"
+        }
+    ],
+    "intelmq-manager": [
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-43506",
+            "advisory": "Intelmq-manager 2.1.1 includes a fix for CVE-2020-11016: IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the \"send\" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.",
+            "cve": "CVE-2020-11016",
+            "id": "pyup.io-40849",
             "specs": [
-                "<3.9.24"
+                ">=1.1.0,<2.1.1"
             ],
-            "v": "<3.9.24"
-        },
+            "v": ">=1.1.0,<2.1.1"
+        }
+    ],
+    "intensity-normalization": [
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-43507",
+            "advisory": "Intensity-normalization 2.1.2 updates its dependency 'pip' minimum version to v21.3 to include a security fix.",
+            "cve": "CVE-2021-3572",
+            "id": "pyup.io-44576",
             "specs": [
-                "<3.9.24"
+                "<2.1.2"
             ],
-            "v": "<3.9.24"
-        },
+            "v": "<2.1.2"
+        }
+    ],
+    "interpret-community": [
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-25288",
-            "id": "pyup.io-43508",
+            "advisory": "Interpret-community 0.12.1 upgrades websocket-extensions for security reasons.",
+            "cve": "PVE-2021-38442",
+            "id": "pyup.io-38442",
             "specs": [
-                "<3.9.24"
+                "<0.12.1"
             ],
-            "v": "<3.9.24"
-        },
+            "v": "<0.12.1"
+        }
+    ],
+    "invenio": [
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28676",
-            "id": "pyup.io-43509",
+            "advisory": "Invenio 0.90.0 includes a new possibility of secure HTTPS authentication while keeping the rest of the site non-HTTPS (WebSession).",
+            "cve": "PVE-2021-38733",
+            "id": "pyup.io-38733",
             "specs": [
-                "<3.9.24"
+                "<0.90.0"
             ],
-            "v": "<3.9.24"
+            "v": "<0.90.0"
         },
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28677",
-            "id": "pyup.io-43510",
+            "advisory": "Invenio 0.99.0 fixes an alert deletion tool vulnerability (WebAlert), it includes a new password reset mechanism using new secure mail cookies and temporary role membership facilities (WebAccess, WebSession), and it also includes a script that will update your local user table in order to use encrypted passwords for more security.",
+            "cve": "PVE-2021-38734",
+            "id": "pyup.io-38734",
             "specs": [
-                "<3.9.24"
+                "<0.99.0"
             ],
-            "v": "<3.9.24"
+            "v": "<0.99.0"
         },
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28678",
-            "id": "pyup.io-43511",
+            "advisory": "Invenio 1.0.2 includes a fix for a XSS vulnerability in the debug information via 'verbose' parameter in the external search facility.\r\nhttps://github.com/inveniosoftware/invenio/commit/c089ce6cee2d3dcf1eef5126628f0707e10a7c8f",
+            "cve": "PVE-2021-25854",
+            "id": "pyup.io-25854",
             "specs": [
-                "<3.9.24"
+                "<1.0.2"
             ],
-            "v": "<3.9.24"
+            "v": "<1.0.2"
         },
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'django' to v3.1.12 to include security fixes.",
-            "cve": "CVE-2021-31542",
-            "id": "pyup.io-43512",
+            "advisory": "Invenio 1.1.2 fixes a XSS vulnerability due to lack of escaping variables in output.\r\nhttps://github.com/inveniosoftware/invenio/commit/ec02244fa270f02512cb1905d804b66d78572564",
+            "cve": "PVE-2021-25855",
+            "id": "pyup.io-25855",
             "specs": [
-                "<3.9.24"
+                "<1.1.2"
             ],
-            "v": "<3.9.24"
+            "v": "<1.1.2"
         },
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'django' to v3.1.12 to include security fixes.",
-            "cve": "CVE-2021-33203",
-            "id": "pyup.io-43513",
+            "advisory": "Invenio 2.0.5 disables debug mode when using standard Docker image. It uses Docker compose to set the variable instead.",
+            "cve": "PVE-2021-38741",
+            "id": "pyup.io-38741",
             "specs": [
-                "<3.9.24"
+                "<2.0.5"
             ],
-            "v": "<3.9.24"
+            "v": "<2.0.5"
         },
         {
-            "advisory": "Fiduswriter 3.9.24 updates its dependency 'django' to v3.1.12 to include security fixes.",
-            "cve": "CVE-2021-33571",
-            "id": "pyup.io-43514",
+            "advisory": "Invenio 2.0.6 fixes potential XSS issues by changing main flash messages template so that they are not displayed as safe HTML by default.\r\nhttps://github.com/inveniosoftware/invenio/commit/ecb6d6e79282fb555483d3133bf3e61dfeaf2e64",
+            "cve": "PVE-2021-38740",
+            "id": "pyup.io-38740",
             "specs": [
-                "<3.9.24"
+                "<2.0.6"
             ],
-            "v": "<3.9.24"
+            "v": "<2.0.6"
         }
     ],
-    "fincity-django-allauth": [
-        {
-            "advisory": "In fincity-django-allauth 0.18.0, the Persona provider now requires the ``AUDIENCE`` parameter to be explicitly configured, as required by the Persona specification for security reasons. Also, the inline Javascript is removed from the ``fbconnect.html`` template, which allows for a more strict ``Content-Security-Policy``. If you were using the builtin ``fbconnect.html`` this change should go by unnoticed.",
-            "cve": "PVE-2021-37466",
-            "id": "pyup.io-37466",
-            "specs": [
-                "<0.18.0"
-            ],
-            "v": "<0.18.0"
-        },
+    "invenio-admin": [
         {
-            "advisory": "Version prior to fincity-django-allauth 0.28.0 contained a vulnerability allowing an attacker to alter the provider specific settings for ``SCOPE`` and/or ``AUTH_PARAMS`` (part of the larger ``SOCIALACCOUNT_PROVIDERS`` setting). The changes would persist across subsequent requests for all users, provided these settings were explicitly set within your project. These settings translate directly into request parameters, giving the attacker undesirable control over the OAuth(2) handshake. You are not affected if you did not explicitly configure these settings.",
-            "cve": "PVE-2021-37464",
-            "id": "pyup.io-37464",
+            "advisory": "invenio-admin 1.1.1 has the minimum version of Flask-Admin bumped to v1.5.3 due to Cross-Site Scripting\r\n  vulnerability in previous versions.",
+            "cve": "PVE-2021-36759",
+            "id": "pyup.io-36759",
             "specs": [
-                "<0.28.0"
+                "<1.0.1",
+                "==1.1.0"
             ],
-            "v": "<0.28.0"
+            "v": "<1.0.1,==1.1.0"
         },
         {
-            "advisory": "Password reset tokens in fincity-django-allauth 0.33.0 are prevented from being leaked through the password reset URL.",
-            "cve": "PVE-2021-38514",
-            "id": "pyup.io-38514",
+            "advisory": "invenio-admin 1.1.1 bumps Flask-Admin to v1.5.3 due to Cross-Site Scripting vulnerability in previous versions",
+            "cve": "PVE-2021-38011",
+            "id": "pyup.io-38011",
             "specs": [
-                "<0.33.0"
+                "<1.1.1"
             ],
-            "v": "<0.33.0"
-        },
+            "v": "<1.1.1"
+        }
+    ],
+    "invenio-app": [
         {
-            "advisory": "Before fincity-django-allauth 0.34.0, the \"Set Password\" view did not properly check whether or not the user already had a usable password set. This allowed an attacker to set the password without providing the current password, but only in case the attacker already gained control over the victim's session.",
-            "cve": "PVE-2021-37463",
-            "id": "pyup.io-37463",
+            "advisory": "Invenio-app 1.1.1 fixes a security issue where APP_ALLOWED_HOSTS was not always being checked, and thus could allow host header injection attacks.",
+            "cve": "PVE-2021-37311",
+            "id": "pyup.io-37311",
             "specs": [
-                "<0.34.0"
+                "<1.1.1"
             ],
-            "v": "<0.34.0"
-        },
+            "v": "<1.1.1"
+        }
+    ],
+    "invenio-app-ils": [
         {
-            "advisory": "As an extra security measure on top of what the standard Django password reset token generator is already facilitating, allauth in fincity-django-allauth 0.35.0 adds the user email address to the hash such that whenever the user's email address changes the token is invalidated.",
-            "cve": "PVE-2021-37462",
-            "id": "pyup.io-37462",
+            "advisory": "Invenio-app-ils 1.0.0a28 adds cookies configuration for improved security.",
+            "cve": "PVE-2021-40030",
+            "id": "pyup.io-40030",
             "specs": [
-                "<0.35.0"
+                "<1.0.0a28"
             ],
-            "v": "<0.35.0"
-        },
+            "v": "<1.0.0a28"
+        }
+    ],
+    "invenio-communities": [
         {
-            "advisory": "The authentication backend in fincity-django-allauth before 0.36.0 did not invoke the `user_can_authenticate()` method, potentially allowing users with `is_active=False` to authenticate when the allauth authentication backend was used in a non allauth context.",
-            "cve": "PVE-2021-38513",
-            "id": "pyup.io-38513",
+            "advisory": "invenio-communities before 1.0.0a20 allows XSS.",
+            "cve": "CVE-2019-1020005",
+            "id": "pyup.io-42260",
             "specs": [
-                "<0.36.0"
+                "<1.0.0a20"
             ],
-            "v": "<0.36.0"
-        },
-        {
-            "advisory": "Before fincity-django-allauth 0.38.0, the '{% user_display user %}' tag wasn't escaped properly. Depending on the username validation rules, this could allow XSS.\r\nhttps://github.com/tiru777/fincity-django-allauth/commit/85ca0c710bfc27f5e74a95c5144fc497cffdb5fa",
-            "cve": "PVE-2021-37465",
-            "id": "pyup.io-37465",
+            "v": "<1.0.0a20"
+        }
+    ],
+    "invenio-previewer": [
+        {
+            "advisory": "invenio-previewer before 1.0.0a12 allows XSS.",
+            "cve": "CVE-2019-1020019",
+            "id": "pyup.io-42261",
             "specs": [
-                "<0.38.0"
+                "<1.0.0a12"
             ],
-            "v": "<0.38.0"
+            "v": "<1.0.0a12"
         }
     ],
-    "firepyer": [
+    "invenio-records": [
         {
-            "advisory": "Firepyer 0.0.2 adds system, security policy and ICMP methods.",
-            "cve": "PVE-2021-39442",
-            "id": "pyup.io-39442",
+            "advisory": "Invenio-records versions 1.0.2, 1.1.1 and 1.2.2 include a fix for CVE-2019-1020003, a XSS vulnerability.\r\nhttps://github.com/inveniosoftware/invenio-records/security/advisories/GHSA-vxh3-mvv7-265j",
+            "cve": "CVE-2019-1020003",
+            "id": "pyup.io-42259",
             "specs": [
-                "<0.0.2"
+                "<1.0.2",
+                "==1.1.0",
+                ">=1.2.0,<1.2.2"
             ],
-            "v": "<0.0.2"
+            "v": "<1.0.2,==1.1.0,>=1.2.0,<1.2.2"
         }
     ],
-    "flambe": [
+    "invenio-search": [
         {
-            "advisory": "Flambe 0.4.16 fixes a vulnerability with PyYAML < 5.3.1.",
-            "cve": "PVE-2021-38138",
-            "id": "pyup.io-38138",
+            "advisory": "Invenio-search 0.1.3 fixes a potential XSS issues by changing search flash messages template so that they are not displayed as safe HTML by default.\r\nhttps://github.com/inveniosoftware/invenio-search/commit/deb2fe3213d6f8dcab41714a579dd13dcfba6e87",
+            "cve": "PVE-2021-25856",
+            "id": "pyup.io-25856",
             "specs": [
-                "<0.4.16"
+                "<0.1.3"
             ],
-            "v": "<0.4.16"
+            "v": "<0.1.3"
         }
     ],
-    "flashfocus": [
+    "iotedgehubdev": [
         {
-            "advisory": "Flashfocus 1.2.1 updates pyyaml version to >=4.2b1 to include a security fix.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-36825",
+            "advisory": "Lotedgehubdev 0.14.5 upgrades underlying dependencies to address vulnerability issues.",
+            "cve": "PVE-2021-40098",
+            "id": "pyup.io-40098",
             "specs": [
-                "<1.2.1"
+                "<0.14.5"
             ],
-            "v": "<1.2.1"
+            "v": "<0.14.5"
         }
     ],
-    "flask": [
+    "ipsilon": [
         {
-            "advisory": "flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3.",
-            "cve": "CVE-2018-1000656",
-            "id": "pyup.io-36388",
+            "advisory": "The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via an HTTP response. See: CVE-2015-5216.",
+            "cve": "CVE-2015-5216",
+            "id": "pyup.io-37897",
             "specs": [
-                "<0.12.3"
+                ">=0.1.0,<1.0.1"
             ],
-            "v": "<0.12.3"
-        },
+            "v": ">=0.1.0,<1.0.1"
+        }
+    ],
+    "ipwb": [
         {
-            "advisory": "flask 0.6.1 fixes a security problem that allowed clients to download arbitrary files  if the host server was a windows based operating system and the client  uses backslashes to escape the directory the files where exposed from.",
-            "cve": "PVE-2021-25820",
-            "id": "pyup.io-25820",
+            "advisory": "ipwb 0.2018.08.29.1434 updates Flask use in ipwb replay due to a security vulnerability.",
+            "cve": "PVE-2021-36492",
+            "id": "pyup.io-36492",
             "specs": [
-                "<0.6.1"
+                "<0.2018.08.29.1434"
             ],
-            "v": "<0.6.1"
+            "v": "<0.2018.08.29.1434"
         },
         {
-            "advisory": "The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. See: CVE-2019-1010083. (NOTE: this may overlap CVE-2018-1000656.)",
-            "cve": "CVE-2019-1010083",
-            "id": "pyup.io-38654",
+            "advisory": "Ipwb 0.2019.07.26.1435 updates Flask for replay to the latest version to address a security vulnerability in an older versions.",
+            "cve": "PVE-2021-37304",
+            "id": "pyup.io-37304",
             "specs": [
-                "<1.0"
+                "<0.2019.07.26.1435"
             ],
-            "v": "<1.0"
+            "v": "<0.2019.07.26.1435"
         }
     ],
-    "flask-admin": [
+    "ipython": [
         {
-            "advisory": "Flask-admin 1.3.0 fixes an XSS vulnerability escaping html in column_editable_list values in the WTForms widget.\r\nhttps://github.com/flask-admin/flask-admin/commit/f447db0c78c03235d0dd6bdce0c5365fc6a7c321\r\nhttps://github.com/flask-admin/flask-admin/pull/1002\r\nhttps://github.com/flask-admin/flask-admin/issues/1000",
-            "cve": "PVE-2021-25821",
-            "id": "pyup.io-25821",
+            "advisory": "Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.",
+            "cve": "CVE-2015-6938",
+            "id": "pyup.io-33132",
             "specs": [
-                "<1.3.0"
+                "<3.2.2"
             ],
-            "v": "<1.3.0"
+            "v": "<3.2.2"
         },
         {
-            "advisory": "Flask-Admin 1.5.3 includes a fix for CVE-2018-16516: Helpers.py in Flask-Admin 1.5.2 has Reflected XSS via a crafted URL.\r\nhttps://github.com/flask-admin/flask-admin/pull/1699",
-            "cve": "CVE-2018-16516",
-            "id": "pyup.io-36437",
+            "advisory": "The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.",
+            "cve": "CVE-2015-7337",
+            "id": "pyup.io-33133",
             "specs": [
-                "<=1.5.2"
+                "<3.2.2"
             ],
-            "v": "<=1.5.2"
-        }
-    ],
-    "flask-api-tools": [
+            "v": "<3.2.2"
+        },
         {
-            "advisory": "Flask-api-tools 1.6.2 fixes a security vulnerability discovered and patched in a dependency. See also <https://github.com/mozilla/bleach/releases/tag/v3.3.0>.",
-            "cve": "PVE-2021-40044",
-            "id": "pyup.io-40044",
+            "advisory": "Ipython versions 8.0.1, 7.31.1, 7.16.3 and 5.11 include a fix for CVE-2022-21699: Affected versions are subject to an arbitrary code execution vulnerability achieved by not properly managing cross user temporary files. This vulnerability allows one user to run code as another on the same machine.\r\nhttps://github.com/ipython/ipython/security/advisories/GHSA-pq7m-3gw7-gq5x",
+            "cve": "CVE-2022-21699",
+            "id": "pyup.io-44634",
             "specs": [
-                "<1.6.2"
+                ">=8.0.0a0,<8.0.1",
+                ">=7.17.0,<7.31.1",
+                ">=6.0.0a0,<7.16.3",
+                "<5.11"
             ],
-            "v": "<1.6.2"
+            "v": ">=8.0.0a0,<8.0.1,>=7.17.0,<7.31.1,>=6.0.0a0,<7.16.3,<5.11"
         }
     ],
-    "flask-appbuilder": [
+    "irc3": [
         {
-            "advisory": "Flask-appbuilder 0.2.0 includes reset password corrections.",
-            "cve": "PVE-2021-37060",
-            "id": "pyup.io-37060",
+            "advisory": "irc3 before 0.4.4 is vulnerable to several undisclosed security issues.",
+            "cve": "PVE-2021-25859",
+            "id": "pyup.io-25859",
             "specs": [
-                "<0.2.0"
+                "<0.4.4"
             ],
-            "v": "<0.2.0"
-        },
+            "v": "<0.4.4"
+        }
+    ],
+    "iroin-python-pptx": [
         {
-            "advisory": "flask-appbuilder 0.7.8 adds new, added optional parameter \"label\" and \"category_label\" for menu items, better security and i18n",
-            "cve": "PVE-2021-37905",
-            "id": "pyup.io-37905",
+            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
+            "cve": "CVE-2016-9189",
+            "id": "pyup.io-43505",
             "specs": [
-                "<0.7.8"
+                "<0.6.12"
             ],
-            "v": "<0.7.8"
+            "v": "<0.6.12"
         },
         {
-            "advisory": "Flask-appbuilder 0.7.8 has better security than previous versions. No details are given.",
-            "cve": "PVE-2021-37064",
-            "id": "pyup.io-37064",
+            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
+            "cve": "CVE-2014-9601",
+            "id": "pyup.io-40563",
             "specs": [
-                "<0.7.8"
+                "<0.6.12"
             ],
-            "v": "<0.7.8"
+            "v": "<0.6.12"
         },
         {
-            "advisory": "flask-appbuilder 1.9.0 prevents masquerade attacks through oauth providers",
-            "cve": "PVE-2021-37828",
-            "id": "pyup.io-37828",
+            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
+            "cve": "CVE-2016-3076",
+            "id": "pyup.io-43499",
             "specs": [
-                "<1.9.0"
+                "<0.6.12"
             ],
-            "v": "<1.9.0"
+            "v": "<0.6.12"
         },
         {
-            "advisory": "Flask-appbuilder 1.9.0 prevent masquerade attacks through OAuth providers and fixes crash on OAuth errors, which was a security concern.",
-            "cve": "PVE-2021-37061",
-            "id": "pyup.io-37061",
+            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
+            "cve": "CVE-2016-0740",
+            "id": "pyup.io-43500",
             "specs": [
-                "<1.9.0"
+                "<0.6.12"
             ],
-            "v": "<1.9.0"
+            "v": "<0.6.12"
         },
         {
-            "advisory": "flask-appbuilder 1.9.2 fixes possible SQL injection vulnerability",
-            "cve": "PVE-2021-37297",
-            "id": "pyup.io-37297",
+            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
+            "cve": "CVE-2016-0775",
+            "id": "pyup.io-43501",
             "specs": [
-                "<1.9.2"
+                "<0.6.12"
             ],
-            "v": "<1.9.2"
+            "v": "<0.6.12"
         },
         {
-            "advisory": "Flask-appbuilder 1.9.3 fixes a possible SQL injection vulnerability on order by clauses.",
-            "cve": "PVE-2021-38900",
-            "id": "pyup.io-38900",
+            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
+            "cve": "CVE-2016-2533",
+            "id": "pyup.io-43502",
             "specs": [
-                "<1.9.3"
+                "<0.6.12"
             ],
-            "v": "<1.9.3"
+            "v": "<0.6.12"
         },
         {
-            "advisory": "Flask-appbuilder 2.2.2 make userstatschartview optional (a security issue) (#1239).",
-            "cve": "PVE-2021-37059",
-            "id": "pyup.io-37059",
+            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
+            "cve": "CVE-2016-4009",
+            "id": "pyup.io-43503",
             "specs": [
-                "<2.2.2"
+                "<0.6.12"
             ],
-            "v": "<2.2.2"
+            "v": "<0.6.12"
         },
         {
-            "advisory": "Flask-appbuilder 2.2.4 toggles pvm, perm and vm mvc views config options (a security issue) (#1259).",
-            "cve": "PVE-2021-37130",
-            "id": "pyup.io-37130",
+            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
+            "cve": "CVE-2016-9190",
+            "id": "pyup.io-43504",
             "specs": [
-                "<2.2.4"
+                "<0.6.12"
             ],
-            "v": "<2.2.4"
-        },
+            "v": "<0.6.12"
+        }
+    ],
+    "ironic-discoverd": [
         {
-            "advisory": "Flask-appbuilder 3.1.1 includes a security fix related to permissions mapping.\r\nhttps://github.com/dpgaspar/Flask-AppBuilder/commit/54fc4131ef6544ffb065157a90ebcfcafe40c479",
-            "cve": "PVE-2021-42155",
-            "id": "pyup.io-42155",
+            "advisory": "OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.",
+            "cve": "CVE-2015-5306",
+            "id": "pyup.io-25860",
             "specs": [
-                "<3.1.1"
+                "<2.3.0"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<2.3.0"
+        }
+    ],
+    "ironic-inspector": [
         {
-            "advisory": "Flask-appbuilder version 3.2.2 includes a fix for CVE-2021-32805: In affected versions, if using flask-appbuilder OAuth, an attacker can share a carefully crafted URL with a trusted domain for an application built with flask-appbuilder and this URL can redirect a user to a malicious site. This is an open redirect vulnerability. If upgrading is infeasible,  as a workaround, users may filter HTTP traffic containing \"?next={next-site}\" where the \"next-site\" domain is different from the application you are protecting.\r\nhttps://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-624f-cqvr-3qw4\r\nhttps://github.com/dpgaspar/Flask-AppBuilder/commit/6af28521589599b1dbafd6313256229ee9a4fa74",
-            "cve": "CVE-2021-32805",
-            "id": "pyup.io-41284",
+            "advisory": "OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.",
+            "cve": "CVE-2015-5306",
+            "id": "pyup.io-25861",
             "specs": [
-                "<3.2.2"
+                "<2.3.0"
             ],
-            "v": "<3.2.2"
+            "v": "<2.3.0"
         },
         {
-            "advisory": "Flask-AppBuilder 3.3.4 includes a fix for CVE-2021-41265: Versions prior to 3.3.4 contain an improper authentication vulnerability in the REST API. The issue allows for a malicious actor with a carefully crafted request to successfully authenticate and gain access to existing protected REST API endpoints. This only affects non database authentication types and new REST API endpoints.\r\nhttps://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-m3rf-7m4w-r66q",
-            "cve": "CVE-2021-41265",
-            "id": "pyup.io-43309",
+            "advisory": "A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service. See: CVE-2019-10141.",
+            "cve": "CVE-2019-10141",
+            "id": "pyup.io-37319",
             "specs": [
-                "<3.3.4"
+                "<5.0.2",
+                ">=6.0,<6.0.3",
+                ">=7.0,<7.2.4",
+                ">=8.0,<8.0.3",
+                ">=8.1,<8.2.1"
             ],
-            "v": "<3.3.4"
-        },
+            "v": "<5.0.2,>=6.0,<6.0.3,>=7.0,<7.2.4,>=8.0,<8.0.3,>=8.1,<8.2.1"
+        }
+    ],
+    "iso6709": [
         {
-            "advisory": "Flask-AppBuilder is a development framework, built on top of Flask. User enumeration in database authentication in Flask-AppBuilder <= 3.2.3. Allows for a non authenticated user to enumerate existing accounts by timing the response time from the server when you are logging in. Upgrade to version 3.3.0 or higher to resolve.",
-            "cve": "CVE-2021-29621",
-            "id": "pyup.io-40630",
+            "advisory": "iso6709 0.1.4 bumped development versions for security fixes",
+            "cve": "PVE-2021-37250",
+            "id": "pyup.io-37250",
             "specs": [
-                "<=3.2.3"
+                "<0.1.4"
             ],
-            "v": "<=3.2.3"
+            "v": "<0.1.4"
         }
     ],
-    "flask-async": [
+    "isogeo-export-xl": [
         {
-            "advisory": "Flask-async 0.6.1 fixes a security problem that allowed clients to download arbitrary files if the host server was a windows based operating system and the client used backslashes to escape the directory the files where exposed from.\r\nhttps://github.com/mrdon/flask/commit/aeed530e3221c1b445c13269dcd2fb67548bcefc",
-            "cve": "PVE-2021-25822",
-            "id": "pyup.io-25822",
+            "advisory": "Isogeo-export-xl 1.3.0 updates its dependency 'bleach' to v3.1.1. to include a security fix.",
+            "cve": "CVE-2020-6802",
+            "id": "pyup.io-38286",
             "specs": [
-                "<0.6.1"
+                "<1.3.0"
             ],
-            "v": "<0.6.1"
+            "v": "<1.3.0"
         }
     ],
-    "flask-caching": [
+    "isso": [
         {
-            "advisory": "The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local privilege escalation. If an attacker gains access to cache storage (e.g., filesystem, Memcached, Redis, etc.), they can construct a crafted payload, poison the cache, and execute Python code.",
-            "cve": "CVE-2021-33026",
-            "id": "pyup.io-40459",
+            "advisory": "isso 0.6 fixes a cross-site request forgery vulnerability for comment creation, voting, editing and deletion.",
+            "cve": "PVE-2021-25862",
+            "id": "pyup.io-25862",
             "specs": [
-                "<=1.10.1"
+                "<0.6"
             ],
-            "v": "<=1.10.1"
+            "v": "<0.6"
         }
     ],
-    "flask-cors": [
+    "isso-cn": [
         {
-            "advisory": "An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format. See CVE-2020-25032.",
-            "cve": "CVE-2020-25032",
-            "id": "pyup.io-38745",
+            "advisory": "Isso-cn 0.6 fixes a cross-site request forgery vulnerability for comment creation, voting, editing and deletion.",
+            "cve": "PVE-2021-37714",
+            "id": "pyup.io-37714",
             "specs": [
-                "<3.0.9"
+                "<0.6"
             ],
-            "v": "<3.0.9"
-        }
-    ],
-    "flask-exceptions": [
+            "v": "<0.6"
+        },
         {
-            "advisory": "flask-exceptions 1.2.2 update is for security vulnerabilities",
-            "cve": "PVE-2021-36812",
-            "id": "pyup.io-36812",
+            "advisory": "Isso-cn 0.7 fixes a malicious HTML injection (due to wrong API usage). All unknown/unsafe HTML tags are now removed from the output (`html5lib` 0.99(9) or later) or properly escaped (older `html5lib` versions).",
+            "cve": "PVE-2021-37713",
+            "id": "pyup.io-37713",
             "specs": [
-                "<1.2.2"
+                "<0.7"
             ],
-            "v": "<1.2.2"
+            "v": "<0.7"
         }
     ],
-    "flask-flatpages": [
+    "jake": [
         {
-            "advisory": "Flask-flatpages 0.7.1 updates its dependencies to resolve some severe security alerts.",
-            "cve": "PVE-2021-37077",
-            "id": "pyup.io-37077",
+            "advisory": "Jake 0.2.59 includes a fix for CVE-2020-27783: A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.",
+            "cve": "CVE-2020-27783",
+            "id": "pyup.io-39256",
             "specs": [
-                "<0.7.1"
+                "<0.2.59"
             ],
-            "v": "<0.7.1"
-        }
-    ],
-    "flask-i18n": [
+            "v": "<0.2.59"
+        },
         {
-            "advisory": "flask-i18n 1.1.1 update is for security vulnerabilities",
-            "cve": "PVE-2021-36814",
-            "id": "pyup.io-36814",
+            "advisory": "Jake 0.2.69 updates its dependency 'lxml' to v4.6.3 to include a security fix.",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-40819",
             "specs": [
-                "<1.1.1"
+                "<0.2.69"
             ],
-            "v": "<1.1.1"
-        }
-    ],
-    "flask-images": [
+            "v": "<0.2.69"
+        },
         {
-            "advisory": "flask-images 1.1.3 fixes 3 security bugs, each of which would allow for reading any image on disk.",
-            "cve": "PVE-2021-25823",
-            "id": "pyup.io-25823",
+            "advisory": "Jake version 0.2.70 updates its dependency \"Pyyaml\" to v5.4.1 to include a security fix.",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-40820",
             "specs": [
-                "<1.1.3"
+                "<0.2.70"
             ],
-            "v": "<1.1.3"
+            "v": "<0.2.70"
         }
     ],
-    "flask-ipban": [
+    "jcrypt": [
         {
-            "advisory": "flask-ipban 0.2.2 fixes a yaml loading vulnerability.",
-            "cve": "PVE-2021-36997",
-            "id": "pyup.io-36997",
+            "advisory": "The encryption method in Jcrypt 1.1.0 includes security and speed improvements.",
+            "cve": "PVE-2021-38425",
+            "id": "pyup.io-38425",
             "specs": [
-                "<0.2.2"
+                "<1.1.0"
             ],
-            "v": "<0.2.2"
+            "v": "<1.1.0"
         }
     ],
-    "flask-logger": [
+    "jeIlyfish": [
         {
-            "advisory": "flask-logger 1.0.3 updates dependencies for security issues in Flask.",
-            "cve": "PVE-2021-36811",
-            "id": "pyup.io-36811",
+            "advisory": "JeIlyfish is a malicious Python library caught stealing SSH and GPG keys. Note that the first \"L\" is a capital \"i\". Reference: <https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/>.",
+            "cve": "PVE-2021-38694",
+            "id": "pyup.io-38694",
             "specs": [
-                "<1.0.3"
+                ">0",
+                "<0"
             ],
-            "v": "<1.0.3"
+            "v": ">0,<0"
         }
     ],
-    "flask-micropub": [
+    "jetforce": [
         {
-            "advisory": "flask-micropub 0.2.2 fixes a vulnerability; re-discover the authorization_endpoint and token_endpoint at each stage in the flow. Prevents a buggy or malicious authorization_endpoint from giving you credentials for another user's domain name.",
-            "cve": "PVE-2021-25824",
-            "id": "pyup.io-25824",
+            "advisory": "For security, unhandled exceptions in jetforce 0.2.0 display a generic error message instead of the plain exception string.",
+            "cve": "PVE-2021-38130",
+            "id": "pyup.io-38130",
             "specs": [
-                "<0.2.2"
+                "<0.2.0"
             ],
-            "v": "<0.2.2"
-        }
-    ],
-    "flask-monitoring": [
+            "v": "<0.2.0"
+        },
         {
-            "advisory": "flask-monitoring 1.10.0 adds security for automatic endpoint-data retrieval",
-            "cve": "PVE-2021-37847",
-            "id": "pyup.io-37847",
+            "advisory": "Jetforce 0.2.3 fixes a security vulnerability that allowed maliciously crafted URLs to break out of the root server directory.",
+            "cve": "PVE-2021-38324",
+            "id": "pyup.io-38324",
             "specs": [
-                "<1.10.0"
+                "<0.2.3"
             ],
-            "v": "<1.10.0"
+            "v": "<0.2.3"
         }
     ],
-    "flask-oauthlib": [
+    "jiant": [
         {
-            "advisory": "flask-oauthlib before 0.9.1 improves on security. (Without further details).",
-            "cve": "PVE-2021-25825",
-            "id": "pyup.io-25825",
+            "advisory": "Jiant 1.2.0 updates the NLTK requirement to version 3.4.5 to avoid a potential security issue.",
+            "cve": "PVE-2021-38864",
+            "id": "pyup.io-38864",
             "specs": [
-                "<0.9.1"
+                "<1.2.0"
             ],
-            "v": "<0.9.1"
+            "v": "<1.2.0"
         }
     ],
-    "flask-oidc": [
+    "jina": [
         {
-            "advisory": "flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect",
-            "cve": "CVE-2016-1000001",
-            "id": "pyup.io-25826",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29539",
+            "id": "pyup.io-41713",
             "specs": [
-                "<0.1.2"
+                "<2.0.0"
             ],
-            "v": "<0.1.2"
-        }
-    ],
-    "flask-pagedown": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flask-pagedown 0.1.4 uses secure URLs when request is secure.\r\nhttps://github.com/miguelgrinberg/flask-pagedown/issues/3\r\nhttps://github.com/miguelgrinberg/flask-pagedown/commit/50ba142994e47d584f5bdf083e0c47f4a9209aa4",
-            "cve": "PVE-2021-41280",
-            "id": "pyup.io-41280",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29525",
+            "id": "pyup.io-44061",
             "specs": [
-                "<0.1.4"
+                "<2.0.0"
             ],
-            "v": "<0.1.4"
-        }
-    ],
-    "flask-pyoidc": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flask-pyoidc before 3.7.0 did not properly validate the ID token according to the OIDC specification. It also still depended on a pyoidc version that is now known to not be secure.",
-            "cve": "PVE-2021-39225",
-            "id": "pyup.io-39225",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29519",
+            "id": "pyup.io-44062",
             "specs": [
-                "<3.7.0"
+                "<2.0.0"
             ],
-            "v": "<3.7.0"
-        }
-    ],
-    "flask-restless-ng": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flask-restless-ng 2.2.6 escapes user input in error messages to prevent potential server-side cross-site scripting.",
-            "cve": "PVE-2021-41218",
-            "id": "pyup.io-41218",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29522",
+            "id": "pyup.io-44063",
             "specs": [
-                "<2.2.6"
+                "<2.0.0"
             ],
-            "v": "<2.2.6"
-        }
-    ],
-    "flask-restx": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flask-restx version 0.5.1 includes a fix for CVE-2021-32838: Flask-RESTX before version 0.5.1 is vulnerable to ReDoS (Regular Expression Denial of Service) in email_regex.\r\nhttps://github.com/advisories/GHSA-3q6g-vf58-7m4g\r\nhttps://github.com/python-restx/flask-restx/blob/fd99fe11a88531f5f3441a278f7020589f9d2cc0/flask_restx/inputs.py#L51\r\nhttps://github.com/python-restx/flask-restx/commit/bab31e085f355dd73858fd3715f7ed71849656da\r\nhttps://github.com/python-restx/flask-restx/issues/372\r\nhttps://pypi.org/project/flask-restx/",
-            "cve": "CVE-2021-32838",
-            "id": "pyup.io-41752",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29524",
+            "id": "pyup.io-44064",
             "specs": [
-                "<0.5.1"
+                "<2.0.0"
             ],
-            "v": "<0.5.1"
-        }
-    ],
-    "flask-security-fork": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "flask-security-fork before 1.8.1 fixes a security bug when validating a confirmation token, also checks if the email that the token was created with matches the user's current email.",
-            "cve": "PVE-2021-25827",
-            "id": "pyup.io-25827",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29564",
+            "id": "pyup.io-44066",
             "specs": [
-                "<1.8.1"
+                "<2.0.0"
             ],
-            "v": "<1.8.1"
-        }
-    ],
-    "flask-security-too": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "All versions of flask-security-too are affected by CVE-2021-32618: Flask-Security-Too allows redirects after many successful views (e.g. /login) by honoring the ?next query param. There is code in FS to validate that the url specified in the next parameter is either relative OR has the same netloc (network location) as the requesting URL. This check utilizes Pythons urlsplit library. However many browsers are very lenient on the kind of URL they accept and 'fill in the blanks' when presented with a possibly incomplete URL. As a concrete example - setting http://login?next=\\\\\\github.com will pass FS's relative URL check however many browsers will gladly convert this to http://github.com. Thus an attacker could send such a link to an unwitting user, using a legitimate site and have it redirect to whatever site they want. This is considered a low severity due to the fact that if Werkzeug is used (which is very common with Flask applications) as the WSGI layer, it by default ALWAYS ensures that the Location header is absolute - thus making this attack vector mute. It is possible for application writers to modify this default behavior by setting the 'autocorrect_location_header=False'.",
-            "cve": "CVE-2021-32618",
-            "id": "pyup.io-40493",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29521",
+            "id": "pyup.io-44067",
             "specs": [
-                ">0"
+                "<2.0.0"
             ],
-            "v": ">0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "The Python \"Flask-Security-Too\" package is used for adding security features to your Flask application. It is an is a independently maintained version of Flask-Security based on the 3.0.0 version of Flask-Security. In Flask-Security-Too from version 3.3.0 and before version 3.4.5, the /login and /change endpoints can return the authenticated user's authentication token in response to a GET request. Since GET requests aren't protected with a CSRF token, this could lead to a malicious 3rd party site acquiring the authentication token. Version 3.4.5 and version 4.0.0 are patched. As a workaround, if you aren't using authentication tokens - you can set the SECURITY_TOKEN_MAX_AGE to \"0\" (seconds) which should make the token unusable. See CVE-2021-21241.",
-            "cve": "CVE-2021-21241",
-            "id": "pyup.io-39440",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29532",
+            "id": "pyup.io-44070",
             "specs": [
-                ">=3.3.0rc1,<3.4.5"
+                "<2.0.0"
             ],
-            "v": ">=3.3.0rc1,<3.4.5"
-        }
-    ],
-    "flask-sieve": [
+            "v": "<2.0.0"
+        },
+        {
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29616",
+            "id": "pyup.io-44071",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        },
+        {
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29543",
+            "id": "pyup.io-44072",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flask-sieve 1.0.4 fixes some vulnerabilities by updating the werkzeug package.",
-            "cve": "PVE-2021-39139",
-            "id": "pyup.io-39139",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29547",
+            "id": "pyup.io-44073",
             "specs": [
-                "<1.0.4"
+                "<2.0.0"
             ],
-            "v": "<1.0.4"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
-            "cve": "CVE-2020-5310",
-            "id": "pyup.io-37632",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29544",
+            "id": "pyup.io-44074",
             "specs": [
-                "<1.1.1"
+                "<2.0.0"
             ],
-            "v": "<1.1.1"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
-            "cve": "CVE-2020-5311",
-            "id": "pyup.io-43495",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29534",
+            "id": "pyup.io-44075",
             "specs": [
-                "<1.1.1"
+                "<2.0.0"
             ],
-            "v": "<1.1.1"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
-            "cve": "CVE-2020-5312",
-            "id": "pyup.io-43496",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29587",
+            "id": "pyup.io-44077",
             "specs": [
-                "<1.1.1"
+                "<2.0.0"
             ],
-            "v": "<1.1.1"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
-            "cve": "CVE-2020-5313",
-            "id": "pyup.io-43497",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29568",
+            "id": "pyup.io-44078",
             "specs": [
-                "<1.1.1"
+                "<2.0.0"
             ],
-            "v": "<1.1.1"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flask-sieve 1.1.1 updates Pillow to v6.2.2 to include security fixes.",
-            "cve": "CVE-2019-19911",
-            "id": "pyup.io-43498",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29566",
+            "id": "pyup.io-44079",
             "specs": [
-                "<1.1.1"
+                "<2.0.0"
             ],
-            "v": "<1.1.1"
-        }
-    ],
-    "flask-socketio": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flask-socketio 4.2.0 addresses potential websocket cross-origin attacks. See: <https://github.com/miguelgrinberg/python-engineio/issues/128>.",
-            "cve": "PVE-2021-37309",
-            "id": "pyup.io-37309",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29563",
+            "id": "pyup.io-44080",
             "specs": [
-                "<4.2.0"
+                "<2.0.0"
             ],
-            "v": "<4.2.0"
-        }
-    ],
-    "flask-statsdclient": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "flask-statsdclient 2.0.2 is for security vulnerabilities",
-            "cve": "PVE-2021-36813",
-            "id": "pyup.io-36813",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29560",
+            "id": "pyup.io-44081",
             "specs": [
-                "<2.0.2"
+                "<2.0.0"
             ],
-            "v": "<2.0.2"
-        }
-    ],
-    "flask-unchained": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flask-unchained 0.9.0 includes a security fix in salt configuration for the 'itsdangerous' 2.0+ and a security fix for redirect vulnerability.",
-            "cve": "PVE-2021-40628",
-            "id": "pyup.io-40628",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29550",
+            "id": "pyup.io-44082",
             "specs": [
-                "<0.9.0"
+                "<2.0.0"
             ],
-            "v": "<0.9.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "This affects the package Flask-Unchained before 0.9.0. When using the the _validate_redirect_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.",
-            "cve": "CVE-2021-23393",
-            "id": "pyup.io-40657",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29537",
+            "id": "pyup.io-44084",
             "specs": [
-                "<0.9.0"
+                "<2.0.0"
             ],
-            "v": "<0.9.0"
-        }
-    ],
-    "flask-user": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "This affects all versions of package Flask-User. When using the make_safe_url function, it is possible to bypass URL validation and redirect a user to an arbitrary URL by providing multiple back slashes such as /////evil.com/path or \\\\\\evil.com/path. This vulnerability is only exploitable if an alternative WSGI server other than Werkzeug is used, or the default behaviour of Werkzeug is modified using 'autocorrect_location_header=False.",
-            "cve": "CVE-2021-23401",
-            "id": "pyup.io-40904",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29514",
+            "id": "pyup.io-44085",
             "specs": [
-                "<=1.0.2.2"
+                "<2.0.0"
             ],
-            "v": "<=1.0.2.2"
-        }
-    ],
-    "flask-wtf": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flask-wtf 0.9.3 fixes how CSRF tokens are verified.\r\nhttps://github.com/wtforms/flask-wtf/pull/91/commits/91f70259660a106a49cd8cc2ccd137d47c9c393d",
-            "cve": "PVE-2021-42493",
-            "id": "pyup.io-42493",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29567",
+            "id": "pyup.io-44086",
             "specs": [
-                "<0.9.3"
+                "<2.0.0"
             ],
-            "v": "<0.9.3"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flask-wtf 0.9.5 adds missing CSRF tokens to all templates.\r\nhttps://github.com/wtforms/flask-wtf/commit/8e5998cd759d0a87a0197a87e7f780fcf84f2933",
-            "cve": "PVE-2021-42491",
-            "id": "pyup.io-42491",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29520",
+            "id": "pyup.io-44065",
             "specs": [
-                "<0.9.5"
+                "<2.0.0"
             ],
-            "v": "<0.9.5"
-        }
-    ],
-    "flatplan": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flatplan 1.2.0 updates its dependencies to fix vulnerability issues.",
-            "cve": "PVE-2021-40345",
-            "id": "pyup.io-40345",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29523",
+            "id": "pyup.io-44068",
             "specs": [
-                "<1.2.0"
+                "<2.0.0"
             ],
-            "v": "<1.2.0"
-        }
-    ],
-    "flex": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flex before 6.12.0 uses the unsafe 'yaml.load' function to load YAML files, leading to an attack vector that allows remote code execution. See CVE-2020-1747.",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-35155",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2020-8169",
+            "id": "pyup.io-44069",
             "specs": [
-                "<6.12.0"
+                "<2.0.0"
             ],
-            "v": "<6.12.0"
-        }
-    ],
-    "flora-blockchain": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Flora-blockchain 1.0b10 includes fixes for various Node.js security vulnerabilities.",
-            "cve": "PVE-2021-40983",
-            "id": "pyup.io-40983",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29610",
+            "id": "pyup.io-44076",
             "specs": [
-                "<1.0b10"
+                "<2.0.0"
             ],
-            "v": "<1.0b10"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flora-blockchain 1.0b8 removes the ability to pass in 'sk_seed' to plotting, to increase security.",
-            "cve": "PVE-2021-40985",
-            "id": "pyup.io-40985",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29545",
+            "id": "pyup.io-44083",
             "specs": [
-                "<1.0b8"
+                "<2.0.0"
             ],
-            "v": "<1.0b8"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flora-blockchain 1.0b9 starts to use the 'libsodium' dependency for additional security for Windows BLS Signature library and updates Node.js dependencies to fix security vulnerabilities.",
-            "cve": "PVE-2021-40984",
-            "id": "pyup.io-40984",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29589",
+            "id": "pyup.io-44087",
             "specs": [
-                "<1.0b9"
+                "<2.0.0"
             ],
-            "v": "<1.0b9"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flora-blockchain 1.0rc5 updates the 'aiohttp' underlying library to 3.7.4 to address a low severity issue.",
-            "cve": "PVE-2021-40980",
-            "id": "pyup.io-40980",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29512",
+            "id": "pyup.io-44088",
             "specs": [
-                "<1.0rc5"
+                "<2.0.0"
             ],
-            "v": "<1.0rc5"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flora-blockchain 1.0rc6 takes secret words a prompt on the command line or stdin instead of command line arguments for better security for 'chia keys add' command. This version also adds rate limiting for full node. Limitation can and will lead to short term bans of certain peers that didn't behave in expected ways. This is ok and normal, but strong defense against many DDOS attacks.",
-            "cve": "PVE-2021-40979",
-            "id": "pyup.io-40979",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29533",
+            "id": "pyup.io-44089",
             "specs": [
-                "<1.0rc6"
+                "<2.0.0"
             ],
-            "v": "<1.0rc6"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Flora-blockchain 1.1.3 includes a fix to mitigate 1-3 mojo dust attacks.",
-            "cve": "PVE-2021-40978",
-            "id": "pyup.io-40978",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29535",
+            "id": "pyup.io-44090",
             "specs": [
-                "<1.1.3"
+                "<2.0.0"
             ],
-            "v": "<1.1.3"
-        }
-    ],
-    "fnapy": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Fnapy 1.1.7 prevents possible vulnerabilities due to requests <=2.19.1. See CVE-2018-18074.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-39418",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29548",
+            "id": "pyup.io-44091",
             "specs": [
-                "<1.1.7"
+                "<2.0.0"
             ],
-            "v": "<1.1.7"
-        }
-    ],
-    "foolscap": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "In foolscap before 0.7.0 the \"flappserver\" feature was found to have a vulnerability in the service-lookup code which, when combined with an attacker who has the ability to write files to a location where the flappserver process could read them, would allow that attacker to obtain control of the flappserver process.\r\n\r\nUsers who run flappservers should upgrade to 0.7.0, where this was fixed as part of 226.",
-            "cve": "PVE-2021-25828",
-            "id": "pyup.io-25828",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29536",
+            "id": "pyup.io-44092",
             "specs": [
-                "<0.7.0"
+                "<2.0.0"
             ],
-            "v": "<0.7.0"
-        }
-    ],
-    "form-designer": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Form-designer 0.8 fixes an XSS vulnerability in the administration panel.\r\nhttps://github.com/feincms/form_designer/pull/18/commits/bc252a4bf3d610c9beaf83ffa39d66f2cbbcc5cd\r\nhttps://github.com/feincms/form_designer/commit/0e93601195f4c22c84ee1704de34e5331816188b",
-            "cve": "PVE-2021-34711",
-            "id": "pyup.io-34711",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29538",
+            "id": "pyup.io-44093",
             "specs": [
-                "<0.7.2"
+                "<2.0.0"
             ],
-            "v": "<0.7.2"
-        }
-    ],
-    "formbar": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Formbar 0.9 fixes a potential code injection issue by removing the rule parsing out of formbar and by using brabbel library for rule parsing and evaluation.\r\nhttps://github.com/ringo-framework/formbar/commit/bcbcf67fc68c37dd12528e3ddcacd712e4e0e64d",
-            "cve": "PVE-2021-25829",
-            "id": "pyup.io-25829",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29540",
+            "id": "pyup.io-44094",
             "specs": [
-                "<0.9"
+                "<2.0.0"
             ],
-            "v": "<0.9"
-        }
-    ],
-    "formencode": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "schema.py in FormEncode for Python (python-formencode) 1.0 does not apply the chained_validators feature, which allows attackers to bypass intended access restrictions via unknown vectors.",
-            "cve": "CVE-2008-6547",
-            "id": "pyup.io-25830",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29608",
+            "id": "pyup.io-44095",
             "specs": [
-                "<1.0"
+                "<2.0.0"
             ],
-            "v": "<1.0"
-        }
-    ],
-    "freewvs": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "In freewvs before 0.1.1, a directory structure of more than 1000 nested directories can interrupt a freewvs scan due to Python's recursion limit and os.walk(). This can be problematic in a case where an administrator scans the dirs of potentially untrusted users.\r\nhttps://github.com/schokokeksorg/freewvs/security/advisories/GHSA-7pmh-vrww-25xx\r\nhttps://github.com/schokokeksorg/freewvs/commit/83a6b55c0435c69f447488b791555e6078803143",
-            "cve": "CVE-2020-15101",
-            "id": "pyup.io-38575",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29551",
+            "id": "pyup.io-44096",
             "specs": [
-                "<0.1.1"
+                "<2.0.0"
             ],
-            "v": "<0.1.1"
-        }
-    ],
-    "fresco": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "In fresco after 0.5.5 user supplied data is no longer reflected in error messages raised from \"fresco.routeargs.RequestArg\". This fixes a potential XSS vulnerability affecting versions starting from 0.5.0.",
-            "cve": "PVE-2021-35028",
-            "id": "pyup.io-35028",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29513",
+            "id": "pyup.io-44097",
             "specs": [
-                ">=0.5.0,<0.5.5"
+                "<2.0.0"
             ],
-            "v": ">=0.5.0,<0.5.5"
-        }
-    ],
-    "friendlyshell": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "friendlyshell 1.0.3 fixes security warnings, and bugs with parsing quoted command parameters.",
-            "cve": "PVE-2021-36642",
-            "id": "pyup.io-36642",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29572",
+            "id": "pyup.io-44098",
             "specs": [
-                "<1.0.3"
+                "<2.0.0"
             ],
-            "v": "<1.0.3"
-        }
-    ],
-    "ftw-dashboard-portlets-postit": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "ftw-dashboard-portlets-postit  1.3.4 fixes a security error, it was possible to add postit comment on a foreign dashboard if the userid an portlet id was known.",
-            "cve": "PVE-2021-35933",
-            "id": "pyup.io-35933",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29580",
+            "id": "pyup.io-44099",
             "specs": [
-                "<1.3.4"
+                "<2.0.0"
             ],
-            "v": "<1.3.4"
-        }
-    ],
-    "ftw.dashboard.dragndrop": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "ftw.dashboard.dragndrop 1.5.1 includes several undisclosed security fixes.",
-            "cve": "PVE-2021-25831",
-            "id": "pyup.io-25831",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29578",
+            "id": "pyup.io-44100",
             "specs": [
-                "<1.5.1"
+                "<2.0.0"
             ],
-            "v": "<1.5.1"
-        }
-    ],
-    "ftw.dashboard.portlets.postit": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "ftw.dashboard.portlets.postit 1.3.4 fixes a security error, it was possible to add postit comment on a foreign dashboard if the userid an portlet id was known.",
-            "cve": "PVE-2021-25832",
-            "id": "pyup.io-25832",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29579",
+            "id": "pyup.io-44101",
             "specs": [
-                "<1.3.4"
+                "<2.0.0"
             ],
-            "v": "<1.3.4"
-        }
-    ],
-    "ftw.lawgiver": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Ftw.lawgiver 1.16.1 fixes the workflow security.",
-            "cve": "PVE-2021-37470",
-            "id": "pyup.io-37470",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29581",
+            "id": "pyup.io-44102",
             "specs": [
-                "<1.16.1"
+                "<2.0.0"
             ],
-            "v": "<1.16.1"
-        }
-    ],
-    "ftw.mail": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Ftw.mail 2.2.3 makes mail view XSS-save using the safe-html transform for the mail-body display.\r\nhttps://github.com/4teamwork/ftw.mail/pull/25",
-            "cve": "PVE-2021-25833",
-            "id": "pyup.io-25833",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29582",
+            "id": "pyup.io-44103",
             "specs": [
-                "<2.2.3"
+                "<2.0.0"
             ],
-            "v": "<2.2.3"
-        }
-    ],
-    "ftw.meeting": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "ftw.meeting before 1.4.1 isn't using safe-html-transform for textfields.",
-            "cve": "PVE-2021-25834",
-            "id": "pyup.io-25834",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29583",
+            "id": "pyup.io-44104",
             "specs": [
-                "<1.4.1"
+                "<2.0.0"
             ],
-            "v": "<1.4.1"
-        }
-    ],
-    "ftw.permissionmanager": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "ftw.permissionmanager before 2.2.2 allowed users with view permission to access the advanced security features. Since it's possible to search for all users, which exposes all usernames and email addresses to anyone with view permission.",
-            "cve": "PVE-2021-25835",
-            "id": "pyup.io-25835",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29584",
+            "id": "pyup.io-44105",
             "specs": [
-                "<2.2.2"
+                "<2.0.0"
             ],
-            "v": "<2.2.2"
-        }
-    ],
-    "ftw.recipe.solr": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Ftw.recipe.solr 1.3.5 disables message lookups in log4j dependency to fix a critical vulnerability.\r\nhttps://github.com/4teamwork/ftw.recipe.solr/commit/5d5ede2d8e0119c74ad6fa51cd2bee434109810f",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43395",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29585",
+            "id": "pyup.io-44106",
             "specs": [
-                "<1.3.5"
+                "<2.0.0"
             ],
-            "v": "<1.3.5"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Ftw.recipe.solr 1.3.6 fixes a system property for Log4j configuration file to be compatible with secure versions of this package.",
-            "cve": "CVE-2021-45105",
-            "id": "pyup.io-43440",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29586",
+            "id": "pyup.io-44107",
             "specs": [
-                "<1.3.6"
+                "<2.0.0"
             ],
-            "v": "<1.3.6"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Ftw.recipe.solr 1.3.6 fixes a system property for Log4j configuration file to be compatible with secure versions of this package.",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43396",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29588",
+            "id": "pyup.io-44108",
             "specs": [
-                "<1.3.6"
+                "<2.0.0"
             ],
-            "v": "<1.3.6"
-        }
-    ],
-    "funcx": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Funcx 0.2.0 overhauls the security architecture.",
-            "cve": "PVE-2021-40175",
-            "id": "pyup.io-40175",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29590",
+            "id": "pyup.io-44109",
             "specs": [
-                "<0.2.0"
+                "<2.0.0"
             ],
-            "v": "<0.2.0"
-        }
-    ],
-    "fundnsf": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Fundnsf 0.0.32 updates requests to v2.20.0 for including a security fix.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36598",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29591",
+            "id": "pyup.io-44110",
             "specs": [
-                "<0.0.32"
+                "<2.0.0"
             ],
-            "v": "<0.0.32"
-        }
-    ],
-    "futoin-cid": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "futoin-cid before 0.8.5 does not properly check components loading from the root directory when using os.path.join().",
-            "cve": "PVE-2021-35184",
-            "id": "pyup.io-35184",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29592",
+            "id": "pyup.io-44111",
             "specs": [
-                "<0.8.5"
+                "<2.0.0"
             ],
-            "v": "<0.8.5"
-        }
-    ],
-    "galaxy-importer": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Galaxy-importer 0.2.15 updates 'bleach' dependency to v3.3.0 to fix a 'XSS mutation' vulnerability.",
-            "cve": "CVE-2021-23980",
-            "id": "pyup.io-40174",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29594",
+            "id": "pyup.io-44112",
             "specs": [
-                "<0.2.15"
+                "<2.0.0"
             ],
-            "v": "<0.2.15"
-        }
-    ],
-    "galaxy-ng": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Galaxy-ng 4.4.0 updates its dependency 'django' minimum version to v2.2.23 to include a security fix.",
-            "cve": "CVE-2021-32052",
-            "id": "pyup.io-42974",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29595",
+            "id": "pyup.io-44113",
             "specs": [
-                "<4.4.0"
+                "<2.0.0"
             ],
-            "v": "<4.4.0"
-        }
-    ],
-    "gallery-dl": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Gallery-dl 1.5.3 improves the downloader/postprocessor module loading to prevent potential security risk through relative imports.\r\nhttps://github.com/mikf/gallery-dl/commit/e9ae6fd080d8c9662a1ce688ec622d413b99e615",
-            "cve": "PVE-2021-42368",
-            "id": "pyup.io-42368",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29593",
+            "id": "pyup.io-44114",
             "specs": [
-                "<1.5.3"
+                "<2.0.0"
             ],
-            "v": "<1.5.3"
-        }
-    ],
-    "gandi.cli": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "gandi.cli 0.10 includes two security related fixes: \r\n\r\n- validate server certificate using request as\r\n  xmlrpc transport.\r\n- Security: restrict configuration file rights to owner only.",
-            "cve": "PVE-2021-25836",
-            "id": "pyup.io-25836",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29596",
+            "id": "pyup.io-44115",
             "specs": [
-                "<0.10"
+                "<2.0.0"
             ],
-            "v": "<0.10"
-        }
-    ],
-    "gdal": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Gdal 1.10.0 fixes various vulnerabilities/DoS  in the GXF driver.\r\nhttps://github.com/OSGeo/gdal/commit/283146cbff813f0a7eff3e1fe4712ff1f48f1188",
-            "cve": "PVE-2021-42375",
-            "id": "pyup.io-42375",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29527",
+            "id": "pyup.io-44116",
             "specs": [
-                "<1.10.0"
+                "<2.0.0"
             ],
-            "v": "<1.10.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gdal 1.11.0 applies a patch for CVE-2013-6629 in the JPEG driver.",
-            "cve": "CVE-2013-6629",
-            "id": "pyup.io-42374",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29528",
+            "id": "pyup.io-44117",
+            "specs": [
+                "<2.0.0"
+            ],
+            "v": "<2.0.0"
+        },
+        {
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29530",
+            "id": "pyup.io-44118",
             "specs": [
-                "<1.11.0"
+                "<2.0.0"
             ],
-            "v": "<1.11.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gdal 1.11.0 switches http to https for the oauth2 link to improve security in the GFT driver.",
-            "cve": "PVE-2021-42376",
-            "id": "pyup.io-42376",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29529",
+            "id": "pyup.io-44119",
             "specs": [
-                "<1.11.0"
+                "<2.0.0"
             ],
-            "v": "<1.11.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gdal 2.3.0 drops support for PostgreSQL client library older than 7.4, or non security maintained releases older than 8.1.4, 8.0.8, 7.4.13, 7.3.15.",
-            "cve": "PVE-2021-42372",
-            "id": "pyup.io-42372",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29597",
+            "id": "pyup.io-44120",
             "specs": [
-                "<2.3.0"
+                "<2.0.0"
             ],
-            "v": "<2.3.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gdal 2.3.0 includes more than 1000 fixes for issues/vulnerabilities found by OSS-Fuzz.",
-            "cve": "PVE-2021-42371",
-            "id": "pyup.io-42371",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29531",
+            "id": "pyup.io-44121",
             "specs": [
-                "<2.3.0"
+                "<2.0.0"
             ],
-            "v": "<2.3.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gdal 3.1.0 includes multiple security-related fixes. No details are given.",
-            "cve": "PVE-2021-38264",
-            "id": "pyup.io-38264",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29598",
+            "id": "pyup.io-44122",
             "specs": [
-                "<3.1.0"
+                "<2.0.0"
             ],
-            "v": "<3.1.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gdal 3.1.0 includes multiple security related fixes detected by OSS-Fuzz.",
-            "cve": "PVE-2021-42370",
-            "id": "pyup.io-42370",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29599",
+            "id": "pyup.io-44123",
             "specs": [
-                "<3.1.0"
+                "<2.0.0"
             ],
-            "v": "<3.1.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gdal 3.3.3 adds netcdf patch to fix a stack read overflow vulnerability.\r\nhttps://github.com/OSGeo/gdal/commit/eec259c7c73f8bc200ff41efc8e6771472b48f86\r\nhttps://bugs.chromium.org/p/oss-fuzz/issues/detail?id=39189",
-            "cve": "PVE-2021-42369",
-            "id": "pyup.io-42369",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29600",
+            "id": "pyup.io-44124",
             "specs": [
-                "<3.3.3"
+                "<2.0.0"
             ],
-            "v": "<3.3.3"
-        }
-    ],
-    "gds-django-jet": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Gds-django-jet 1.0.4 fixes an security issue with accessing 'model_lookup_view' (when using 'RelatedFieldAjaxListFilter') without permissions.\r\nhttps://github.com/govindsharma7/gds-django-jet/commit/734f3521d8290f6162847ad0b5c33d8ab5e119a9",
-            "cve": "PVE-2021-40668",
-            "id": "pyup.io-40668",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29601",
+            "id": "pyup.io-44125",
             "specs": [
-                "<1.0.4"
+                "<2.0.0"
             ],
-            "v": "<1.0.4"
-        }
-    ],
-    "genbadge": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Genbadge 1.0.0 starts to use 'defusedxml' to fix a known vulnerability. See: <https://github.com/smarie/python-genbadge/issues/11>.",
-            "cve": "PVE-2021-40496",
-            "id": "pyup.io-40496",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29603",
+            "id": "pyup.io-44126",
             "specs": [
-                "<1.0.0"
+                "<2.0.0"
             ],
-            "v": "<1.0.0"
-        }
-    ],
-    "genshi": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "genshi 0.6.1 includes a security fix to enhance sanitizing of CSS in style attributes. Genshi's `HTMLSanitizer` disallows style attributes by default (this remains unchanged) and warns against such attacks in its documentation, but the provided CSS santizing is now less lacking (see GitHub issue 455).",
-            "cve": "PVE-2021-34688",
-            "id": "pyup.io-34688",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29605",
+            "id": "pyup.io-44127",
             "specs": [
-                "<0.6.1"
+                "<2.0.0"
             ],
-            "v": "<0.6.1"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Genshi 0.6.1 updates the HTML sanitizer to strip any CSS comments in style attributes, which could previously be used to hide malicious property values. This security fix also enhances the sanitizing of CSS in style attributes. Genshi's  'HTMLSanitizer' disallows style attributes by default (this remains unchanged) and warns against such attacks in its documentation.",
-            "cve": "PVE-2021-39055",
-            "id": "pyup.io-39055",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29606",
+            "id": "pyup.io-44128",
             "specs": [
-                "<0.6.1"
+                "<2.0.0"
             ],
-            "v": "<0.6.1"
-        }
-    ],
-    "geojson-client": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Geojson-client 0.4 fetches NSW Rural Fire Service feed securely via HTTPS.",
-            "cve": "PVE-2021-38898",
-            "id": "pyup.io-38898",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29542",
+            "id": "pyup.io-44129",
             "specs": [
-                "<0.4"
+                "<2.0.0"
             ],
-            "v": "<0.4"
-        }
-    ],
-    "geokey": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Geokey 1.11.2 upgrades the REST framework (+GIS) dependencies in order to resolve reported vulnerability issue.",
-            "cve": "PVE-2021-37207",
-            "id": "pyup.io-37207",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29541",
+            "id": "pyup.io-44130",
             "specs": [
-                "<1.11.2"
+                "<2.0.0"
             ],
-            "v": "<1.11.2"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Geokey 1.3.1 includes a not further specified security update.",
-            "cve": "PVE-2021-35080",
-            "id": "pyup.io-35080",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29607",
+            "id": "pyup.io-44131",
             "specs": [
-                "<1.3.1"
+                "<2.0.0"
             ],
-            "v": "<1.3.1"
-        }
-    ],
-    "geonode": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Geonode 2.10 updates 'django' to v1.11.22 to include a security fix.",
-            "cve": "CVE-2019-12781",
-            "id": "pyup.io-37877",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29609",
+            "id": "pyup.io-44132",
             "specs": [
-                "<2.10"
+                "<2.0.0"
             ],
-            "v": "<2.10"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Geonode 2.10 updates 'urllib3' to v1.24.2 to include security fixes.",
-            "cve": "CVE-2018-20060",
-            "id": "pyup.io-42969",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29611",
+            "id": "pyup.io-44133",
             "specs": [
-                "<2.10"
+                "<2.0.0"
             ],
-            "v": "<2.10"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Geonode 2.10 updates 'urllib3' to v1.24.2 to include security fixes.",
-            "cve": "CVE-2019-11324",
-            "id": "pyup.io-42968",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29612",
+            "id": "pyup.io-44134",
             "specs": [
-                "<2.10"
+                "<2.0.0"
             ],
-            "v": "<2.10"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Geonode 2.10 updates 'twisted' to v19.2.1 to include security fixes.",
-            "cve": "CVE-2019-12387",
-            "id": "pyup.io-42970",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29546",
+            "id": "pyup.io-44135",
             "specs": [
-                "<2.10"
+                "<2.0.0"
             ],
-            "v": "<2.10"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Geonode 2.10 updates 'twisted' to v19.2.1 to include security fixes.",
-            "cve": "PVE-2021-37040",
-            "id": "pyup.io-42971",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29549",
+            "id": "pyup.io-44136",
             "specs": [
-                "<2.10"
+                "<2.0.0"
             ],
-            "v": "<2.10"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Geonode 2.10 patches a yaml vulnerability by using safe_load().\r\nhttps://github.com/geonode/geonode/commit/b2d6f0e5ede3642c308fcc5df2c33b2e2a5e010c",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-42972",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29613",
+            "id": "pyup.io-44137",
             "specs": [
-                "<2.10"
+                "<2.0.0"
             ],
-            "v": "<2.10"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Geonode 2.8.1 fix a JavaScript vulnerability and also fixes a vulnerability with the Pillow dependency.",
-            "cve": "PVE-2021-38558",
-            "id": "pyup.io-38558",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29615",
+            "id": "pyup.io-44138",
             "specs": [
-                "<2.8.1"
+                "<2.0.0"
             ],
-            "v": "<2.8.1"
-        }
-    ],
-    "geonode-oauth-toolkit": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Geonode-oauth-toolkit 0.8.0 fixes vulnerabilities on Basic authentication.",
-            "cve": "PVE-2021-40423",
-            "id": "pyup.io-40423",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29617",
+            "id": "pyup.io-44139",
             "specs": [
-                "<0.8.0"
+                "<2.0.0"
             ],
-            "v": "<0.8.0"
-        }
-    ],
-    "gerapy": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "This affects the package Gerapy from 0 and before 0.9.3. The input being passed to Popen, via the project_configure endpoint, isn\u2019t being sanitized. See: CVE-2020-7698.",
-            "cve": "CVE-2020-7698",
-            "id": "pyup.io-38636",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29618",
+            "id": "pyup.io-44140",
             "specs": [
-                "<0.9.3"
+                "<2.0.0"
             ],
-            "v": "<0.9.3"
-        }
-    ],
-    "getmail": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Versions of getmail prior to 4.2.0 and 3.2.5 contain a security vulnerability. A local attacker with a shell account could exploit a race condition (or a similar symlink attack) to cause getmail to create or overwrite files in a directory of the local user's choosing if the system administrator ran getmail as root and delivered messages to a maildir or mbox file under the control of the attacker, resulting in a local root exploit. (This vulnerability is not exploitable if the administrator does not deliver mail to the maildirs/mbox files of untrusted local users, or if getmail is configured to use an external unprivileged MDA. Also, this vulnerability is not remotely exploitable.)",
-            "cve": "PVE-2021-38862",
-            "id": "pyup.io-38862",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29553",
+            "id": "pyup.io-44141",
             "specs": [
-                "<3.2.5",
-                ">=4.0.0a1,<4.2.0"
+                "<2.0.0"
             ],
-            "v": "<3.2.5,>=4.0.0a1,<4.2.0"
-        }
-    ],
-    "gevent": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "gevent 1.2a1 includes a security related fix. Errors logged by :class:`~gevent.pywsgi.WSGIHandler` no longer print the entire WSGI environment by default. This avoids  possible information disclosure vulnerabilities. Applications can also opt-in to a higher security level for the WSGI environment if they  choose and their frameworks support it. Originally reported  in :pr:`779` by sean-peters-au and changed in :pr:`781`.",
-            "cve": "PVE-2021-25837",
-            "id": "pyup.io-25837",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29552",
+            "id": "pyup.io-44142",
             "specs": [
-                "<1.2a1"
+                "<2.0.0"
             ],
-            "v": "<1.2a1"
-        }
-    ],
-    "geventhttpclient": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "geventhttpclient 1.2.0 includes an undisclosed security fix related to SSL support.",
-            "cve": "PVE-2021-25838",
-            "id": "pyup.io-25838",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29619",
+            "id": "pyup.io-44143",
             "specs": [
-                "<1.2.0"
+                "<2.0.0"
             ],
-            "v": "<1.2.0"
-        }
-    ],
-    "gimpformats": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-42153",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29552",
+            "id": "pyup.io-44144",
             "specs": [
-                "<2021"
+                "<2.0.0"
             ],
-            "v": "<2021"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-42152",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29554",
+            "id": "pyup.io-44145",
             "specs": [
-                "<2021"
+                "<2.0.0"
             ],
-            "v": "<2021"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-40211",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2020-8177",
+            "id": "pyup.io-44146",
             "specs": [
-                "<2021"
+                "<2.0.0"
             ],
-            "v": "<2021"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-42150",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29555",
+            "id": "pyup.io-44147",
             "specs": [
-                "<2021"
+                "<2.0.0"
             ],
-            "v": "<2021"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-42151",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2020-8231",
+            "id": "pyup.io-44148",
             "specs": [
-                "<2021"
+                "<2.0.0"
             ],
-            "v": "<2021"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gimpformats 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-42154",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29557",
+            "id": "pyup.io-44149",
             "specs": [
-                "<2021"
+                "<2.0.0"
             ],
-            "v": "<2021"
-        }
-    ],
-    "gino-quart": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Gino-quart 0.1.1b2 updates 'cryptography' dependency to fix a security issue.",
-            "cve": "PVE-2021-39623",
-            "id": "pyup.io-39623",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2020-8284",
+            "id": "pyup.io-44150",
             "specs": [
-                "<0.1.1b2"
+                "<2.0.0"
             ],
-            "v": "<0.1.1b2"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Gino-quart bumps jinja2 from version 2.11.2 to 2.11.3 to improve its security.",
-            "cve": "PVE-2021-40058",
-            "id": "pyup.io-40058",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29556",
+            "id": "pyup.io-44151",
             "specs": [
-                "<0.1.1b4"
+                "<2.0.0"
             ],
-            "v": "<0.1.1b4"
-        }
-    ],
-    "giosgapps-bindings": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-43725",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29558",
+            "id": "pyup.io-44152",
             "specs": [
-                "<0.0.19"
+                "<2.0.0"
             ],
-            "v": "<0.0.19"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-43727",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29559",
+            "id": "pyup.io-44153",
             "specs": [
-                "<0.0.19"
+                "<2.0.0"
             ],
-            "v": "<0.0.19"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-43728",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29565",
+            "id": "pyup.io-44154",
             "specs": [
-                "<0.0.19"
+                "<2.0.0"
             ],
-            "v": "<0.0.19"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-43726",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2020-8286",
+            "id": "pyup.io-44155",
             "specs": [
-                "<0.0.19"
+                "<2.0.0"
             ],
-            "v": "<0.0.19"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Giosgapps-bindings 0.0.19 updates its dependency Django to v2.2.8 to include security fixes.",
-            "cve": "CVE-2019-19118",
-            "id": "pyup.io-37906",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29518",
+            "id": "pyup.io-44156",
             "specs": [
-                "<0.0.19"
+                "<2.0.0"
             ],
-            "v": "<0.0.19"
-        }
-    ],
-    "girder": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Girder 2.2.0 fixes an XSS vulnerability in girders human-readable web API output. This vulnerability was not present in girders normal web client, so users of the Girder web client would not have been affected.\r\nhttps://github.com/girder/girder/pull/1828",
-            "cve": "PVE-2021-34634",
-            "id": "pyup.io-34634",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29526",
+            "id": "pyup.io-44157",
             "specs": [
-                "<2.2.0"
+                "<2.0.0"
             ],
-            "v": "<2.2.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "In girder 2.5.0 the default Girder server now binds to localhost by default instead of 0.0.0.0.",
-            "cve": "PVE-2021-35831",
-            "id": "pyup.io-35831",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29516",
+            "id": "pyup.io-44158",
             "specs": [
-                "<2.5.0"
+                "<2.0.0"
             ],
-            "v": "<2.5.0"
-        }
-    ],
-    "git-big-picture": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.",
-            "cve": "CVE-2021-3028",
-            "id": "pyup.io-42311",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29516",
+            "id": "pyup.io-44159",
             "specs": [
-                "<1.0.0"
+                "<2.0.0"
             ],
-            "v": "<1.0.0"
-        }
-    ],
-    "git-portfolio": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Git-portfolio 0.10.1 includes various security patches.",
-            "cve": "PVE-2021-39510",
-            "id": "pyup.io-39510",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29517",
+            "id": "pyup.io-44160",
             "specs": [
-                "<0.10.1"
+                "<2.0.0"
             ],
-            "v": "<0.10.1"
-        }
-    ],
-    "gitlab-languages": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Gitlab-languages 1.4.1 updates dependencies because of a security vulnerability in 'requests' <2.20.0.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36639",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29569",
+            "id": "pyup.io-44161",
             "specs": [
-                "<1.4.1"
+                "<2.0.0"
             ],
-            "v": "<1.4.1"
-        }
-    ],
-    "gitlabform": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Gitlabform 2.0.5 fixes potential security issue by enabling autoescaping when loading the 'Jinja' templates.",
-            "cve": "PVE-2021-40639",
-            "id": "pyup.io-40639",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29561",
+            "id": "pyup.io-44162",
             "specs": [
-                "<2.0.5"
+                "<2.0.0"
             ],
-            "v": "<2.0.5"
-        }
-    ],
-    "glances": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Glances 3.2.0 updates Web UI for a security vulnerability.",
-            "cve": "PVE-2021-40900",
-            "id": "pyup.io-40900",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29562",
+            "id": "pyup.io-44163",
             "specs": [
-                "<3.2.0"
+                "<2.0.0"
             ],
-            "v": "<3.2.0"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Glances before version 3.2.1 is vulnerable to XML External Entity (XXE) Injection via the use of Fault to parse untrusted XML data, which is known to be vulnerable to XML attacks. See: CVE-2021-23418.",
-            "cve": "CVE-2021-23418",
-            "id": "pyup.io-41042",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29570",
+            "id": "pyup.io-44164",
             "specs": [
-                "<3.2.1"
+                "<2.0.0"
             ],
-            "v": "<3.2.1"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Glances 3.2.4 updates WebUI dependencies to include security fixes.\r\nhttps://github.com/nicolargo/glances/pull/1948",
-            "cve": "PVE-2021-42752",
-            "id": "pyup.io-42752",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29575",
+            "id": "pyup.io-44165",
             "specs": [
-                "<3.2.4"
+                "<2.0.0"
             ],
-            "v": "<3.2.4"
-        }
-    ],
-    "glooey": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Glooey version 0.3.5 includes a security patch for the function 'yaml' in 'glooey/themes/helpers.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/kxgames/glooey/commit/9178939df55a44dcf0a890aec0aceef2f4989947",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41326",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29515",
+            "id": "pyup.io-44166",
             "specs": [
-                "<0.3.5"
+                "<2.0.0"
             ],
-            "v": "<0.3.5"
-        }
-    ],
-    "glovo-api-python": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Glovo-api-python 2.0.0 updates its dependencies to remove the insecure ones.",
-            "cve": "PVE-2021-38427",
-            "id": "pyup.io-38427",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29573",
+            "id": "pyup.io-44167",
             "specs": [
                 "<2.0.0"
             ],
             "v": "<2.0.0"
-        }
-    ],
-    "gns3-gui": [
+        },
         {
-            "advisory": "gns3-gui 1.5.1 fixes a security related bug to prevent client to send empty hostname.",
-            "cve": "PVE-2021-25839",
-            "id": "pyup.io-25839",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29574",
+            "id": "pyup.io-44168",
             "specs": [
-                "<1.5.1"
+                "<2.0.0"
             ],
-            "v": "<1.5.1"
-        }
-    ],
-    "gns3-server": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "GNS3 ubridge through 0.9.18 on macOS, as used in GNS3 server before 2.1.17, allows a local attacker to read arbitrary files because it handles configuration-file errors by printing the configuration file while executing in a setuid root context.",
-            "cve": "CVE-2020-14976",
-            "id": "pyup.io-42277",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29576",
+            "id": "pyup.io-44169",
             "specs": [
-                "<2.1.17"
+                "<2.0.0"
             ],
-            "v": "<2.1.17"
-        }
-    ],
-    "gnupg": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "python-gnupg before 0.3.5 allows context-dependent attackers to execute arbitrary commands via shell metacharacters in unspecified vectors.",
-            "cve": "CVE-2013-7323",
-            "id": "pyup.io-35493",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29571",
+            "id": "pyup.io-44170",
             "specs": [
-                "<0.3.5"
+                "<2.0.0"
             ],
-            "v": "<0.3.5"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "The shell_quote function in python-gnupg 0.3.5 does not properly escape characters, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using \"\\\" (backslash) characters to form multi-command sequences, a different vulnerability than CVE-2014-1927.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.",
-            "cve": "CVE-2014-1928",
-            "id": "pyup.io-35534",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29577",
+            "id": "pyup.io-44171",
             "specs": [
-                "==0.3.5"
+                "<2.0.0"
             ],
-            "v": "==0.3.5"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, which allows context-dependent attackers to execute arbitrary code via shell metacharacters in unspecified vectors, as demonstrated using \"$(\" command-substitution sequences, a different vulnerability than CVE-2014-1928.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.",
-            "cve": "CVE-2014-1927",
-            "id": "pyup.io-35533",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2020-8285",
+            "id": "pyup.io-44172",
             "specs": [
-                "==0.3.5"
+                "<2.0.0"
             ],
-            "v": "==0.3.5"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "python-gnupg 0.3.5 and 0.3.6 allows context-dependent attackers to have an unspecified impact via vectors related to \"option injection through positional arguments.\" NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-7323.",
-            "cve": "CVE-2014-1929",
-            "id": "pyup.io-35535",
+            "advisory": "Jina version 2.0.0 updates its dependency \"Tensorflow\" to v2.4.2 to include security fixes.",
+            "cve": "CVE-2021-29614",
+            "id": "pyup.io-44173",
             "specs": [
-                "==0.3.5",
-                "==0.3.6"
+                "<2.0.0"
             ],
-            "v": "==0.3.5,==0.3.6"
-        }
-    ],
-    "gocept.month": [
+            "v": "<2.0.0"
+        },
         {
-            "advisory": "Gocept.month 2.2 adds a missing security declaration needed for the '.browser.widget.MonthWidget', the month widget for 'z3c.form'.",
-            "cve": "PVE-2021-40231",
-            "id": "pyup.io-40231",
+            "advisory": "Jina version 2.0.24 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-43528",
             "specs": [
-                "<2.2"
+                "<2.0.24"
             ],
-            "v": "<2.2"
-        }
-    ],
-    "goharbor": [
+            "v": "<2.0.24"
+        },
         {
-            "advisory": "goharbor 1.1.0 fixes some security issues in token service.",
-            "cve": "PVE-2021-36776",
-            "id": "pyup.io-36776",
+            "advisory": "Jina version 2.0.24 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-41712",
             "specs": [
-                "<1.1.0"
+                "<2.0.24"
             ],
-            "v": "<1.1.0"
+            "v": "<2.0.24"
         }
     ],
-    "google-appengine": [
+    "jinja": [
         {
-            "advisory": "Cross-site request forgery (CSRF) vulnerability in _ah/admin/interactive/execute (aka the Interactive Console) in the SDK Console (aka Admin Console) in the Google App Engine Python SDK before 1.5.4 allows remote attackers to hijack the authentication of administrators for requests that execute arbitrary Python code via the code parameter.",
-            "cve": "CVE-2011-1364",
-            "id": "pyup.io-33128",
+            "advisory": "jinja 2.7.2 fixes a security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems.  See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747 for more information.",
+            "cve": "PVE-2021-25863",
+            "id": "pyup.io-25863",
             "specs": [
-                "<1.5.4"
+                "<2.7.2"
             ],
-            "v": "<1.5.4"
+            "v": "<2.7.2"
         },
         {
-            "advisory": "The FakeFile implementation in the sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly control the opening of files, which allows local users to bypass intended access restrictions and create arbitrary files via ALLOWED_MODES and ALLOWED_DIRS changes within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.",
-            "cve": "CVE-2011-4211",
-            "id": "pyup.io-33129",
+            "advisory": "jinja 2.7.3 fixes a security issue: Corrected the security fix for the cache folder.",
+            "cve": "PVE-2021-25864",
+            "id": "pyup.io-25864",
             "specs": [
-                "<1.5.4"
+                "<2.7.3"
             ],
-            "v": "<1.5.4"
+            "v": "<2.7.3"
+        }
+    ],
+    "jinja2": [
+        {
+            "advisory": "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory. See: CVE-2020-28493.",
+            "cve": "CVE-2020-28493",
+            "id": "pyup.io-39525",
+            "specs": [
+                "<2.11.3"
+            ],
+            "v": "<2.11.3"
         },
         {
-            "advisory": "The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent use of the os module, which allows local users to bypass intended access restrictions and execute arbitrary commands via a file_blob_storage.os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.",
-            "cve": "CVE-2011-4213",
-            "id": "pyup.io-33131",
+            "advisory": "jinja2 2.7.2 fixes a security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems.  See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747 for more information.",
+            "cve": "PVE-2021-25865",
+            "id": "pyup.io-25865",
             "specs": [
-                "<1.5.4"
+                "<2.7.2"
             ],
-            "v": "<1.5.4"
+            "v": "<2.7.2"
         },
         {
-            "advisory": "The sandbox environment in the Google App Engine Python SDK before 1.5.4 does not properly prevent os.popen calls, which allows local users to bypass intended access restrictions and execute arbitrary commands via a dev_appserver.RestrictedPathFunction._original_os reference within the code parameter to _ah/admin/interactive/execute, a different vulnerability than CVE-2011-1364.",
-            "cve": "CVE-2011-4212",
-            "id": "pyup.io-33130",
+            "advisory": "The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.",
+            "cve": "CVE-2014-1402",
+            "id": "pyup.io-25866",
             "specs": [
-                "<1.5.4"
+                "<2.7.3"
             ],
-            "v": "<1.5.4"
+            "v": "<2.7.3"
         }
     ],
-    "google-images-search": [
+    "jinjafx": [
         {
-            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-43479",
+            "advisory": "Jinjafx 1.3.4 fixes an Arbitrary Code Execution vulnerability related to yaml.FullLoader().\r\nhttps://github.com/cmason3/jinjafx/commit/de9218a7d204317695a2573d446ddda887ba153f\r\nhttps://github.com/cmason3/jinjafx/commit/2e60b6e24e4a7affea3beb4aadf1de90d3227cc8",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-42841",
             "specs": [
-                "<1.3.8"
+                "<1.3.4"
             ],
-            "v": "<1.3.8"
+            "v": "<1.3.4"
         },
         {
-            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-43480",
+            "advisory": "Jinjafx 1.5.0 adds support for DataTemplate revisions to mitigate 0-RTT replay attacks.\r\nhttps://github.com/cmason3/jinjafx/commit/fa906c025429fe3c51a567e8502a9cc8a2a854ea",
+            "cve": "PVE-2021-42840",
+            "id": "pyup.io-42840",
             "specs": [
-                "<1.3.8"
+                "<1.5.0"
             ],
-            "v": "<1.3.8"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25292",
-            "id": "pyup.io-43481",
+            "advisory": "Jinjafx 1.6.1 drops support for IE11, as it represents a security risk.\r\nhttps://github.com/cmason3/jinjafx/commit/2f6c03711f1d509e6aeff1f3c381ea1e3f144436",
+            "cve": "PVE-2021-42839",
+            "id": "pyup.io-42839",
             "specs": [
-                "<1.3.8"
+                "<1.6.1"
             ],
-            "v": "<1.3.8"
+            "v": "<1.6.1"
         },
         {
-            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25293",
-            "id": "pyup.io-43482",
+            "advisory": "Jinjafx 1.6.1 fixes a race condition in password prompts.\r\nhttps://github.com/cmason3/jinjafx/commit/af5910ff137a6d8e3cce477ed2e17f4f328fe510",
+            "cve": "PVE-2021-42839",
+            "id": "pyup.io-42941",
             "specs": [
-                "<1.3.8"
+                "<1.6.1"
             ],
-            "v": "<1.3.8"
+            "v": "<1.6.1"
         },
         {
-            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25291",
-            "id": "pyup.io-43483",
+            "advisory": "Jinjafx 1.7.0 improves the security of the HAProxy Dockerfile by dropping to a non-root user.",
+            "cve": "PVE-2021-42838",
+            "id": "pyup.io-42838",
             "specs": [
-                "<1.3.8"
+                "<1.7.0"
             ],
-            "v": "<1.3.8"
-        },
+            "v": "<1.7.0"
+        }
+    ],
+    "jnitrace": [
         {
-            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25290",
-            "id": "pyup.io-43484",
+            "advisory": "Jnitrace 1.0.6 includes a fix for CVE-2020-7598: Minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.",
+            "cve": "CVE-2020-7598",
+            "id": "pyup.io-38061",
             "specs": [
-                "<1.3.8"
+                "<1.0.6"
             ],
-            "v": "<1.3.8"
+            "v": "<1.0.6"
         },
         {
-            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25289",
-            "id": "pyup.io-43485",
+            "advisory": "Jnitrace 2.2.1 upgrades eslint-package to patch security vulnerability.",
+            "cve": "PVE-2021-37427",
+            "id": "pyup.io-37427",
             "specs": [
-                "<1.3.8"
+                "<2.2.1"
             ],
-            "v": "<1.3.8"
+            "v": "<2.2.1"
         },
         {
-            "advisory": "Google-images-search 1.3.8 updates its dependency 'Pillow' to version 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-40043",
+            "advisory": "Jnitrace 3.0.5 includes a fix for CVE-2020-7598: Minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.",
+            "cve": "CVE-2020-7598",
+            "id": "pyup.io-38060",
             "specs": [
-                "<1.3.8"
+                ">=3.0.0,<3.0.5"
             ],
-            "v": "<1.3.8"
+            "v": ">=3.0.0,<3.0.5"
         }
     ],
-    "gordo-components": [
+    "jno": [
         {
-            "advisory": "Gordo-components 0.15.1 includes a fix for CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.",
-            "cve": "CVE-2019-11324",
-            "id": "pyup.io-37545",
+            "advisory": "Jno 0.4.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-43590",
             "specs": [
-                "<0.15.1"
+                "<=0.4.0"
             ],
-            "v": "<0.15.1"
+            "v": "<=0.4.0"
+        },
+        {
+            "advisory": "Jno 0.4.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44458",
+            "specs": [
+                "<=0.4.0"
+            ],
+            "v": "<=0.4.0"
+        },
+        {
+            "advisory": "Jno 0.4.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43588",
+            "specs": [
+                "<=0.4.0"
+            ],
+            "v": "<=0.4.0"
+        },
+        {
+            "advisory": "Jno 0.4.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43589",
+            "specs": [
+                "<=0.4.0"
+            ],
+            "v": "<=0.4.0"
         }
     ],
-    "gphotos-sync": [
+    "jose": [
         {
-            "advisory": "gphotos-sync 2.9 update dependencies for security patches",
-            "cve": "PVE-2021-37829",
-            "id": "pyup.io-37829",
+            "advisory": "jose 0.3.0 fixed critical JWT vulnerability.",
+            "cve": "PVE-2021-25867",
+            "id": "pyup.io-25867",
             "specs": [
-                "<2.9"
+                "<0.3.0"
             ],
-            "v": "<2.9"
+            "v": "<0.3.0"
         }
     ],
-    "gpmf": [
+    "js-videojs": [
         {
-            "advisory": "Gpmf 1.2.2 addresses OOB attacks.",
-            "cve": "PVE-2021-38566",
-            "id": "pyup.io-38566",
+            "advisory": "js-videojs  4.12.5 updates videojs-swf to v4.5.4 to fix a potential security issue ([view](https://github.com/videojs/video.js/pull/1955)",
+            "cve": "PVE-2021-36130",
+            "id": "pyup.io-36130",
             "specs": [
-                "<1.2.2"
+                "<4.12.5"
             ],
-            "v": "<1.2.2"
+            "v": "<4.12.5"
         }
     ],
-    "gps-time": [
+    "json2xml": [
         {
-            "advisory": "Gps-time 2.8.6 updates its dependency 'kramdown' to v2.3.1 to include a security fix.",
-            "cve": "CVE-2021-28834",
-            "id": "pyup.io-43739",
+            "advisory": "Json2xml version 3.0.0 updates its dependency \"requests\" minimum requirement to v2.20.0 to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-42097",
             "specs": [
-                "<2.8.6"
+                "<3.0.0"
             ],
-            "v": "<2.8.6"
+            "v": "<3.0.0"
         },
         {
-            "advisory": "Gps-time 2.8.6 updates its dependency 'nokogiri' to v1.11.0 to include a security fix.",
-            "cve": "CVE-2020-26247",
-            "id": "pyup.io-43743",
+            "advisory": "Json2xml version 3.8.0 replaces its dependency \"xml.dom\" with the more secure \"defusedxml\".\nhttps://github.com/vinitkumar/json2xml/commit/7c4912d16ab9d8553d7fe16e348205bb1cea3af2",
+            "cve": "PVE-2021-42096",
+            "id": "pyup.io-42096",
             "specs": [
-                "<2.8.6"
+                "<3.8.0"
             ],
-            "v": "<2.8.6"
+            "v": "<3.8.0"
         }
     ],
-    "gradio": [
+    "jsoneditor": [
         {
-            "advisory": "Gradio 2.6.0 fixes arbitrary file reading vulnerabilities.\r\nhttps://github.com/gradio-app/gradio/pull/406",
-            "cve": "PVE-2021-43619",
-            "id": "pyup.io-43619",
+            "advisory": "Jsoneditor 2.2.2 fixes a security error in the server side file retriever script of the web application.",
+            "cve": "PVE-2021-40863",
+            "id": "pyup.io-40863",
             "specs": [
-                "<2.6.0"
+                "<2.2.2"
             ],
-            "v": "<2.6.0"
+            "v": "<2.2.2"
         }
     ],
-    "grafana-dashboard-builder": [
+    "jsonpickle": [
         {
-            "advisory": "Grafana-dashboard-builder 0.6.0a1 fixes a pyyaml security issue.",
-            "cve": "PVE-2021-38648",
-            "id": "pyup.io-38648",
+            "advisory": "Jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. See CVE-2020-22083.",
+            "cve": "CVE-2020-22083",
+            "id": "pyup.io-39319",
             "specs": [
-                "<0.6.0a1"
+                "<=1.4.1"
             ],
-            "v": "<0.6.0a1"
+            "v": "<=1.4.1"
         }
     ],
-    "graph-notebook": [
+    "jsonrpc-pyclient": [
         {
-            "advisory": "Graph-notebook 3.0.5 includes an upgrade of a Jupyter Notebook dependency for a security fix. \r\nhttps://github.com/aws/graph-notebook/pull/182",
-            "cve": "PVE-2021-41231",
-            "id": "pyup.io-41231",
+            "advisory": "jsonrpc-pyclient 0.7.0 fixes security issues in unixdomainsocket connectors.",
+            "cve": "PVE-2021-25869",
+            "id": "pyup.io-25869",
             "specs": [
-                "<3.0.5"
+                "<0.7.0"
             ],
-            "v": "<3.0.5"
+            "v": "<0.7.0"
         }
     ],
-    "graphite-web": [
+    "jumpssh": [
         {
-            "advisory": "Graphite-web 1.1.8 prevents cross-site scripting.",
-            "cve": "PVE-2021-40227",
-            "id": "pyup.io-40227",
+            "advisory": "Jumpssh 1.6.3 removes pytest-runner from setup_requires as this is deprecated for security reasons, see https://github.com/pytest-dev/pytest-runner",
+            "cve": "PVE-2021-38051",
+            "id": "pyup.io-38051",
             "specs": [
-                "<1.1.8"
+                "<1.6.3"
             ],
-            "v": "<1.1.8"
+            "v": "<1.6.3"
         }
     ],
-    "graphrepo": [
+    "junos-eznc": [
         {
-            "advisory": "Graphrepo 0.1.8 updates some dependencies in order to avoid security vulnerabilities.",
-            "cve": "PVE-2021-38421",
-            "id": "pyup.io-38421",
+            "advisory": "Junos-eznc 2.2.1 fixes PyYAML as per CVE-2017-18342.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-37081",
             "specs": [
-                "<0.1.8"
+                "<2.2.1"
             ],
-            "v": "<0.1.8"
+            "v": "<2.2.1"
         }
     ],
-    "graphscope": [
+    "jupyter-jsmol": [
         {
-            "advisory": "Graphscope 0.7.0 updates its dependency 'Apache Commons IO' to v2.7 to include a security fix.",
-            "cve": "CVE-2021-29425",
-            "id": "pyup.io-42560",
+            "advisory": "Jupyter-jsmol 2021.9.0 includes \"fixing security suggestions\". No further information is available.",
+            "cve": "PVE-2021-41252",
+            "id": "pyup.io-41252",
             "specs": [
-                "<0.7.0"
+                "<2021.9.0"
             ],
-            "v": "<0.7.0"
-        },
+            "v": "<2021.9.0"
+        }
+    ],
+    "jupyter-matlab-proxy": [
         {
-            "advisory": "Graphscope 0.7.0 updates its dependency 'SLF4J' to v1.7.31 to include a security fix.",
-            "cve": "CVE-2018-8088",
-            "id": "pyup.io-42561",
+            "advisory": "Jupyter-matlab-proxy 0.1.1 includes bug fixes and security patches.",
+            "cve": "PVE-2021-41081",
+            "id": "pyup.io-41081",
             "specs": [
-                "<0.7.0"
+                "<0.1.1"
             ],
-            "v": "<0.7.0"
+            "v": "<0.1.1"
         },
         {
-            "advisory": "Graphscope 0.7.0 updates its dependency 'Junit4' to v4.13.2 to include a security fix.",
-            "cve": "CVE-2020-15250",
-            "id": "pyup.io-42562",
+            "advisory": "Jupyter-matlab-proxy 0.2.0 includes internal security patches.",
+            "cve": "PVE-2021-41080",
+            "id": "pyup.io-41080",
             "specs": [
-                "<0.7.0"
+                "<0.2.0"
             ],
-            "v": "<0.7.0"
+            "v": "<0.2.0"
         }
     ],
-    "graphtransliterator": [
+    "jupyter-nbrequirements": [
         {
-            "advisory": "Graphtransliterator 1.1.2 includes security updates. No details were given.",
-            "cve": "PVE-2021-38234",
-            "id": "pyup.io-38234",
+            "advisory": "Jupyter-nbrequirements 0.6.0 updates bleach from 3.1.0 to 3.1.1 to include a security fix.",
+            "cve": "CVE-2020-6802",
+            "id": "pyup.io-38077",
             "specs": [
-                "<1.1.2"
+                "<0.6.0"
             ],
-            "v": "<1.1.2"
+            "v": "<0.6.0"
         }
     ],
-    "great-components": [
+    "jupyter-server": [
         {
-            "advisory": "great-components 25.0.1 updates lodash vulnerability",
-            "cve": "PVE-2021-37925",
-            "id": "pyup.io-37925",
+            "advisory": "Jupyter-server 0.2.0 adds a \"secure_write\" to function for cookie/token saves. See: <https://github.com/jupyter/jupyter_server/pull/77>.",
+            "cve": "PVE-2021-38212",
+            "id": "pyup.io-38212",
             "specs": [
-                "<25.0.1"
+                "<0.2.0"
             ],
-            "v": "<25.0.1"
-        }
-    ],
-    "gseapy": [
+            "v": "<0.2.0"
+        },
         {
-            "advisory": "Gseapy 0.10.5 fixes 'InsecureRequestWarning'.",
-            "cve": "PVE-2021-41066",
-            "id": "pyup.io-41066",
+            "advisory": "Jupyter-server 1.0.6 fixes an open redirect vulnerability. See: CVE-2020-26232.",
+            "cve": "CVE-2020-26232",
+            "id": "pyup.io-39167",
             "specs": [
-                "<0.10.5"
+                "<1.0.6"
             ],
-            "v": "<0.10.5"
-        }
-    ],
-    "gsutil": [
+            "v": "<1.0.6"
+        },
         {
-            "advisory": "Gsutil 3.41 includes changes to protect the security of resumable upload IDs.\r\nhttps://github.com/GoogleCloudPlatform/gsutil/commit/43cf0087b97c889d8e3eca67499ac2e887a6726a",
-            "cve": "PVE-2021-27541",
-            "id": "pyup.io-27541",
+            "advisory": "Jupyter-server 1.1.0 includes a security advisory fix (pull 345).",
+            "cve": "PVE-2021-39272",
+            "id": "pyup.io-39272",
             "specs": [
-                "<3.41"
+                "<1.1.0"
             ],
-            "v": "<3.41"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Gsutil 5.0 drops support for Python 2 to patch RSA security issues.",
-            "cve": "PVE-2021-41771",
-            "id": "pyup.io-41771",
+            "advisory": "The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: \"jupyter server --ServerApp.base_url=/jupyter/\".",
+            "cve": "CVE-2020-26275",
+            "id": "pyup.io-42289",
             "specs": [
-                "<5.0"
+                "<1.1.1"
             ],
-            "v": "<5.0"
+            "v": "<1.1.1"
         },
         {
-            "advisory": "Gsutil 5.2 drops support for Python 2 to patch RSA security issues.",
-            "cve": "PVE-2021-41871",
-            "id": "pyup.io-41871",
+            "advisory": "Jupyter-server 1.10.2 fixes bytes decoding process from secure cookies.",
+            "cve": "PVE-2021-41065",
+            "id": "pyup.io-41065",
             "specs": [
-                "<5.2"
+                "<1.10.2"
             ],
-            "v": "<5.2"
+            "v": "<1.10.2"
+        },
+        {
+            "advisory": "Jupyter-server 1.12.0 sets 'xsrf' and 'jupyterhub-session-id' cookies on base url to avoid they are shared between instances.\r\nhttps://github.com/jupyter-server/jupyter_server/pull/612",
+            "cve": "PVE-2021-42779",
+            "id": "pyup.io-42779",
+            "specs": [
+                "<1.12.0"
+            ],
+            "v": "<1.12.0"
+        },
+        {
+            "advisory": "Jupyter-server version 1.6.2 improves xsrf checks.\r\nhttps://github.com/jupyter-server/jupyter_server/pull/478",
+            "cve": "PVE-2021-41836",
+            "id": "pyup.io-41836",
+            "specs": [
+                "<1.6.2"
+            ],
+            "v": "<1.6.2"
         }
     ],
-    "guillotina": [
+    "jupyter-server-proxy": [
         {
-            "advisory": "guillotina 4.5.8 fixes memory leak in security policy lookups",
-            "cve": "PVE-2021-36961",
-            "id": "pyup.io-36961",
+            "advisory": "Jupyter-server-proxy 3.2.1 includes a fix for CVE-2022-21697: Versions of Jupyter Server Proxy prior to 3.2.1 are vulnerable to Server-Side Request Forgery (SSRF). Any user deploying Jupyter Server or Notebook with jupyter-proxy-server extension enabled is affected. A lack of input validation allows authenticated clients to proxy requests to other hosts, bypassing the 'allowed_hosts' check. Because authentication is required, which already grants permissions to make the same requests via kernel or terminal execution, this is considered low to moderate severity. Users may upgrade to version 3.2.1 to receive a patch or, as a workaround, install the patch manually.\r\nhttps://github.com/jupyterhub/jupyter-server-proxy/security/advisories/GHSA-gcv9-6737-pjqw",
+            "cve": "CVE-2022-21697",
+            "id": "pyup.io-44665",
             "specs": [
-                "<4.5.8"
+                "<3.2.1"
             ],
-            "v": "<4.5.8"
-        },
+            "v": "<3.2.1"
+        }
+    ],
+    "jupyterhub": [
         {
-            "advisory": "Guillotina 6.0.0b3 fixes a security policy not taking into account IInheritPermissionMap for principals.",
-            "cve": "PVE-2021-38203",
-            "id": "pyup.io-38203",
+            "advisory": "The maintainers of jupyterhub acknowledge in their changelog notes for version 0.2 that when the environment dictionary is used for authentication as an admin, jupyterhub becomes vulnerable to pre-existing security issues because these environment variables may be passed to the user via the batch submit command.",
+            "cve": "PVE-2021-38973",
+            "id": "pyup.io-38973",
             "specs": [
-                "<6.0.0b3"
+                "<=0.2"
             ],
-            "v": "<6.0.0b3"
+            "v": "<=0.2"
+        }
+    ],
+    "jupyterhub-systemdspawner": [
+        {
+            "advisory": "Jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.",
+            "cve": "PVE-2021-39244",
+            "id": "pyup.io-39244",
+            "specs": [
+                "<0.15"
+            ],
+            "v": "<0.15"
         },
         {
-            "advisory": "Guillotina 6.2.3 improves security checking for the search in PostgreSQL catalog.",
-            "cve": "PVE-2021-40178",
-            "id": "pyup.io-40178",
+            "advisory": "jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15",
+            "cve": "CVE-2020-26261",
+            "id": "pyup.io-42288",
             "specs": [
-                "<6.2.3"
+                "<0.15"
             ],
-            "v": "<6.2.3"
+            "v": "<0.15"
         }
     ],
-    "guillotina-dynamictablestorage": [
+    "jupyterlab": [
         {
-            "advisory": "guillotina-dynamictablestorage 1.1.0 fixes a possible sql injection.",
-            "cve": "PVE-2021-40218",
-            "id": "pyup.io-40218",
+            "advisory": "Jupyterlab 3.0.8 updates its dependency 'marked' to v2.0.0 to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.",
+            "cve": "CVE-2021-21306",
+            "id": "pyup.io-40042",
             "specs": [
-                "<1.1.0"
+                "<3.0.8"
             ],
-            "v": "<1.1.0"
-        }
-    ],
-    "gunicorn": [
+            "v": "<3.0.8"
+        },
         {
-            "advisory": "Gunicorn 19.10.0 includes a security fix to prevent HTTP desync attack.",
-            "cve": "PVE-2021-40105",
-            "id": "pyup.io-40105",
+            "advisory": "Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.",
+            "cve": "PVE-2021-41038",
+            "id": "pyup.io-41038",
             "specs": [
-                "<19.10.0"
+                "<3.1.0"
             ],
-            "v": "<19.10.0"
+            "v": "<3.1.0"
         },
         {
-            "advisory": "Gunicorn 20.0.1 fixes chunked encoding support to prevent any request smuggling for security purposes.",
-            "cve": "PVE-2021-40104",
-            "id": "pyup.io-40104",
+            "advisory": "Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.",
+            "cve": "PVE-2021-40969",
+            "id": "pyup.io-40969",
             "specs": [
-                "<19.10.0",
-                ">=20.0.0,<20.0.1"
+                "<3.1.0b2"
             ],
-            "v": "<19.10.0,>=20.0.0,<20.0.1"
+            "v": "<3.1.0b2"
         },
         {
-            "advisory": "Gunicorn 19.4.0 includes a security fix to raise 'InvalidRequestLine' exception when the line contains malicious data.",
-            "cve": "PVE-2021-40103",
-            "id": "pyup.io-40103",
+            "advisory": "Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn\u2019t sanitize the action attribute of html \"<form>\". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.\r\nhttps://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx\r\nhttps://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed",
+            "cve": "CVE-2021-32797",
+            "id": "pyup.io-41707",
             "specs": [
-                "<19.4.0"
+                ">=3.1.0a0,<3.1.4",
+                ">=3.0.0a0,<3.0.17",
+                ">=2.3.0a0,<2.3.2",
+                ">=2.2.0a0,<2.2.10",
+                "<1.2.21"
             ],
-            "v": "<19.4.0"
+            "v": ">=3.1.0a0,<3.1.4,>=3.0.0a0,<3.0.17,>=2.3.0a0,<2.3.2,>=2.2.0a0,<2.2.10,<1.2.21"
         }
     ],
-    "gvar": [
+    "jupyterlab-git": [
         {
-            "advisory": "Gvar 9.2.1 fixes bugs in gvar.load and gvar.dump caused by recent security upgrades to pyYAML.",
-            "cve": "PVE-2021-37809",
-            "id": "pyup.io-37809",
+            "advisory": "Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.",
+            "cve": "PVE-2021-41073",
+            "id": "pyup.io-41073",
             "specs": [
-                "<9.2.1"
+                "<0.32.0"
             ],
-            "v": "<9.2.1"
+            "v": "<0.32.0"
         }
     ],
-    "h2o": [
+    "jupyterlab-theme-solarized-dark": [
         {
-            "advisory": "H2o 3.34.0.7 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/h2oai/h2o-3/commit/85dc8a3fdbfef002919d15764b1ad99b3c39f851",
-            "cve": "CVE-2021-45105",
-            "id": "pyup.io-43439",
+            "advisory": "Jupyterlab-theme-solarized-dark 1.0.2 updates its dependency \"lodash\" to a secure version.",
+            "cve": "PVE-2021-41738",
+            "id": "pyup.io-41738",
             "specs": [
-                "<3.34.0.7"
+                "<1.0.2"
             ],
-            "v": "<3.34.0.7"
+            "v": "<1.0.2"
         },
         {
-            "advisory": "H2o 3.34.0.7 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/h2oai/h2o-3/commit/85dc8a3fdbfef002919d15764b1ad99b3c39f851",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43398",
+            "advisory": "Jupyterlab-theme-solarized-dark version 2.0.1 updates its dependency 'lodash' to v4.17.21 to include a security fix.\r\nhttps://github.com/AllanChain/jupyterlab-theme-solarized-dark/pull/9",
+            "cve": "CVE-2020-28500",
+            "id": "pyup.io-41741",
             "specs": [
-                "<3.34.0.7"
+                "<2.0.1"
             ],
-            "v": "<3.34.0.7"
+            "v": "<2.0.1"
         },
         {
-            "advisory": "H2o 3.34.0.7 updates its dependency 'log4j' to v2.17.0 to fix critical and severe vulnerabilities.\r\nhttps://github.com/h2oai/h2o-3/commit/85dc8a3fdbfef002919d15764b1ad99b3c39f851",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43397",
+            "advisory": "Jupyterlab-theme-solarized-dark version 2.0.1 updates its dependency 'lodash' to v4.17.21 to include a security fix.\r\nhttps://github.com/AllanChain/jupyterlab-theme-solarized-dark/pull/9",
+            "cve": "CVE-2021-23337",
+            "id": "pyup.io-41742",
             "specs": [
-                "<3.34.0.7"
+                "<2.0.1"
             ],
-            "v": "<3.34.0.7"
+            "v": "<2.0.1"
         }
     ],
-    "hail": [
+    "jupyterquiz": [
         {
-            "advisory": "Hail 0.2.80 updates dependencies related to 'log4j' to fix critical and severe vulnerabilities.\r\nhttps://github.com/hail-is/hail/commit/1ad3b9822d4f2d77442d6da93ea4d9ca87796d22",
-            "cve": "CVE-2021-45105",
-            "id": "pyup.io-43599",
+            "advisory": "Jupyterquiz version 1.7.5 improves security of decoding JSON question data.",
+            "cve": "PVE-2021-41822",
+            "id": "pyup.io-41822",
             "specs": [
-                "<0.2.80"
+                "<1.7.5"
             ],
-            "v": "<0.2.80"
-        },
+            "v": "<1.7.5"
+        }
+    ],
+    "jupytext": [
         {
-            "advisory": "Hail 0.2.80 updates dependencies related to 'log4j' to fix critical and severe vulnerabilities.\r\nhttps://github.com/hail-is/hail/commit/1ad3b9822d4f2d77442d6da93ea4d9ca87796d22",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43598",
+            "advisory": "Jupytext 1.10.3 updates 'marked', an indirect dependency of the 'jupyterlab-jupytext' extension, to fix a moderate vulnerability (https://github.com/mwouts/jupytext/issues/750).",
+            "cve": "PVE-2021-40093",
+            "id": "pyup.io-40093",
             "specs": [
-                "<0.2.80"
+                "<1.10.3"
             ],
-            "v": "<0.2.80"
+            "v": "<1.10.3"
         },
         {
-            "advisory": "Hail 0.2.80 updates dependencies related to 'log4j' to fix critical and severe vulnerabilities.\r\nhttps://github.com/hail-is/hail/commit/3a1918dc2836e24384560b7bc2bffd9b3f7c5e02",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43597",
+            "advisory": "Jupytext 1.11.3 updates dependencies of the 'JupyterLab' extension to fix a security vulnerability.",
+            "cve": "PVE-2021-40645",
+            "id": "pyup.io-40645",
             "specs": [
-                "<0.2.80"
+                "<1.11.3"
             ],
-            "v": "<0.2.80"
-        }
-    ],
-    "handprint": [
+            "v": "<1.11.3"
+        },
         {
-            "advisory": "Handprint 1.5.0 updates the underlying 'urllib3' library to v1.26.5 to include security fixes.",
-            "cve": "CVE-2020-7212",
-            "id": "pyup.io-43016",
+            "advisory": "Jupytext 1.11.5 updates dependencies to address several security issues.\r\nhttps://github.com/mwouts/jupytext/issues/842\r\nhttps://github.com/mwouts/jupytext/issues/843",
+            "cve": "PVE-2021-41249",
+            "id": "pyup.io-41249",
             "specs": [
-                "<1.5.0"
+                "<1.11.5"
             ],
-            "v": "<1.5.0"
+            "v": "<1.11.5"
         },
         {
-            "advisory": "urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.",
-            "cve": "CVE-2020-26137",
-            "id": "pyup.io-40823",
+            "advisory": "Jupytext version 1.13.0 updates its jupyterlab extension's dependencies (especially \"ansi-regex\") to handle security vulnerabilities. See CVE-2021-3807.\r\nhttps://github.com/mwouts/jupytext/issues/857",
+            "cve": "CVE-2021-3807",
+            "id": "pyup.io-41777",
             "specs": [
-                "<1.5.0"
+                "<1.13.0"
             ],
-            "v": "<1.5.0"
+            "v": "<1.13.0"
         }
     ],
-    "hardline": [
+    "jw.util": [
         {
-            "advisory": "Hardline 0.12 contains privacy enchantments for hashID domain names.",
-            "cve": "PVE-2021-39435",
-            "id": "pyup.io-39435",
+            "advisory": "An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used. See: CVE-2020-13388.",
+            "cve": "CVE-2020-13388",
+            "id": "pyup.io-38315",
             "specs": [
-                "<0.12"
+                "<2.3"
             ],
-            "v": "<0.12"
-        },
+            "v": "<2.3"
+        }
+    ],
+    "jwcrypto": [
         {
-            "advisory": "Hardline 0.13 uses rolling-code to slightly deter certain fingerprinting attacks on networks with strong client isolation.",
-            "cve": "PVE-2021-40590",
-            "id": "pyup.io-40590",
+            "advisory": "The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).",
+            "cve": "CVE-2016-6298",
+            "id": "pyup.io-42243",
             "specs": [
-                "<0.13"
+                "<0.3.2"
             ],
-            "v": "<0.13"
+            "v": "<0.3.2"
         }
     ],
-    "hashers": [
+    "jwql": [
         {
-            "advisory": "Hashers 0.2.11 adds protection against time-attacks on string comparisons.",
-            "cve": "PVE-2021-39643",
-            "id": "pyup.io-39643",
+            "advisory": "Jwql 0.16.0 updates its dependency 'Django' to v2.1.2 to include a security fix.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-37148",
             "specs": [
-                "<0.2.11"
+                "<0.16.0"
             ],
-            "v": "<0.2.11"
+            "v": "<0.16.0"
         }
     ],
-    "hassmart-homeassistant": [
+    "k8t": [
         {
-            "advisory": "Home Assistant before 0.67.0 was vulnerable to an information disclosure that allowed an unauthenticated attacker to read the application's error log via components/api.py.",
-            "cve": "CVE-2018-21019",
-            "id": "pyup.io-42256",
+            "advisory": "K8t 0.7.5 updates docker image to include a security fix.\r\nhttps://github.com/ClarkSource/k8t/commit/0f0ef80254cc841175e24738f4e19956a04e6435",
+            "cve": "CVE-2021-3121",
+            "id": "pyup.io-44660",
             "specs": [
-                "<0.67.0"
+                "<0.7.5"
             ],
-            "v": "<0.67.0"
+            "v": "<0.7.5"
         }
     ],
-    "heedy": [
+    "kafkacrypto": [
         {
-            "advisory": "Heedy 0.3.0a1 reports it its changelog: There might [...] be security issues. Use at your own risk.",
-            "cve": "PVE-2021-37687",
-            "id": "pyup.io-37687",
+            "advisory": "Kafkacrypto 0.9.5 includes one low severity security fix identified during the crypto review.",
+            "cve": "PVE-2021-37515",
+            "id": "pyup.io-37515",
             "specs": [
-                "<0.3.0a1"
+                "<0.9.5"
             ],
-            "v": "<0.3.0a1"
-        }
-    ],
-    "henosis": [
+            "v": "<0.9.5"
+        },
         {
-            "advisory": "henosis before 0.0.11 included a vulnerability that was opened by using `yaml.load` as opposed to `yaml.safe_load` ([issue 22](https://github.com/vc1492a/henosis/issues/22)).",
-            "cve": "PVE-2021-36303",
-            "id": "pyup.io-36303",
+            "advisory": "Kafkacrypto 0.9.8 includes:\r\n-  Implementation of allowlist and denylists. This removes the need for separate code pathways for root of trusts, enabling them to be treated as entries in allowlist.\r\n- Implementation of automatic processing of messages to adjust allowlists, denylists, and chains. This enables very short chain lifetimes, a security benefit. It also enables a private key to self-sign that it should be revoked.\r\n- Implementation of a pathlength constraint for further tightening of chains. Minimum usable value is typically 1, unless the end of the chain will not sign any further messages.\r\n- Fix kafka wrapper poll implementation to make the timeout optional.",
+            "cve": "PVE-2021-37560",
+            "id": "pyup.io-37560",
             "specs": [
-                "<0.0.11"
+                "<0.9.8"
             ],
-            "v": "<0.0.11"
+            "v": "<0.9.8"
         }
     ],
-    "hhpy": [
+    "kako": [
         {
-            "advisory": "Hhpy 0.1.8 includes an upgrade of bleach for security reasons.",
-            "cve": "PVE-2021-38480",
-            "id": "pyup.io-38480",
+            "advisory": "Kako 1.1.0 updates a few dependencies to resolve dependabot complaints around security issues in \"pyyaml\", \"requests\" and to resolve exceptions raised by `cerberus` when an incorrect simulation is provided.",
+            "cve": "PVE-2021-38720",
+            "id": "pyup.io-38720",
             "specs": [
-                "<0.1.8"
+                "<1.1.0"
             ],
-            "v": "<0.1.8"
+            "v": "<1.1.0"
         }
     ],
-    "hisock": [
+    "kalliope": [
         {
-            "advisory": "Hisock 1.0 updates its dependency 'cryptography' to v35.0.0 to include security patches.",
-            "cve": "PVE-2021-42144",
-            "id": "pyup.io-42144",
+            "advisory": "Kalliope 0.5.3 updates 'requests' dependency to v2.20.1 to fix a security vulnerability.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36808",
             "specs": [
-                "<1.0"
+                "<0.5.3"
             ],
-            "v": "<1.0"
+            "v": "<0.5.3"
         }
     ],
-    "hivemind": [
+    "karlovic": [
         {
-            "advisory": "Hivemind 0.9.5 includes fixes for several known bugs and security vulnerabilities.",
-            "cve": "PVE-2021-40150",
-            "id": "pyup.io-40150",
+            "advisory": "Karlovic 0.1.3beta includes a fix for a vulnerable Pillow function.",
+            "cve": "PVE-2021-38963",
+            "id": "pyup.io-38963",
             "specs": [
-                "<0.9.5"
+                "<0.1.3beta"
             ],
-            "v": "<0.9.5"
+            "v": "<0.1.3beta"
         }
     ],
-    "hkjournalist": [
+    "katal": [
         {
-            "advisory": "Hkjournalist version 0.0.8 includes a security patch for the function 'report' in 'hkjournalist/journalist.py'. It contained an OS injection vulnerability: subprocess call with shell=True.\r\nhttps://github.com/li-xin-yi/HK-journalist/commit/ec95050b13fed27f77ac3ab7ecbc7b1f27f50921",
-            "cve": "PVE-2021-41327",
-            "id": "pyup.io-41327",
+            "advisory": "katal before 0.0.6 uses eval() internally.",
+            "cve": "PVE-2021-34247",
+            "id": "pyup.io-34247",
             "specs": [
-                "<0.0.8"
+                "<0.0.6"
             ],
-            "v": "<0.0.8"
+            "v": "<0.0.6"
         }
     ],
-    "holepunch": [
+    "katka-core": [
         {
-            "advisory": "Holepunch 1.0.0 drops support for Python 2 and 3 < 3.6. These versions are not receiving security updates anymore.",
-            "cve": "CVE-2021-3177",
-            "id": "pyup.io-43376",
+            "advisory": "Katka-core 0.11.0 decreases the amount of gaping security holes related to broken authentication.\r\nhttps://github.com/kpn/katka-core/commit/adeffeff55c5b58d73bbbe9ccbf5735677f1b650",
+            "cve": "PVE-2021-36914",
+            "id": "pyup.io-36914",
             "specs": [
-                "<1.0.0"
+                "<0.11.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.11.0"
+        }
+    ],
+    "katsdptelstate": [
         {
-            "advisory": "Holepunch 1.0.0 drops support for Python 2 and 3 < 3.6. These versions are not receiving security updates anymore.",
-            "cve": "CVE-2020-27619",
-            "id": "pyup.io-43392",
+            "advisory": "Katsdptelstate 0.9 disable pickles by default for security.",
+            "cve": "PVE-2021-38321",
+            "id": "pyup.io-38321",
             "specs": [
-                "<1.0.0"
+                "<0.9"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.9"
+        }
+    ],
+    "kaze-python": [
         {
-            "advisory": "Holepunch 1.0.0 drops support for Python 2 and 3 < 3.6. These versions are not receiving security updates anymore.",
-            "cve": "CVE-2021-3737",
-            "id": "pyup.io-43393",
+            "advisory": "kaze-python 0.6.5 fixes vulnerability to RPC invoke functionality that can send node into unclosed loop during 'test' invokes.",
+            "cve": "PVE-2021-36494",
+            "id": "pyup.io-36494",
             "specs": [
-                "<1.0.0"
+                "<0.6.5"
             ],
-            "v": "<1.0.0"
+            "v": "<0.6.5"
         },
         {
-            "advisory": "Holepunch 1.0.0 drops support for Python 2 and 3 < 3.6. These versions are not receiving security updates anymore.",
-            "cve": "CVE-2020-8492",
-            "id": "pyup.io-43394",
+            "advisory": "kaze-python 0.7.8 fixes vulnerability to RPC invoke functionality that can send node into unclosed loop during 'test' invokes.",
+            "cve": "PVE-2021-36493",
+            "id": "pyup.io-36493",
             "specs": [
-                "<1.0.0"
+                "<0.7.8"
             ],
-            "v": "<1.0.0"
+            "v": "<0.7.8"
         }
     ],
-    "holocron": [
+    "kdcproxy": [
         {
-            "advisory": "holocron 0.2.0 fixed a security issue when content author may steal private data through content's meta header.",
-            "cve": "PVE-2021-25844",
-            "id": "pyup.io-25844",
+            "advisory": "python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.",
+            "cve": "CVE-2015-5159",
+            "id": "pyup.io-36597",
             "specs": [
-                "<0.2.0"
+                "<0.3.2"
             ],
-            "v": "<0.2.0"
+            "v": "<0.3.2"
         }
     ],
-    "homeassistant": [
+    "kedro-viz": [
         {
-            "advisory": "homeassistant before 0.37 uses a weak random number generator to create access tokens for camera feeds which could be brute force attacked in 2.5 weeks",
-            "cve": "PVE-2021-34222",
-            "id": "pyup.io-34222",
+            "advisory": "Kedro-viz 2.1.0 fixes an infosec vulnerability in LoDash (16).",
+            "cve": "PVE-2021-37353",
+            "id": "pyup.io-37353",
             "specs": [
-                "<0.37"
+                "<2.1.0"
             ],
-            "v": "<0.37"
+            "v": "<2.1.0"
         },
         {
-            "advisory": "homeassistant before 0.73.2 and >=0.56 is vulnerable to a man in the middle attack since SSL verification was disabled for **outgoing** requests that were done using the shared aiohttp session.",
-            "cve": "PVE-2021-36326",
-            "id": "pyup.io-36326",
+            "advisory": "Kedro-viz 3.0.0 includes a Snyk fix for one, unspecified vulnerability.",
+            "cve": "PVE-2021-37615",
+            "id": "pyup.io-37615",
             "specs": [
-                ">=0.56,<0.73.2"
+                "<3.0.0"
             ],
-            "v": ">=0.56,<0.73.2"
+            "v": "<3.0.0"
         },
         {
-            "advisory": "The markdown renderer in homeassistant 0.98 is vulnerable to an XSS attack if exposed to specially crafted markdown. This was fixed in 0.98.5.\r\nhttps://github.com/home-assistant/home-assistant-polymer/pull/3640",
-            "cve": "PVE-2021-37453",
-            "id": "pyup.io-37453",
+            "advisory": "Kedro-viz 3.3.0 adds bandit for security scanning as a pre-commit hook.",
+            "cve": "PVE-2021-38329",
+            "id": "pyup.io-38329",
             "specs": [
-                ">=0.98,<0.98.5"
+                "<3.3.0"
             ],
-            "v": ">=0.98,<0.98.5"
+            "v": "<3.3.0"
         }
     ],
-    "hooktest": [
+    "keepkey": [
         {
-            "advisory": "Hooktest 1.3.1 updates its dependency \"validators\" to fix a security leak.",
-            "cve": "PVE-2021-41910",
-            "id": "pyup.io-41910",
+            "advisory": "Keepkey 6.6.0 includes vulnerability fixes. No more information was disclosed.",
+            "cve": "PVE-2021-41885",
+            "id": "pyup.io-41885",
             "specs": [
-                "<1.3.1"
+                "<6.6.0"
             ],
-            "v": "<1.3.1"
+            "v": "<6.6.0"
         }
     ],
-    "horizon": [
+    "keplergl": [
         {
-            "advisory": "An issue was discovered in OpenStack Horizon before 15.3.2, 16.x before 16.2.1, 17.x and 18.x before 18.3.3, 18.4.x, and 18.5.x. There is a lack of validation of the \"next\" parameter, which would allow someone to supply a malicious URL in Horizon that can cause an automatic redirect to the provided malicious URL. See CVE-2020-29565.",
-            "cve": "CVE-2020-29565",
-            "id": "pyup.io-39226",
+            "advisory": "Keplergl 0.3.1 fixes several security vulnerabilities related to packages resolutions.\r\nhttps://github.com/keplergl/kepler.gl/pull/1294/commits/8a5a3fb07a498425b60841033fbd12ff9791f873",
+            "cve": "PVE-2021-39211",
+            "id": "pyup.io-39211",
             "specs": [
-                "<15.3.2",
-                ">=17.0,<18.3.3",
-                ">=16.0.0.0b1,<16.2.1"
+                "<0.3.1"
             ],
-            "v": "<15.3.2,>=17.0,<18.3.3,>=16.0.0.0b1,<16.2.1"
+            "v": "<0.3.1"
         }
     ],
-    "hotaru": [
+    "keras": [
         {
-            "advisory": "Hotaru 3.2.4 updates tensorflow to >= 2.2.1. Tensorflow versions before 2.2.1 are known to be affected by several CVEs.",
-            "cve": "PVE-2021-38822",
-            "id": "pyup.io-38822",
+            "advisory": "Keras 2.6.0rc3 fixes a security issue for loading keras models via yaml, which could allow arbitrary code execution. See CVE-2021-37678.\r\nhttps://github.com/keras-team/keras/commit/32febb6cdebe166fc70ad72f2da37607c13bb11a",
+            "cve": "CVE-2021-37678",
+            "id": "pyup.io-41100",
             "specs": [
-                "<3.2.4"
+                "<2.6.0rc3"
             ],
-            "v": "<3.2.4"
+            "v": "<2.6.0rc3"
         }
     ],
-    "hover": [
+    "kerberos": [
         {
-            "advisory": "Hover 0.4.0 was released with the acknowledgement that it (and previous versions?) includes a potential security concern. In particular, it displays traceback information if something breaks in the scope of the recipe.",
-            "cve": "PVE-2021-39389",
-            "id": "pyup.io-39389",
+            "advisory": "The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.",
+            "cve": "CVE-2015-3206",
+            "id": "pyup.io-42240",
             "specs": [
-                "<=0.4.0"
+                ">0"
             ],
-            "v": "<=0.4.0"
+            "v": ">0"
         }
     ],
-    "hpack": [
-        {
-            "advisory": "A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.",
-            "cve": "CVE-2016-6580",
-            "id": "pyup.io-35679",
-            "specs": [
-                "<1.2.0"
-            ],
-            "v": "<1.2.0"
-        },
-        {
-            "advisory": "A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called \"HPACK Bomb\" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.",
-            "cve": "CVE-2016-6581",
-            "id": "pyup.io-35680",
-            "specs": [
-                "<2.3.0"
-            ],
-            "v": "<2.3.0"
-        },
+    "kerko": [
         {
-            "advisory": "Hhpack 2.3.0 enforces a maximum value of the decompressed size of the header list. This is to avoid the so-called \"HPACK Bomb\" vulnerability, which is caused when a malicious peer sends a compressed HPACK body that decompresses to a gigantic header list size. See: CVE-2016-6581.\r\n\r\nHhpack 2.3.0 also adds a 'OversizedHeaderListError', which is thrown by the 'decode' method if the maximum header list size is being violated. This places the HPACK decoder into a broken state: it must not be used after this exception is thrown.\r\n\r\nLastly, hhpack 2.3.0 adds a 'max_header_list_size' to the 'Decoder' object. This controls the maximum allowable decompressed size of the header list. By default this is set to 64kB.",
-            "cve": "CVE-2016-6581",
-            "id": "pyup.io-38742",
+            "advisory": "Kerko 0.7.1 fixes unescaped date fields which could allow XSS attacks.\r\nhttps://github.com/whiskyechobravo/kerko/commit/28740a2c14d4c40ec119dc79b34a2d7d404039cf",
+            "cve": "PVE-2021-42709",
+            "id": "pyup.io-42709",
             "specs": [
-                "<2.3.0"
+                ">=0.7,<0.7.1"
             ],
-            "v": "<2.3.0"
+            "v": ">=0.7,<0.7.1"
         }
     ],
-    "hpim-dm": [
+    "keyring": [
         {
-            "advisory": "hpim-dm 1.0 includes dissertation work and security implementation",
-            "cve": "PVE-2021-37836",
-            "id": "pyup.io-37836",
+            "advisory": "Python keyring lib before 0.10 created keyring files with world-readable permissions. See: CVE-2012-5577.",
+            "cve": "CVE-2012-5577",
+            "id": "pyup.io-37610",
             "specs": [
-                "<1.0"
+                "<0.10"
             ],
-            "v": "<1.0"
+            "v": "<0.10"
         },
         {
-            "advisory": "Hpim-dm 1.4 fixes security issues on IPv6 HPIM-DM interfaces.",
-            "cve": "PVE-2021-39387",
-            "id": "pyup.io-39387",
-            "specs": [
-                "<1.4"
-            ],
-            "v": "<1.4"
-        }
-    ],
-    "html-to-csv": [
-        {
-            "advisory": "All versions of html-to-csv are affected by CVE-2021-23654: When there is a formula embedded in a HTML page, it gets accepted without any validation and the same would be pushed while converting it into a CSV file. Through this, a malicious actor can embed or generate a malicious link or execute commands via CSV files.\r\nhttps://github.com/hanwentao/html2csv/blob/master/html2csv/converter.py",
-            "cve": "CVE-2021-23654",
-            "id": "pyup.io-42868",
+            "advisory": "Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.",
+            "cve": "CVE-2012-4571",
+            "id": "pyup.io-25870",
             "specs": [
-                ">0"
+                "<0.9.1"
             ],
-            "v": ">0"
-        }
-    ],
-    "html5": [
+            "v": "<0.9.1"
+        },
         {
-            "advisory": "Html5 0.99999999 fixes a XSS vulnerability exploitable when using legacy browsers. This release alters the API so that quote_attr_values is now a ternary setting, choosing between legacy-safe behavior, spec behavior, and always quoting.\r\nhttps://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7",
-            "cve": "PVE-2021-25845",
-            "id": "pyup.io-25845",
+            "advisory": "Python keyring has insecure permissions on new databases allowing world-readable files to be created. See: CVE-2012-5578.",
+            "cve": "CVE-2012-5578",
+            "id": "pyup.io-37743",
             "specs": [
-                "<0.99999999"
+                "<=0.10"
             ],
-            "v": "<0.99999999"
+            "v": "<=0.10"
         }
     ],
-    "html5lib": [
+    "keystone": [
         {
-            "advisory": "The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of special characters in attribute values, a different vulnerability than CVE-2016-9909.\r\nhttps://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7",
-            "cve": "CVE-2016-9910",
-            "id": "pyup.io-35694",
+            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times. See: CVE-2020-12692.",
+            "cve": "CVE-2020-12692",
+            "id": "pyup.io-38584",
             "specs": [
-                "<0.99999999",
-                ">=1.0b1,<1.0b9"
+                "<15.0.1",
+                "==16.0.0"
             ],
-            "v": "<0.99999999,>=1.0b1,<1.0b9"
+            "v": "<15.0.1,==16.0.0"
         },
         {
-            "advisory": "The serializer in html5lib before 0.99999999 might allow remote attackers to conduct cross-site scripting (XSS) attacks by leveraging mishandling of the < (less than) character in attribute values.\r\nhttps://github.com/html5lib/html5lib-python/commit/9b8d8eb5afbc066b7fac9390f5ec75e5e8a7cab7",
-            "cve": "CVE-2016-9909",
-            "id": "pyup.io-35693",
-            "specs": [
-                "<0.99999999",
-                ">=1.0b1,<1.0b9"
-            ],
-            "v": "<0.99999999,>=1.0b1,<1.0b9"
-        }
-    ],
-    "httpauth": [
-        {
-            "advisory": "httpauth 0.2 fixes a security issue: Invalid username + empty password were being accepted.",
-            "cve": "PVE-2021-25847",
-            "id": "pyup.io-25847",
+            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. See: CVE-2020-12689.",
+            "cve": "CVE-2020-12689",
+            "id": "pyup.io-38587",
             "specs": [
-                "<0.2"
+                "<15.0.1",
+                "==16.0.0"
             ],
-            "v": "<0.2"
-        }
-    ],
-    "httpie": [
+            "v": "<15.0.1,==16.0.0"
+        },
         {
-            "advisory": "Httpie 1.0.3 fixes CVE-2019-10751. The way the output filename is generated for ``--download`` requests without ``--output`` resulting in a redirect has been changed to only consider the initial URL as the base for the generated filename, and not the final one. See: <https://github.com/jakubroztocil/httpie/releases/tag/1.0.3>.",
-            "cve": "CVE-2019-10751",
-            "id": "pyup.io-37405",
+            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access. See: CVE-2020-12690.",
+            "cve": "CVE-2020-12690",
+            "id": "pyup.io-38583",
             "specs": [
-                "<1.0.3"
+                "<15.0.1",
+                "==16.0.0"
             ],
-            "v": "<1.0.3"
-        }
-    ],
-    "httplib2": [
+            "v": "<15.0.1,==16.0.0"
+        },
         {
-            "advisory": "In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server. This vulnerability impacts software that uses httplib2 with uri constructed by string concatenation, as opposed to proper urllib building with escaping. This has been fixed in 0.18.0. See CVE-2020-11078.",
-            "cve": "CVE-2020-11078",
-            "id": "pyup.io-38368",
+            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. See: CVE-2020-12691.",
+            "cve": "CVE-2020-12691",
+            "id": "pyup.io-38585",
             "specs": [
-                "<0.18.0"
+                "<15.0.1",
+                "==16.0.0"
             ],
-            "v": "<0.18.0"
+            "v": "<15.0.1,==16.0.0"
         },
         {
-            "advisory": "Httplib2 0.18.0 is an important security update to patch a CWE-93 CRLF injection vulnerability which forces %xx quote of space, CR, LF characters in uri. See: <https://cwe.mitre.org/data/definitions/93.html>.",
-            "cve": "PVE-2021-38303",
-            "id": "pyup.io-38303",
+            "advisory": "OpenStack Keystone 15.0.0 and 16.0.0 are affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.) See: CVE-2019-19687.",
+            "cve": "CVE-2019-19687",
+            "id": "pyup.io-37770",
             "specs": [
-                "<0.18.0"
+                "==15.0.0",
+                "==16.0.0"
             ],
-            "v": "<0.18.0"
+            "v": "==15.0.0,==16.0.0"
         },
         {
-            "advisory": "httplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of \"\\xa0\" characters in the \"www-authenticate\" header may cause Denial of Service (CPU burn while parsing header) of the httplib2 client accessing said server. This is fixed in version 0.19.0 which contains a new implementation of auth headers parsing using the pyparsing library. See CVE-2021-21240.",
-            "cve": "CVE-2021-21240",
-            "id": "pyup.io-39608",
+            "advisory": "HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. See: CVE-2013-2255.",
+            "cve": "CVE-2013-2255",
+            "id": "pyup.io-38589",
             "specs": [
-                "<0.19.0"
+                "==2013"
             ],
-            "v": "<0.19.0"
+            "v": "==2013"
         },
         {
-            "advisory": "httplib2 before and including 0.9.2 on \"SSL certificate hostname mismatch\" it is checked only once: https://github.com/httplib2/httplib2/issues/5",
-            "cve": "PVE-2021-25848",
-            "id": "pyup.io-25848",
+            "advisory": "It is possible to remotely trigger a crash in Keystone by sending an extremely long password. When Keystone is validating the password, glibc allocates space on the stack for the entire password. If the password is long enough, stack space can be exhausted, resulting in a crash. This vulnerability is mitigated by a patch to impose a reasonable limit on password length (4 kB). Reportedly, all versions are affected. See also: CVE-2012-1572 and https://security.openstack.org/ossa/OSSA-2012-002.html.",
+            "cve": "CVE-2012-1572",
+            "id": "pyup.io-38586",
             "specs": [
-                "<=0.9.2"
+                ">0",
+                "<0"
             ],
-            "v": "<=0.9.2"
+            "v": ">0,<0"
         }
     ],
-    "httprunner": [
+    "keystonemiddleware": [
         {
-            "advisory": "Httprunner 2.0.5 fixes XSS in response json.\r\nhttps://github.com/httprunner/httprunner/commit/6cd930ce0d37a3f92bb4f4b9689c7617e610ff43",
-            "cve": "PVE-2021-36945",
-            "id": "pyup.io-36945",
+            "advisory": "Keystonemiddleware versions 0.11.0 and 1.2.0 include a fix for CVE-2014-7144: OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the \"insecure\" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.\r\nhttp://www.openwall.com/lists/oss-security/2014/09/25/51\r\nhttps://bugs.launchpad.net/python-keystoneclient/+bug/1353315\r\nhttp://rhn.redhat.com/errata/RHSA-2014-1783.html\r\nhttp://rhn.redhat.com/errata/RHSA-2014-1784.html\r\nhttp://rhn.redhat.com/errata/RHSA-2015-0020.html\r\nhttp://www.ubuntu.com/usn/USN-2705-1\r\nhttp://www.securityfocus.com/bid/69864\r\nhttp://secunia.com/advisories/62709",
+            "cve": "CVE-2014-7144",
+            "id": "pyup.io-42222",
             "specs": [
-                "<2.0.5"
+                "<0.11.0",
+                ">=1.0.0,<1.2.0"
             ],
-            "v": "<2.0.5"
+            "v": "<0.11.0,>=1.0.0,<1.2.0"
         },
         {
-            "advisory": "Httprunner 2.1.3 replaces eval() with builtins to prevent security vulnerabilities.\r\nhttps://github.com/httprunner/httprunner/pull/608/commits/9e6c3b6aa4220f6ffbb13604767ee7e1b525c0de",
-            "cve": "PVE-2021-37216",
-            "id": "pyup.io-37216",
+            "advisory": "The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.",
+            "cve": "CVE-2015-7546",
+            "id": "pyup.io-25871",
             "specs": [
-                "<2.1.3"
+                "<1.5.4",
+                ">=2.0,<2.3.3"
             ],
-            "v": "<2.1.3"
-        }
-    ],
-    "httpsig": [
+            "v": "<1.5.4,>=2.0,<2.3.3"
+        },
         {
-            "advisory": "httpsig 1.0.0 removed suport for reading keyfiles from disk as this is a huge security hole if this is used in a server framework like drf-httpsig.",
-            "cve": "PVE-2021-25849",
-            "id": "pyup.io-25849",
+            "advisory": "The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the \"insecure\" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.",
+            "cve": "CVE-2015-1852",
+            "id": "pyup.io-25872",
             "specs": [
-                "<1.0.0"
+                "<1.6.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.6.0"
         }
     ],
-    "httpsig-cffi": [
+    "kglab": [
         {
-            "advisory": "httpsig-cffi 1.0.0 removed suport for reading keyfiles from disk as this is a huge security hole if this is used in a server framework like drf-httpsig.",
-            "cve": "PVE-2021-25850",
-            "id": "pyup.io-25850",
+            "advisory": "Kglab 0.4.1 includes a minimum version requirement for its dependency 'jupyterlab' to include a security fix.",
+            "cve": "CVE-2021-32797",
+            "id": "pyup.io-42895",
             "specs": [
-                "<1.0.0"
+                "<0.4.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.4.1"
         }
     ],
-    "httpx-socks": [
+    "khoros": [
         {
-            "advisory": "Httpx-socks 0.7.2 adds support for SSL secure connections.\r\nhttps://github.com/romis2012/httpx-socks/commit/c7fab549cdfbb4ad37aacb67364b32194fe65e76",
-            "cve": "PVE-2021-42827",
-            "id": "pyup.io-42827",
+            "advisory": "Khoros 2.2.0 includes changes to the :doc:`supporting modules <supporting-modules>`. The ``yaml.load()`` function call got replaced with ``yaml.safe_load()`` in :py:func:`khoros.utils.helper.import_yaml_file` as it is a better security practice.",
+            "cve": "PVE-2021-38223",
+            "id": "pyup.io-38223",
             "specs": [
-                "<0.7.2"
+                "<2.2.0"
             ],
-            "v": "<0.7.2"
-        }
-    ],
-    "hub": [
+            "v": "<2.2.0"
+        },
         {
-            "advisory": "Hub 0.9.0 upgrades urllib3 to urllib3[secure].",
-            "cve": "PVE-2021-39217",
-            "id": "pyup.io-39217",
+            "advisory": "Khoros 3.5.0 added the '.github/workflows/bandit.yml' GitHub Action workflow configuration file to leverage the 'Python security check using Bandit' action to perform security audits with each push event. It also changed the default value for the 'shell' parameter to be 'False' in the :py:func:khoros.utils.core_utils.run_cmd function to improve overall security of the library. See also <https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html>.",
+            "cve": "PVE-2021-40102",
+            "id": "pyup.io-40102",
             "specs": [
-                "<0.9.0"
+                "<3.5.0"
             ],
-            "v": "<0.9.0"
-        }
-    ],
-    "hubitatmaker": [
+            "v": "<3.5.0"
+        },
         {
-            "advisory": "Hubitatmaker 0.5.4 updates dependencies to fix some low-severity vulnerabilities.",
-            "cve": "PVE-2021-40101",
-            "id": "pyup.io-40101",
+            "advisory": "Khoros 4.2.0 replaces the module :py:mod:\"xml.etree.ElementTree\" with :py:mod:\"defusedxml.ElementTree\" to proactively mitigate a known XML vulnerability.\r\nhttps://github.com/jeffshurtliff/khoros/pull/42\r\nhttps://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b313-b320-xml",
+            "cve": "PVE-2021-41300",
+            "id": "pyup.io-41300",
             "specs": [
-                "<0.5.4"
+                "<4.2.0"
             ],
-            "v": "<0.5.4"
+            "v": "<4.2.0"
         }
     ],
-    "hug": [
+    "khorosjx": [
         {
-            "advisory": "hug 2.3.0 fixes a vulnerability in the static file router that allows files in parent directory to be accessed.",
-            "cve": "PVE-2021-34472",
-            "id": "pyup.io-34472",
+            "advisory": "khorosjx 2.3.1 upgrades the bleach package to version 3.1.1 to mitigate an XSS security issue",
+            "cve": "PVE-2021-37935",
+            "id": "pyup.io-37935",
             "specs": [
-                "<2.3.0"
+                "<2.3.1"
             ],
-            "v": "<2.3.0"
-        }
-    ],
-    "humblesetuptools": [
+            "v": "<2.3.1"
+        },
         {
-            "advisory": "humblesetuptools 0.9.5 fixes a security vulnerability in SSL certificate validation.",
-            "cve": "PVE-2021-25851",
-            "id": "pyup.io-25851",
+            "advisory": "Khorosjx 2.5.0 updates its dependency 'bleach' to v3.1.2 to include a security fix.",
+            "cve": "CVE-2020-6816",
+            "id": "pyup.io-38236",
             "specs": [
-                "<0.9.5"
+                "<2.5.0"
             ],
-            "v": "<0.9.5"
+            "v": "<2.5.0"
         },
         {
-            "advisory": "humblesetuptools 1.3 adresses a security vulnerability in SSL match_hostname check as reported in  Python #17997.",
-            "cve": "PVE-2021-25852",
-            "id": "pyup.io-25852",
+            "advisory": "Khorosjx 2.5.1 updates its dependency 'Bleach' to v3.1.4 to include a security fix.",
+            "cve": "CVE-2020-6817",
+            "id": "pyup.io-38235",
             "specs": [
-                "<1.3"
+                "<2.5.1"
             ],
-            "v": "<1.3"
+            "v": "<2.5.1"
+        },
+        {
+            "advisory": "Khorosjx 3.0.0 updates its dependency \"twine\" to a secure version.",
+            "cve": "PVE-2021-41754",
+            "id": "pyup.io-41754",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
         }
     ],
-    "hxl-proxy": [
+    "kili": [
         {
-            "advisory": "Hxl-proxy 1.22 updates to libhxl=4.22 for security reasons.",
-            "cve": "PVE-2021-40296",
-            "id": "pyup.io-40296",
+            "advisory": "Kili 2.87.0 secured its core API. From 16/09/2021 on, package maintainers prompt all users of the Python SDK on the SaaS application to upgrade kili to its last version. No more details were given.",
+            "cve": "PVE-2021-41724",
+            "id": "pyup.io-41724",
             "specs": [
-                "<1.22"
+                "<2.87.0"
             ],
-            "v": "<1.22"
+            "v": "<2.87.0"
         }
     ],
-    "hydroshare": [
+    "kinto": [
         {
-            "advisory": "hydroshare before 1.9.5 has multiple - undisclosed - security issues.",
-            "cve": "PVE-2021-34264",
-            "id": "pyup.io-34264",
+            "advisory": "kinto 12.0.2\r\n **security**: Fix a pagination bug in the PostgreSQL backend that could leak records between collections",
+            "cve": "PVE-2021-36841",
+            "id": "pyup.io-36841",
             "specs": [
-                "<1.9.5"
+                "<12.0.2"
             ],
-            "v": "<1.9.5"
+            "v": "<12.0.2"
         },
         {
-            "advisory": "hydroshare before 1.9.6 has multiple - undisclosed - security issues.",
-            "cve": "PVE-2021-34265",
-            "id": "pyup.io-34265",
+            "advisory": "kinto 13.0.0 **security**: Fix a pagination bug in the PostgreSQL backend that could leak records between collections",
+            "cve": "PVE-2021-36840",
+            "id": "pyup.io-36840",
             "specs": [
-                "<1.9.6"
+                "<13.0.0"
             ],
-            "v": "<1.9.6"
-        }
-    ],
-    "hyper-kube-config": [
+            "v": "<13.0.0"
+        },
         {
-            "advisory": "Hyper-kube-config 0.6.1 includes an update of Cryptography to mitigate CVE-2020-25659.",
-            "cve": "CVE-2020-25659",
-            "id": "pyup.io-38968",
+            "advisory": "kinto 5.1.0 replaced insecure use of ``random.random()`` and ``random.choice(...)`` with more secure ``random.SystemRandom().random()`` and ``random.SystemRandom().choice(...)``.",
+            "cve": "PVE-2021-25873",
+            "id": "pyup.io-25873",
             "specs": [
-                "<0.6.1"
+                "<5.1.0"
             ],
-            "v": "<0.6.1"
-        }
-    ],
-    "hyperkitty": [
+            "v": "<5.1.0"
+        },
         {
-            "advisory": "An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4. When importing a private mailing list's archives, these archives are publicly visible for the duration of the import. For example, sensitive information might be available on the web for an hour during a large migration from Mailman 2 to Mailman 3.",
-            "cve": "CVE-2021-33038",
-            "id": "pyup.io-42316",
+            "advisory": "Kinto 5.3.5 prevents injections in the PostgreSQL permission backend.",
+            "cve": "PVE-2021-38954",
+            "id": "pyup.io-38954",
             "specs": [
-                "<1.3.4"
+                "<5.3.5"
             ],
-            "v": "<1.3.4"
+            "v": "<5.3.5"
         }
     ],
-    "hypothesis": [
+    "kinto-dist": [
         {
-            "advisory": "Hypothesis 3.69.8 moves away from using pickle module and replaces it with json to prevent possible security issues.",
-            "cve": "PVE-2021-39447",
-            "id": "pyup.io-39447",
+            "advisory": "Signer parameters in kinto-dist before 15.0.2 were displayed in capabilities. This was a security concern.",
+            "cve": "PVE-2021-37169",
+            "id": "pyup.io-37169",
             "specs": [
-                "<3.69.8"
+                "<15.0.2"
             ],
-            "v": "<3.69.8"
-        }
-    ],
-    "ib-client": [
+            "v": "<15.0.2"
+        },
         {
-            "advisory": "Ib-client 0.1.2 updates packages (especially Jinja2 which had a vulnerability in version 2.10).",
-            "cve": "PVE-2021-37047",
-            "id": "pyup.io-37047",
+            "advisory": "Kinto-dist 17.0.0 fixes a pagination bug in the PostgreSQL backend that could leak records between collections.",
+            "cve": "PVE-2021-36153",
+            "id": "pyup.io-36153",
             "specs": [
-                "<0.1.2"
+                "<17.0.0"
             ],
-            "v": "<0.1.2"
-        }
-    ],
-    "idchecker": [
+            "v": "<17.0.0"
+        },
         {
-            "advisory": "Idchecker 1.1.1 was re-created for security reasons.",
-            "cve": "PVE-2021-40134",
-            "id": "pyup.io-40134",
+            "advisory": "Kinto-dist between 6.0.0 and 6.0.2 included Kinto 8.2.0 where the `account` plugin had a security flaw where the password wasn't verified during the session duration.",
+            "cve": "PVE-2021-36291",
+            "id": "pyup.io-36291",
             "specs": [
-                "<1.1.1"
+                ">=6.0.0,<=6.0.2"
             ],
-            "v": "<1.1.1"
+            "v": ">=6.0.0,<=6.0.2"
         }
     ],
-    "ihatemoney": [
+    "kiosk-client": [
         {
-            "advisory": "In \"I hate money\" before version 4.1.5, an authenticated member of one project can modify and delete members of another project, without knowledge of this other project's private code. This can be further exploited to access all bills of another project without knowledge of this other project's private code. With the default configuration, anybody is allowed to create a new project. An attacker can create a new project and then use it to become authenticated and exploit this flaw. As such, the exposure is similar to an unauthenticated attack, because it is trivial to become authenticated. See CVE-2020-15120.",
-            "cve": "CVE-2020-15120",
-            "id": "pyup.io-42278",
+            "advisory": "Kiosk-client 0.2.1 updates Twisted to the latest version due to CVE-2019-12855. In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.",
+            "cve": "CVE-2019-12855",
+            "id": "pyup.io-38382",
             "specs": [
-                "<4.1.5"
+                "<0.2.1"
             ],
-            "v": "<4.1.5"
+            "v": "<0.2.1"
         },
         {
-            "advisory": "Ihatemoney version 5.0.0 includes several security fixes/improvements:\r\n- Adds CSRF validation on destructive actions.\r\n- Asks for private code to delete project or project history.\r\n- Adds headers to mitigate Clickjacking, XSS, and other attacks.\r\n- Adds URL validation to external link to prevent XSS.",
-            "cve": "PVE-2021-42349",
-            "id": "pyup.io-42349",
+            "advisory": "Kiosk-client 0.2.2 update Pillow to >=6.2.0 to address CVE-2019-16865.\r\n\r\nAn issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.",
+            "cve": "CVE-2019-16865",
+            "id": "pyup.io-38601",
             "specs": [
-                "<5.0.0"
+                "<0.2.2"
             ],
-            "v": "<5.0.0"
+            "v": "<0.2.2"
         }
     ],
-    "im": [
+    "kiwitcms": [
         {
-            "advisory": "im 1.5.0 removes use of insecure Pickle data.",
-            "cve": "PVE-2021-36819",
-            "id": "pyup.io-36819",
+            "advisory": "Kiwitcms 3.36.0 no longer include Regular Expression Denial of Service (ReDoS) vulnerabilities in the included `moment` Javascript library.",
+            "cve": "PVE-2021-39074",
+            "id": "pyup.io-39074",
             "specs": [
-                "<1.5.0"
+                "<3.36.0"
             ],
-            "v": "<1.5.0"
-        }
-    ],
-    "imageedit": [
+            "v": "<3.36.0"
+        },
         {
-            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-42638",
+            "advisory": "Kiwitcms 3.8.102 fixes bug 1133912: Script injection in notes field.",
+            "cve": "PVE-2021-39075",
+            "id": "pyup.io-39075",
             "specs": [
-                "<2021"
+                "<3.8.102"
             ],
-            "v": "<2021"
+            "v": "<3.8.102"
         },
         {
-            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-42639",
+            "advisory": "Kiwi TCMS 4.2 starts using the more cryptographically secure module 'secrets' for activation keys.\r\nhttps://github.com/kiwitcms/Kiwi/commit/e45dde2f42336df74a284678a4d59bea699d5994",
+            "cve": "PVE-2021-42529",
+            "id": "pyup.io-42529",
             "specs": [
-                "<2021"
+                "<4.2"
             ],
-            "v": "<2021"
+            "v": "<4.2"
         },
         {
-            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-42640",
+            "advisory": "Kiwi TCMS 4.2 uses SHA256 instead of insecure MD5 and SHA1.\r\nhttps://github.com/kiwitcms/Kiwi/commit/e17c071623e055c24a0fdf203991819d446c8f09",
+            "cve": "PVE-2021-42528",
+            "id": "pyup.io-42528",
             "specs": [
-                "<2021"
+                "<4.2"
             ],
-            "v": "<2021"
+            "v": "<4.2"
         },
         {
-            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-42637",
+            "advisory": "Kiwi TCMS 4.2 removes an unnecessary AJAX view that had a remote code execution vulnerability.\r\nhttps://github.com/kiwitcms/Kiwi/commit/bb986000ed3cb222832e1e4535dd6316d32503f8",
+            "cve": "PVE-2021-38543",
+            "id": "pyup.io-38543",
             "specs": [
-                "<2021"
+                "<4.2"
             ],
-            "v": "<2021"
+            "v": "<4.2"
         },
         {
-            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-42636",
+            "advisory": "Kiwi TCMS 4.2 updates its dependency 'patternfly' to version 3.36.0 to include security fixes.",
+            "cve": "PVE-2021-42530",
+            "id": "pyup.io-42530",
             "specs": [
-                "<2021"
+                "<4.2"
             ],
-            "v": "<2021"
+            "v": "<4.2"
         },
         {
-            "advisory": "Imageedit 2021 updates its dependency 'pillow' to version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-42439",
+            "advisory": "Kiwitcms 6.0 updates its dependency Django to v2.1.2 to include a security fix.",
+            "cve": "CVE-2018-16984",
+            "id": "pyup.io-36649",
             "specs": [
-                "<2021"
+                "<6.0"
             ],
-            "v": "<2021"
-        }
-    ],
-    "imageio": [
+            "v": "<6.0"
+        },
         {
-            "advisory": "imageio 2.6.0 fixes a security vulnerability for Windows users that have dcmtk installed, and where an attacker can set the filename",
-            "cve": "PVE-2021-37902",
-            "id": "pyup.io-37902",
+            "advisory": "Kiwitcms v6.10 adds missing permission checks for menus in Test run page UI template.\r\nhttps://github.com/kiwitcms/Kiwi/issues/716",
+            "cve": "PVE-2021-42119",
+            "id": "pyup.io-42119",
             "specs": [
-                "<2.6.0"
+                "<6.10"
             ],
-            "v": "<2.6.0"
-        }
-    ],
-    "imgstore": [
+            "v": "<6.10"
+        },
         {
-            "advisory": "Imgstore version 0.2.9 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/loopbio/imgstore/commit/06b49a519b687ff3cd20b06c4c797818df812d06#diff-9e38eed8462f9c72f080c6c96c054a06d828dbd0ebca39f3738471d4557c704a",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41330",
+            "advisory": "Kiwitcms 6.10 updates Django from 2.2.1 to 2.2.2 (see CVE-2019-12308).",
+            "cve": "CVE-2019-12308",
+            "id": "pyup.io-38537",
             "specs": [
-                "<0.2.9"
+                "<6.10"
             ],
-            "v": "<0.2.9"
-        }
-    ],
-    "impalacli": [
+            "v": "<6.10"
+        },
         {
-            "advisory": "Impalacli 0.1.6 updates dependencies to fix vulnerabilities.",
-            "cve": "PVE-2021-41936",
-            "id": "pyup.io-41936",
+            "advisory": "Kiwitcms 6.10 updates its dependency 'Django' to include security fixes.",
+            "cve": "CVE-2019-11358",
+            "id": "pyup.io-39590",
             "specs": [
-                "<0.1.6"
+                "<6.10"
             ],
-            "v": "<0.1.6"
-        }
-    ],
-    "in-toto": [
+            "v": "<6.10"
+        },
         {
-            "advisory": "In-toto version 1.0.1 updates its dependency \"cryptography\" to include a security fix.",
-            "cve": "CVE-2020-36242",
-            "id": "pyup.io-41832",
+            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
+            "cve": "CVE-2019-12781",
+            "id": "pyup.io-38544",
             "specs": [
-                "<1.0.1"
+                "<6.11"
             ],
-            "v": "<1.0.1"
-        }
-    ],
-    "indico": [
+            "v": "<6.11"
+        },
         {
-            "advisory": "indico before 2.0.2 uses a insecure transitive dependency (bleach).",
-            "cve": "PVE-2021-35802",
-            "id": "pyup.io-35802",
+            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
+            "cve": "CVE-2019-14233",
+            "id": "pyup.io-43691",
             "specs": [
-                "<2.0.2"
+                "<6.11"
             ],
-            "v": "<2.0.2"
+            "v": "<6.11"
         },
         {
-            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
-            "cve": "CVE-2020-5310",
-            "id": "pyup.io-38163",
+            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
+            "cve": "CVE-2019-14232",
+            "id": "pyup.io-43690",
             "specs": [
-                "<2.2.8"
+                "<6.11"
             ],
-            "v": "<2.2.8"
+            "v": "<6.11"
         },
         {
-            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
-            "cve": "CVE-2020-5313",
-            "id": "pyup.io-43464",
+            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
+            "cve": "CVE-2019-14234",
+            "id": "pyup.io-43692",
             "specs": [
-                "<2.2.8"
+                "<6.11"
             ],
-            "v": "<2.2.8"
+            "v": "<6.11"
         },
         {
-            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
-            "cve": "CVE-2019-19911",
-            "id": "pyup.io-43465",
+            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
+            "cve": "CVE-2019-14235",
+            "id": "pyup.io-43693",
             "specs": [
-                "<2.2.8"
+                "<6.11"
             ],
-            "v": "<2.2.8"
+            "v": "<6.11"
         },
         {
-            "advisory": "Indico 2.2.8 updates its dependency 'bleach' to v3.1.4 to include security fixes.",
-            "cve": "CVE-2020-6816",
-            "id": "pyup.io-43467",
+            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Marked' to v0.7.0 to include a security fix.\r\nhttps://github.com/kiwitcms/Kiwi/commit/e5e90133973d1e46ff50718b180e84bd8217db1e",
+            "cve": "PVE-2021-43694",
+            "id": "pyup.io-43694",
             "specs": [
-                "<2.2.8"
+                "<6.11"
             ],
-            "v": "<2.2.8"
+            "v": "<6.11"
         },
         {
-            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
-            "cve": "CVE-2020-5311",
-            "id": "pyup.io-43462",
+            "advisory": "SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.",
+            "cve": "CVE-2018-19057",
+            "id": "pyup.io-42323",
             "specs": [
-                "<2.2.8"
+                "<6.3"
             ],
-            "v": "<2.2.8"
+            "v": "<6.3"
         },
         {
-            "advisory": "Indico 2.2.8 updates its dependency 'pillow' to v6.2.2 to include security fixes.",
-            "cve": "CVE-2020-5312",
-            "id": "pyup.io-43463",
+            "advisory": "Kiwi TCMS 6.3 resolves a medium severity XSS vulnerability which can be exploited when previewing malicious text in Simple MDE editor. Additionally, it uses 'mozilla/bleach' before rendering Markdown to the user as a second layer of protection against the previously mentioned XSS vulnerability.\r\nhttps://github.com/kiwitcms/Kiwi/commit/27b1ff7ab243d5112f63fa64b703c59a3504996c\r\nhttps://github.com/kiwitcms/Kiwi/commit/0bb3f7a1320a8d6a6ce71d0225049f93483da814",
+            "cve": "CVE-2018-19057",
+            "id": "pyup.io-38542",
             "specs": [
-                "<2.2.8"
+                "<6.3"
             ],
-            "v": "<2.2.8"
+            "v": "<6.3"
         },
         {
-            "advisory": "Indico 2.2.8 updates its dependency 'bleach' to v3.1.4 to include security fixes.",
-            "cve": "CVE-2020-6817",
-            "id": "pyup.io-43466",
+            "advisory": "Kiwitcms 6.4 includes fix for CVE-2019-3498: In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-38541",
             "specs": [
-                "<2.2.8"
+                "<6.4"
             ],
-            "v": "<2.2.8"
+            "v": "<6.4"
         },
         {
-            "advisory": "Indico 2.3.4 fixes some open redirects which could help making harmful URLs look more trustworthy by linking to Indico and having it redirect the user to a malicious site. Also, the :data:`BASE_URL` is now always enforced and requests whose Host header does not match are rejected. This prevents malicious actors from tricking Indico into sending e.g. a password reset link to a user that points to a host controlled by the attacker instead of the actual Indico host.",
-            "cve": "PVE-2021-40431",
-            "id": "pyup.io-40431",
+            "advisory": "Kiwi TCMS 6.4 updates Patternfly to version 3.59.0, which deals with an XSS issue in bootstrap (CVE-2018-14041 - In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy). By default session cookies will expire after 24 hours. This can now be controlled via the ``SESSION_COOKIE_AGE`` setting. See https://github.com/kiwitcms/Kiwi/issues/556.",
+            "cve": "CVE-2018-14041",
+            "id": "pyup.io-39589",
             "specs": [
-                "<2.3.4"
+                "<6.4"
             ],
-            "v": "<2.3.4"
+            "v": "<6.4"
         },
         {
-            "advisory": "Indico 2.3.5 fixes XSS vulnerabilities in the category picker (via category titles), location widget (via room and venue names defined by an Indico administrator) and the \"Indico Weeks View\" timetable theme (via contribution/break titles defined by an event organizer).\r\nhttps://github.com/indico/indico/pull/4897",
-            "cve": "PVE-2021-40430",
-            "id": "pyup.io-40430",
+            "advisory": "Kiwi TCMS 6.5 includes a better override of SimpleMDE markdown rendering to prevent XSS vulnerabilities in SimpleMDE.",
+            "cve": "CVE-2018-19057",
+            "id": "pyup.io-38540",
             "specs": [
-                "<2.3.5"
+                "<6.5"
             ],
-            "v": "<2.3.5"
+            "v": "<6.5"
         },
         {
-            "advisory": "Indico 3.0 improves security for the 'OAuth' provider module.",
-            "cve": "PVE-2021-40429",
-            "id": "pyup.io-40429",
+            "advisory": "Kiwi TCMS 6.5.3 updates Django from 2.1.5 to 2.1.7 to prevent memory exhaustion in `django.utils.numberformat.format()`. See CVE-2019-6975.",
+            "cve": "CVE-2019-6975",
+            "id": "pyup.io-38539",
             "specs": [
-                "<3.0"
+                "<6.5.3"
             ],
-            "v": "<3.0"
+            "v": "<6.5.3"
         },
         {
-            "advisory": "Indico 3.0rc1 re-implements the 'OAuth' provider module based on a more modern library ('authlib'). Support for the somewhat insecure *implicit flow* has been removed in favor of the code-with-PKCE flow. Tokens are now stored more securely as a hash instead of plaintext.",
-            "cve": "PVE-2021-40856",
-            "id": "pyup.io-40856",
+            "advisory": "Kiwi TCMS 6.6 explicitly requires marked v0.6.1 to fix medium severity ReDoS vulnerability.",
+            "cve": "PVE-2021-38538",
+            "id": "pyup.io-38538",
             "specs": [
-                "<3.0rc1"
+                "<6.6"
             ],
-            "v": "<3.0rc1"
+            "v": "<6.6"
         },
         {
-            "advisory": "Indico 2.0.3 no longer shows contribution information (metadata including title, speakers and a partial description) in the contribution list unless the user has access to a contribution.",
-            "cve": "PVE-2021-37568",
-            "id": "pyup.io-37568",
+            "advisory": "Kiwi TCMS 7.0 removes the API method ``BugSystem.filter()``. It was possible to use this method to steal passwords or keys used for Issue Tracker integration. This vulnerability could be exploited by users logged into Kiwi TCMS and is classified as medium severity.",
+            "cve": "PVE-2021-38536",
+            "id": "pyup.io-38536",
             "specs": [
-                ">=2.0.0,<2.0.3"
+                "<7.0"
             ],
-            "v": ">=2.0.0,<2.0.3"
+            "v": "<7.0"
         },
         {
-            "advisory": "Indico 2.1.11 fixes more places where LaTeX input was not correctly sanitized. While the biggest security impact (reading local files) has already been mitigated when fixing the initial vulnerability in the previous release, it is still strongly recommended to update.",
-            "cve": "PVE-2021-37570",
-            "id": "pyup.io-37570",
+            "advisory": "Kiwi TCMS 7.3 includes a fix for CVE-2019-19844: potential account hijack via password reset form.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-38535",
             "specs": [
-                ">=2.1.0,<2.1.11"
+                "<7.3"
             ],
-            "v": ">=2.1.0,<2.1.11"
+            "v": "<7.3"
         },
         {
-            "advisory": "Indico 2.1.3\r\n- Only returns timetable entries for the current session when updating a session through the timetable (issue 3474)\r\n- Prevents session managers/coordinators from modifying certain timetable entries or scheduling contributions not assigned to their session\r\n- Restricts access to timetable entry details to users who are authorized to see them",
-            "cve": "PVE-1970-34153",
-            "id": "pyup.io-34153",
+            "advisory": "Kiwitcms 8.1 includes a fix for CVE-2020-9402: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.",
+            "cve": "CVE-2020-9402",
+            "id": "pyup.io-37503",
             "specs": [
-                ">=2.1.0,<2.1.3"
+                "<8.1"
             ],
-            "v": ">=2.1.0,<2.1.3"
-        },
+            "v": "<8.1"
+        }
+    ],
+    "knowledge-repo": [
         {
-            "advisory": "Indico 2.2.3 and 2.1.10\r\n- Strip ``@``, ``+``, ``-`` and ``=`` from the beginning of strings when exporting CSV files to avoid security issues when opening the CSV file in Excel.\r\n- Use 027 instead of 000 umask when temporarily changing it to get the current umask.\r\n- Fix LaTeX sanitization to prevent malicious users from running unsafe LaTeX commands through specially crafted abstracts or contribution descriptions, which could lead to the disclosure of local file contents.",
-            "cve": "PVE-2021-37567",
-            "id": "pyup.io-37567",
+            "advisory": "Knowledge-repo 0.8.0 removed two security vulnerabilities associated with arbitrary code execution from code stored in knowledge repositories on both clients and servers via knowledge repository configuration and embedded tooling.\r\nhttps://github.com/airbnb/knowledge-repo/pull/382",
+            "cve": "PVE-2021-36510",
+            "id": "pyup.io-36510",
             "specs": [
-                ">=2.2.0,<2.2.3",
-                ">=2.1.0,<2.1.10"
+                "<0.8.0"
             ],
-            "v": ">=2.2.0,<2.2.3,>=2.1.0,<2.1.10"
-        },
+            "v": "<0.8.0"
+        }
+    ],
+    "kombu": [
         {
-            "advisory": "Indico 2.2.4 fixes more places where LaTeX input was not correctly sanitized. While the biggest security impact (reading local files) has already been mitigated when fixing the initial vulnerability in the previous release, it is still strongly recommended to update.",
-            "cve": "PVE-2021-37569",
-            "id": "pyup.io-37569",
+            "advisory": "Kombu 5.2.1 updates Amazon sqs dependency 'urllib3' minimum version to 1.26.7 to include security fixes.\r\nhttps://github.com/celery/kombu/commit/f3b04558fa0df4ecc383c93e0b3b300d95e17c47",
+            "cve": "PVE-2021-42497",
+            "id": "pyup.io-42497",
             "specs": [
-                ">=2.2.0,<2.2.4"
+                "<5.2.1"
             ],
-            "v": ">=2.2.0,<2.2.4"
+            "v": "<5.2.1"
         }
     ],
-    "indy-node": [
+    "kotti": [
         {
-            "advisory": "In Indy Node 1.12.2, there is an Uncontrolled Resource Consumption vulnerability. Indy Node has a bug in TAA handling code. The current primary can be crashed with a malformed transaction from a client, which leads to a view change. Repeated rapid view changes have the potential of bringing down the network. This is fixed in version 1.12.3.",
-            "cve": "CVE-2020-11090",
-            "id": "pyup.io-42272",
+            "advisory": "kotti 1.3.2 fixes a CSRF (Cross Site Request Forgery) security vulnerablity which was reported in 551. You should upgrade your installations ASAP.",
+            "cve": "PVE-2021-36142",
+            "id": "pyup.io-36142",
             "specs": [
-                "==1.12.2"
+                "<1.3.2"
             ],
-            "v": "==1.12.2"
+            "v": "<1.3.2"
         }
     ],
-    "influx-prompt": [
+    "kuber": [
         {
-            "advisory": "Influx-prompt version 0.0.3 updates its dependency 'requests' to include a security fix.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-42221",
+            "advisory": "Kuber 10.0.1 includes a fix for CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-38099",
             "specs": [
-                "<0.0.3"
+                "<10.0.1"
             ],
-            "v": "<0.0.3"
+            "v": "<10.0.1"
         },
         {
-            "advisory": "Influx-prompt version 0.1.0 updates its dependency 'urllib3' to include a security fix.",
+            "advisory": "Kuber 9.0.0a1 includes a fix for CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.",
             "cve": "CVE-2018-20060",
-            "id": "pyup.io-42220",
+            "id": "pyup.io-36979",
             "specs": [
-                "<0.1.0"
+                "<9.0.0a1"
             ],
-            "v": "<0.1.0"
-        },
+            "v": "<9.0.0a1"
+        }
+    ],
+    "kubernetes": [
         {
-            "advisory": "Influx-prompt 1.0.1 includes a security fix to mitigate CVE-2021-27291.",
-            "cve": "CVE-2021-27291",
-            "id": "pyup.io-40135",
+            "advisory": "Kubernetes 12.0.0a1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/kubernetes-client/python/commit/3240b45c46b1115890b011032c3c38e538d55d3c",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41747",
             "specs": [
-                "<1.0.1"
+                "<12.0.0a1"
             ],
-            "v": "<1.0.1"
+            "v": "<12.0.0a1"
         },
         {
-            "advisory": "An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a Standard ML (SML) source file, as demonstrated by input that only contains the \"exception\" keyword.",
-            "cve": "CVE-2021-20270",
-            "id": "pyup.io-40147",
+            "advisory": "Kubernetes 7.0.1, 8.0.1 and 9.0.0a1 include a fix for CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.",
+            "cve": "CVE-2018-20060",
+            "id": "pyup.io-36762",
             "specs": [
-                "<1.0.1"
+                "<7.0.1",
+                ">=8.0,<8.0.1",
+                ">=9.0,<9.0.0a1"
             ],
-            "v": "<1.0.1"
-        }
-    ],
-    "infracheck": [
+            "v": "<7.0.1,>=8.0,<8.0.1,>=9.0,<9.0.0a1"
+        },
         {
-            "advisory": "Infracheck 1.7.rc2 adds a `ssh-fingerprint` check, which verifies if any remote host fingerprint matches. This helps detecting man-in-the-middle and server takeover attacks.",
-            "cve": "PVE-2021-39200",
-            "id": "pyup.io-39200",
+            "advisory": "Kubernetes 10.0.1 includes a fix for CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-38036",
             "specs": [
-                "<1.7.rc2"
+                ">=10.0,<10.0.1"
             ],
-            "v": "<1.7.rc2"
+            "v": ">=10.0,<10.0.1"
         }
     ],
-    "insecure-package": [
+    "kubernetes-asyncio": [
         {
-            "advisory": "This is an insecure package with lots of exploitable security vulnerabilities.",
-            "cve": "PVE-2021-25853",
-            "id": "pyup.io-25853",
+            "advisory": "kubernetes-asyncio 8.0.3 uses `yaml.safe_load`, `yaml.safe_dump` for security reasons.",
+            "cve": "PVE-2021-36777",
+            "id": "pyup.io-36777",
             "specs": [
-                "<0.2.0"
+                "<8.0.3"
             ],
-            "v": "<0.2.0"
+            "v": "<8.0.3"
         }
     ],
-    "inspetor": [
+    "kubetest": [
         {
-            "advisory": "Inspetor 2.3.1 updates `sprockets` in `Gemfile.lock` to fix security warnings.",
-            "cve": "PVE-2021-37343",
-            "id": "pyup.io-37343",
+            "advisory": "Kubetest 0.1.0 updates the pyyaml version for security reasons. See: CVE-2017-18342.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-37070",
             "specs": [
-                "<2.3.1"
+                "<0.1.0"
             ],
-            "v": "<2.3.1"
+            "v": "<0.1.0"
         }
     ],
-    "installtool": [
+    "kvm48": [
         {
-            "advisory": "Installtool version 1.0 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/l0r3zz/public/commit/ab00de531d125629c11811473bfee9e4063572b2#diff-4f5fe0b656de6953412f12024a4e76b35b618409e88f79d86e52c52c020dac58",
+            "advisory": "Kvm48 version 1.3.600 includes a security patch for the function 'load' in 'kvm48/config.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/SNH48Live/KVM48/commit/1cd560899b8bbb10de64ce5a4f6e88fd61f4199d#diff-ebd9623cdd31ae084d3bdeb718bdcf42de239f8b24a1170581c4c6f89dedeaae",
             "cve": "CVE-2020-1747",
-            "id": "pyup.io-41332",
+            "id": "pyup.io-41333",
             "specs": [
-                "<1.0"
+                "<1.3.600"
             ],
-            "v": "<1.0"
+            "v": "<1.3.600"
         }
     ],
-    "instana": [
+    "kytos": [
         {
-            "advisory": "Instana 1.20.2 upgrades the `event-loop-lag` because of security vulnerabilities in its dependency tree.",
-            "cve": "PVE-2021-34809",
-            "id": "pyup.io-34809",
+            "advisory": "Kytos 2019.1b1 updates the 'pyyaml' and 'requests' requirements versions, in order to fix vulnerabilities.",
+            "cve": "PVE-2021-38938",
+            "id": "pyup.io-38938",
             "specs": [
-                "<1.20.2"
+                "<2019.1b1"
             ],
-            "v": "<1.20.2"
-        }
-    ],
-    "instawow": [
+            "v": "<2019.1b1"
+        },
         {
-            "advisory": "Instawow 1.35.0 improves security by refusing requests to the RPC API which do not originate from the Instawow client (same origin).\r\nhttps://github.com/layday/instawow/commit/478d86bd06819a099c679d4b64d739c0a70080a8",
-            "cve": "PVE-2021-43742",
-            "id": "pyup.io-43742",
+            "advisory": "kytos 2019.1b3 change: Changed some dependencies versions in order to fix security bugs",
+            "cve": "PVE-2021-37226",
+            "id": "pyup.io-37226",
             "specs": [
-                "<1.35.0"
+                "<2019.1b3"
             ],
-            "v": "<1.35.0"
+            "v": "<2019.1b3"
         }
     ],
-    "intelmq": [
+    "kytos-utils": [
         {
-            "advisory": "Intelmq through 2.1.1 is not secure. Its backend incorrectly handles messages given by user-input in the \"send\" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the web server.",
-            "cve": "PVE-2021-38326",
-            "id": "pyup.io-38326",
+            "advisory": "Kytos-utils 2019.1b3 updates requirements versions in order to fix some security bugs.",
+            "cve": "PVE-2021-37225",
+            "id": "pyup.io-37225",
             "specs": [
-                "<=2.1.1"
+                "<2019.1b3"
             ],
-            "v": "<=2.1.1"
+            "v": "<2019.1b3"
         }
     ],
-    "intelmq-manager": [
+    "ladon": [
         {
-            "advisory": "Intelmq-manager 2.1.1 includes a fix for CVE-2020-11016: IntelMQ Manager from version 1.1.0 and before version 2.1.1 has a vulnerability where the backend incorrectly handled messages given by user-input in the \"send\" functionality of the Inspect-tool of the Monitor component. An attacker with access to the IntelMQ Manager could possibly use this issue to execute arbitrary code with the privileges of the webserver.",
-            "cve": "CVE-2020-11016",
-            "id": "pyup.io-40849",
+            "advisory": "Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.",
+            "cve": "CVE-2019-1010268",
+            "id": "pyup.io-42258",
             "specs": [
-                ">=1.1.0,<2.1.1"
+                "==0.6.1"
             ],
-            "v": ">=1.1.0,<2.1.1"
+            "v": "==0.6.1"
         }
     ],
-    "interpret-community": [
+    "lagmat": [
         {
-            "advisory": "Interpret-community 0.12.1 upgrades websocket-extensions for security reasons.",
-            "cve": "PVE-2021-38442",
-            "id": "pyup.io-38442",
+            "advisory": "Lagmat 0.3.3 updates its dependency 'numpy' to v1.19.5 to include a security fix.",
+            "cve": "CVE-2019-6446",
+            "id": "pyup.io-43624",
             "specs": [
-                "<0.12.1"
+                "<0.3.3"
             ],
-            "v": "<0.12.1"
+            "v": "<0.3.3"
         }
     ],
-    "invenio": [
-        {
-            "advisory": "Invenio 0.90.0 includes a new possibility of secure HTTPS authentication while keeping the rest of the site non-HTTPS (WebSession).",
-            "cve": "PVE-2021-38733",
-            "id": "pyup.io-38733",
-            "specs": [
-                "<0.90.0"
-            ],
-            "v": "<0.90.0"
-        },
+    "lambda-tools": [
         {
-            "advisory": "Invenio 0.99.0 fixes an alert deletion tool vulnerability (WebAlert), it includes a new password reset mechanism using new secure mail cookies and temporary role membership facilities (WebAccess, WebSession), and it also includes a script that will update your local user table in order to use encrypted passwords for more security.",
-            "cve": "PVE-2021-38734",
-            "id": "pyup.io-38734",
+            "advisory": "lambda-tools before 0.1.2 used an unsafe way to load untrusted lambda definitions via `yaml.load`.",
+            "cve": "PVE-2021-35209",
+            "id": "pyup.io-35209",
             "specs": [
-                "<0.99.0"
+                "<0.1.2"
             ],
-            "v": "<0.99.0"
-        },
+            "v": "<0.1.2"
+        }
+    ],
+    "lambdajson": [
         {
-            "advisory": "Invenio 1.0.2 includes a fix for a XSS vulnerability in the debug information via 'verbose' parameter in the external search facility.\r\nhttps://github.com/inveniosoftware/invenio/commit/c089ce6cee2d3dcf1eef5126628f0707e10a7c8f",
-            "cve": "PVE-2021-25854",
-            "id": "pyup.io-25854",
+            "advisory": "lambdajson 0.1.5 includes a security fix. Using ast.literal_eval as eval.",
+            "cve": "PVE-2021-25874",
+            "id": "pyup.io-25874",
             "specs": [
-                "<1.0.2"
+                "<0.1.5"
             ],
-            "v": "<1.0.2"
-        },
+            "v": "<0.1.5"
+        }
+    ],
+    "lander": [
         {
-            "advisory": "Invenio 1.1.2 fixes a XSS vulnerability due to lack of escaping variables in output.\r\nhttps://github.com/inveniosoftware/invenio/commit/ec02244fa270f02512cb1905d804b66d78572564",
-            "cve": "PVE-2021-25855",
-            "id": "pyup.io-25855",
+            "advisory": "Lander 0.1.15 updates 'requests' to 2.20.0 for security reasons.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-38375",
             "specs": [
-                "<1.1.2"
+                "<0.1.15"
             ],
-            "v": "<1.1.2"
-        },
+            "v": "<0.1.15"
+        }
+    ],
+    "lando": [
         {
-            "advisory": "Invenio 2.0.5 disables debug mode when using standard Docker image. It uses Docker compose to set the variable instead.",
-            "cve": "PVE-2021-38741",
-            "id": "pyup.io-38741",
+            "advisory": "Lando 0.11.3 adds `cluster_api_settings .ssl_ca_cert` config flag to allow secure k8s connections. See <https://github.com/Duke-GCB/lando/pull/209>.",
+            "cve": "PVE-2021-37414",
+            "id": "pyup.io-37414",
             "specs": [
-                "<2.0.5"
+                "<0.11.3"
             ],
-            "v": "<2.0.5"
-        },
+            "v": "<0.11.3"
+        }
+    ],
+    "language-formatters-pre-commit-hooks": [
         {
-            "advisory": "Invenio 2.0.6 fixes potential XSS issues by changing main flash messages template so that they are not displayed as safe HTML by default.\r\nhttps://github.com/inveniosoftware/invenio/commit/ecb6d6e79282fb555483d3133bf3e61dfeaf2e64",
-            "cve": "PVE-2021-38740",
-            "id": "pyup.io-38740",
+            "advisory": "Language-formatters-pre-commit-hooks 1.6.0 enhances its security in commands execution  to prevent shell-injection.\r\nhttps://github.com/macisamuele/language-formatters-pre-commit-hooks/pull/38/files",
+            "cve": "PVE-2021-38926",
+            "id": "pyup.io-38926",
             "specs": [
-                "<2.0.6"
+                "<1.6.0"
             ],
-            "v": "<2.0.6"
+            "v": "<1.6.0"
         }
     ],
-    "invenio-admin": [
+    "lapdog": [
         {
-            "advisory": "invenio-admin 1.1.1 has the minimum version of Flask-Admin bumped to v1.5.3 due to Cross-Site Scripting\r\n  vulnerability in previous versions.",
-            "cve": "PVE-2021-36759",
-            "id": "pyup.io-36759",
+            "advisory": "Lapdog 0.18.7 improves API security by switching to custom Lapdog OAuth tokens. Currently this is only supported by Broad accounts. Non-broad accounts will continue to use standard Google application-default credentials when authenticating through the Lapdog API.",
+            "cve": "PVE-2021-37597",
+            "id": "pyup.io-37597",
             "specs": [
-                "<1.0.1",
-                "==1.1.0"
+                "<0.18.7"
             ],
-            "v": "<1.0.1,==1.1.0"
-        },
+            "v": "<0.18.7"
+        }
+    ],
+    "laporte-mqtt": [
         {
-            "advisory": "invenio-admin 1.1.1 bumps Flask-Admin to v1.5.3 due to Cross-Site Scripting vulnerability in previous versions",
-            "cve": "PVE-2021-38011",
-            "id": "pyup.io-38011",
+            "advisory": "Laporte-mqtt version 0.2.2 includes a security patch for the function 'load_config' in 'laporte_mqtt/config.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/vinklat/laporte-mqtt/commit/db24ded1c1ed0232c42bb826b9c1dc30fb925f2e",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41334",
             "specs": [
-                "<1.1.1"
+                "<0.2.2"
             ],
-            "v": "<1.1.1"
+            "v": "<0.2.2"
         }
     ],
-    "invenio-app": [
+    "launchdarkly-server-sdk": [
         {
-            "advisory": "Invenio-app 1.1.1 fixes a security issue where APP_ALLOWED_HOSTS was not always being checked, and thus could allow host header injection attacks.",
-            "cve": "PVE-2021-37311",
-            "id": "pyup.io-37311",
+            "advisory": "Launchdarkly-server-sdk 6.11.2 uses 'yaml.safe_load()' instead of 'yaml.load()' for YAML/JSON test data parsing to fix an arbitrary code execution vulnerability.\r\nhttps://github.com/launchdarkly/python-server-sdk/issues/136",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-43004",
             "specs": [
-                "<1.1.1"
+                "<6.11.2"
             ],
-            "v": "<1.1.1"
-        }
-    ],
-    "invenio-app-ils": [
+            "v": "<6.11.2"
+        },
         {
-            "advisory": "Invenio-app-ils 1.0.0a28 adds cookies configuration for improved security.",
-            "cve": "PVE-2021-40030",
-            "id": "pyup.io-40030",
+            "advisory": "Setting `verify_ssl` to `False` in the client configuration of launchdarkly-server-sdk before 6.12.2 did not have the expected effect of completely turning off SSL/TLS verification, because it still left _certificate_ verification in effect, so it would allow a totally insecure connection but reject a secure connection whose certificate had an unknown CA. This has been changed so that it will turn off certificate verification as well. This is not a recommended practice and a future version of the SDK will add a way to specify a custom certificate authority instead (to support, for instance, using the Relay Proxy with a self-signed certificate).",
+            "cve": "PVE-2021-38082",
+            "id": "pyup.io-38082",
             "specs": [
-                "<1.0.0a28"
+                "<6.12.2"
             ],
-            "v": "<1.0.0a28"
+            "v": "<6.12.2"
         }
     ],
-    "invenio-communities": [
+    "launchkey": [
         {
-            "advisory": "invenio-communities before 1.0.0a20 allows XSS.",
-            "cve": "CVE-2019-1020005",
-            "id": "pyup.io-42260",
+            "advisory": "Launchkey 3.9.1 updates its dependency 'jinja2' to v2.11.3 to include a security fix.",
+            "cve": "CVE-2020-28493",
+            "id": "pyup.io-40654",
             "specs": [
-                "<1.0.0a20"
+                "<3.9.1"
             ],
-            "v": "<1.0.0a20"
+            "v": "<3.9.1"
         }
     ],
-    "invenio-previewer": [
+    "layeredimage": [
         {
-            "advisory": "invenio-previewer before 1.0.0a12 allows XSS.",
-            "cve": "CVE-2019-1020019",
-            "id": "pyup.io-42261",
+            "advisory": "Layeredimage 2020.6.4 updates pyora, which has security benefits.",
+            "cve": "PVE-2021-38288",
+            "id": "pyup.io-38288",
             "specs": [
-                "<1.0.0a12"
+                "<2020.6.4"
             ],
-            "v": "<1.0.0a12"
-        }
-    ],
-    "invenio-records": [
+            "v": "<2020.6.4"
+        },
         {
-            "advisory": "Invenio-records versions 1.0.2, 1.1.1 and 1.2.2 include a fix for CVE-2019-1020003, a XSS vulnerability.\r\nhttps://github.com/inveniosoftware/invenio-records/security/advisories/GHSA-vxh3-mvv7-265j",
-            "cve": "CVE-2019-1020003",
-            "id": "pyup.io-42259",
+            "advisory": "Layeredimage 2021.2.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-40331",
             "specs": [
-                "<1.0.2",
-                "==1.1.0",
-                ">=1.2.0,<1.2.2"
+                "<2021.2.1"
             ],
-            "v": "<1.0.2,==1.1.0,>=1.2.0,<1.2.2"
-        }
-    ],
-    "invenio-search": [
+            "v": "<2021.2.1"
+        },
         {
-            "advisory": "Invenio-search 0.1.3 fixes a potential XSS issues by changing search flash messages template so that they are not displayed as safe HTML by default.\r\nhttps://github.com/inveniosoftware/invenio-search/commit/deb2fe3213d6f8dcab41714a579dd13dcfba6e87",
-            "cve": "PVE-2021-25856",
-            "id": "pyup.io-25856",
+            "advisory": "Layeredimage 2021.2.1 updates the 'Pillow' dependency >= 8.1.1 due to high severity security vulnerabilities (CVE-2020-35655).",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-40332",
             "specs": [
-                "<0.1.3"
+                "<2021.2.1"
             ],
-            "v": "<0.1.3"
-        }
-    ],
-    "iotedgehubdev": [
+            "v": "<2021.2.1"
+        },
         {
-            "advisory": "Lotedgehubdev 0.14.5 upgrades underlying dependencies to address vulnerability issues.",
-            "cve": "PVE-2021-40098",
-            "id": "pyup.io-40098",
+            "advisory": "Layeredimage 2021.2.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-40327",
             "specs": [
-                "<0.14.5"
+                "<2021.2.1"
             ],
-            "v": "<0.14.5"
-        }
-    ],
-    "ipsilon": [
+            "v": "<2021.2.1"
+        },
         {
-            "advisory": "The Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly escape certain characters in a Python exception-message template, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via an HTTP response. See: CVE-2015-5216.",
-            "cve": "CVE-2015-5216",
-            "id": "pyup.io-37897",
+            "advisory": "Layeredimage 2021.2.1 updates the 'Pillow' dependency >= 8.1.1 due to high severity security vulnerabilities (CVE-2020-35654).",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-40328",
             "specs": [
-                ">=0.1.0,<1.0.1"
+                "<2021.2.1"
             ],
-            "v": ">=0.1.0,<1.0.1"
-        }
-    ],
-    "ipwb": [
+            "v": "<2021.2.1"
+        },
         {
-            "advisory": "ipwb 0.2018.08.29.1434 updates Flask use in ipwb replay due to a security vulnerability.",
-            "cve": "PVE-2021-36492",
-            "id": "pyup.io-36492",
+            "advisory": "Layeredimage 2021.0.1 includes a fix for CVE-2020-35653: In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-40329",
             "specs": [
-                "<0.2018.08.29.1434"
+                "<2021.2.1"
             ],
-            "v": "<0.2018.08.29.1434"
+            "v": "<2021.2.1"
         },
         {
-            "advisory": "Ipwb 0.2019.07.26.1435 updates Flask for replay to the latest version to address a security vulnerability in an older versions.",
-            "cve": "PVE-2021-37304",
-            "id": "pyup.io-37304",
+            "advisory": "Layeredimage 2021.2.1 updates its dependency 'pillow' to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-40330",
             "specs": [
-                "<0.2019.07.26.1435"
+                "<2021.2.1"
             ],
-            "v": "<0.2019.07.26.1435"
+            "v": "<2021.2.1"
         }
     ],
-    "ipython": [
+    "ldap3": [
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.",
-            "cve": "CVE-2015-6938",
-            "id": "pyup.io-33132",
+            "advisory": "ldap3 before 0.9.5.4 has several security issues in lazy connections.",
+            "cve": "PVE-2021-25875",
+            "id": "pyup.io-25875",
             "specs": [
-                "<3.2.2"
+                "<0.9.5.4"
             ],
-            "v": "<3.2.2"
+            "v": "<0.9.5.4"
         },
         {
-            "advisory": "The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.",
-            "cve": "CVE-2015-7337",
-            "id": "pyup.io-33133",
-            "specs": [
-                "<3.2.2"
-            ],
-            "v": "<3.2.2"
-        }
-    ],
-    "irc3": [
-        {
-            "advisory": "irc3 before 0.4.4 is vulnerable to several undisclosed security issues.",
-            "cve": "PVE-2021-25859",
-            "id": "pyup.io-25859",
+            "advisory": "ldap3 2.4 includes a security fix in the rebind() method of the Connection object.",
+            "cve": "PVE-2021-35053",
+            "id": "pyup.io-35053",
             "specs": [
-                "<0.4.4"
+                "<2.4"
             ],
-            "v": "<0.4.4"
+            "v": "<2.4"
         }
     ],
-    "iroin-python-pptx": [
+    "lemur": [
         {
-            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2016-9189",
-            "id": "pyup.io-43505",
+            "advisory": "Lemur 0.9.0 fixes three critical vulnerabilities where an authenticated user could retrieve/access unauthorized information. See also <https://github.com/Netflix/lemur/issues/3463>.",
+            "cve": "PVE-2021-40028",
+            "id": "pyup.io-40028",
             "specs": [
-                "<0.6.12"
+                "<0.9.0"
             ],
-            "v": "<0.6.12"
+            "v": "<0.9.0"
         },
         {
-            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2014-9601",
-            "id": "pyup.io-40563",
+            "advisory": "Lemur 0.1.5 includes a fix for CVE-2015-7764: Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.\r\nhttp://www.openwall.com/lists/oss-security/2015/10/20/3\r\nhttps://github.com/Netflix/lemur/issues/117\r\nhttps://github.com/kvesteri/sqlalchemy-utils/issues/166",
+            "cve": "CVE-2015-7764",
+            "id": "pyup.io-25876",
             "specs": [
-                "<0.6.12"
+                "==0.1.4"
             ],
-            "v": "<0.6.12"
-        },
+            "v": "==0.1.4"
+        }
+    ],
+    "levenshtein": [
         {
-            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2016-3076",
-            "id": "pyup.io-43499",
+            "advisory": "Levenshtein 0.12.1 fixes handling of numerous possible wraparounds in calculating the size of memory allocations; incorrect handling of which could cause denial of service or even possible remote code execution in previous versions of the library.",
+            "cve": "PVE-2022-44654",
+            "id": "pyup.io-44654",
             "specs": [
-                "<0.6.12"
+                "<0.12.1"
             ],
-            "v": "<0.6.12"
-        },
+            "v": "<0.12.1"
+        }
+    ],
+    "lg-rez": [
         {
-            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2016-0740",
-            "id": "pyup.io-43500",
+            "advisory": "Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-28677",
+            "id": "pyup.io-42105",
             "specs": [
-                "<0.6.12"
+                "<2.1.4"
             ],
-            "v": "<0.6.12"
+            "v": "<2.1.4"
         },
         {
-            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2016-0775",
-            "id": "pyup.io-43501",
+            "advisory": "Lg-rez 2.1.4 updates its dependency 'rsa' to v4.7 to include a security fix.",
+            "cve": "CVE-2020-25658",
+            "id": "pyup.io-42106",
             "specs": [
-                "<0.6.12"
+                "<2.1.4"
             ],
-            "v": "<0.6.12"
+            "v": "<2.1.4"
         },
         {
-            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2016-2533",
-            "id": "pyup.io-43502",
+            "advisory": "Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-28678",
+            "id": "pyup.io-42049",
             "specs": [
-                "<0.6.12"
+                "<2.1.4"
             ],
-            "v": "<0.6.12"
+            "v": "<2.1.4"
         },
         {
-            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2016-4009",
-            "id": "pyup.io-43503",
+            "advisory": "Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-28675",
+            "id": "pyup.io-42103",
             "specs": [
-                "<0.6.12"
+                "<2.1.4"
             ],
-            "v": "<0.6.12"
+            "v": "<2.1.4"
         },
         {
-            "advisory": "Iroin-python-pptx 0.6.12 updates its dependency 'pillow' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2016-9190",
-            "id": "pyup.io-43504",
+            "advisory": "Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-28676",
+            "id": "pyup.io-42104",
             "specs": [
-                "<0.6.12"
+                "<2.1.4"
             ],
-            "v": "<0.6.12"
+            "v": "<2.1.4"
         }
     ],
-    "ironic-discoverd": [
+    "libgenesis": [
         {
-            "advisory": "OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.",
-            "cve": "CVE-2015-5306",
-            "id": "pyup.io-25860",
+            "advisory": "Libgenesis 0.1.8 updates its dependency 'lxml' to v4.6.5 to include a security fix.",
+            "cve": "CVE-2021-43818",
+            "id": "pyup.io-43379",
             "specs": [
-                "<2.3.0"
+                "<0.1.8"
             ],
-            "v": "<2.3.0"
-        }
-    ],
-    "ironic-inspector": [
+            "v": "<0.1.8"
+        },
         {
-            "advisory": "OpenStack Ironic Inspector (aka ironic-inspector or ironic-discoverd), when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error.",
-            "cve": "CVE-2015-5306",
-            "id": "pyup.io-25861",
+            "advisory": "Libgenesis 0.1.8 updates its dependency 'lxml' minimum version to v4.6.5 to include security fixes.",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-43385",
             "specs": [
-                "<2.3.0"
+                "<0.1.8"
             ],
-            "v": "<2.3.0"
+            "v": "<0.1.8"
         },
         {
-            "advisory": "A vulnerability was found in openstack-ironic-inspector all versions excluding 5.0.2, 6.0.3, 7.2.4, 8.0.3 and 8.2.1. A SQL-injection vulnerability was found in openstack-ironic-inspector's node_cache.find_node(). This function makes a SQL query using unfiltered data from a server reporting inspection results (by a POST to the /v1/continue endpoint). Because the API is unauthenticated, the flaw could be exploited by an attacker with access to the network on which ironic-inspector is listening. Because of how ironic-inspector uses the query results, it is unlikely that data could be obtained. However, the attacker could pass malicious data and create a denial of service. See: CVE-2019-10141.",
-            "cve": "CVE-2019-10141",
-            "id": "pyup.io-37319",
+            "advisory": "Libgenesis 0.1.8 updates its dependency 'lxml' minimum version to v4.6.5 to include security fixes.",
+            "cve": "CVE-2020-27783",
+            "id": "pyup.io-43386",
             "specs": [
-                "<5.0.2",
-                ">=6.0,<6.0.3",
-                ">=7.0,<7.2.4",
-                ">=8.0,<8.0.3",
-                ">=8.1,<8.2.1"
+                "<0.1.8"
             ],
-            "v": "<5.0.2,>=6.0,<6.0.3,>=7.0,<7.2.4,>=8.0,<8.0.3,>=8.1,<8.2.1"
+            "v": "<0.1.8"
         }
     ],
-    "iso6709": [
+    "libhxl": [
         {
-            "advisory": "iso6709 0.1.4 bumped development versions for security fixes",
-            "cve": "PVE-2021-37250",
-            "id": "pyup.io-37250",
+            "advisory": "For web-security reasons, libhxl 4.21.3 blocks the fetching of datasets from localhost, *.localdomain (or any dotted quad) unless allow_local is True.",
+            "cve": "PVE-2021-39450",
+            "id": "pyup.io-39450",
             "specs": [
-                "<0.1.4"
+                "<4.21.3"
             ],
-            "v": "<0.1.4"
+            "v": "<4.21.3"
         }
     ],
-    "isogeo-export-xl": [
+    "libtaxii": [
         {
-            "advisory": "Isogeo-export-xl 1.3.0 updates bleach to fix a security alert.",
-            "cve": "PVE-2021-38286",
-            "id": "pyup.io-38286",
+            "advisory": "libtaxii before 1.1.105 has multiple XML parsing related vulnerabilities.",
+            "cve": "PVE-2021-25877",
+            "id": "pyup.io-25877",
             "specs": [
-                "<1.3.0"
+                "<1.1.105"
             ],
-            "v": "<1.3.0"
+            "v": "<1.1.105"
         }
     ],
-    "isso": [
+    "libtorrent": [
         {
-            "advisory": "isso 0.6 fixes a cross-site request forgery vulnerability for comment creation, voting, editing and deletion.",
-            "cve": "PVE-2021-25862",
-            "id": "pyup.io-25862",
+            "advisory": "Libtorrent 2.0.3 (the underlying core dependency of the Python bindings) fixes an integer overflow in hash_picker and properly restricts max file sizes in torrents.\r\nhttps://github.com/arvidn/libtorrent/commit/58a489332ca05303e8001c24478f27338309c858",
+            "cve": "PVE-2021-43049",
+            "id": "pyup.io-43049",
             "specs": [
-                "<0.6"
+                "<2.0.3"
             ],
-            "v": "<0.6"
+            "v": "<2.0.3"
         }
     ],
-    "isso-cn": [
-        {
-            "advisory": "Isso-cn 0.6 fixes a cross-site request forgery vulnerability for comment creation, voting, editing and deletion.",
-            "cve": "PVE-2021-37714",
-            "id": "pyup.io-37714",
-            "specs": [
-                "<0.6"
-            ],
-            "v": "<0.6"
-        },
+    "lief": [
         {
-            "advisory": "Isso-cn 0.7 fixes a malicious HTML injection (due to wrong API usage). All unknown/unsafe HTML tags are now removed from the output (`html5lib` 0.99(9) or later) or properly escaped (older `html5lib` versions).",
-            "cve": "PVE-2021-37713",
-            "id": "pyup.io-37713",
+            "advisory": "An issue was discovered in LIEF through 0.11.4. A heap-buffer-overflow exists in the function main located in pe_reader.c. It allows an attacker to cause code Execution.",
+            "cve": "CVE-2021-32297",
+            "id": "pyup.io-42313",
             "specs": [
-                "<0.7"
+                "<0.11.4"
             ],
-            "v": "<0.7"
+            "v": "<0.11.4"
         }
     ],
-    "jake": [
+    "lifx-control-panel": [
         {
-            "advisory": "Jake 0.2.59 includes a fix for CVE-2020-27783: A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.",
-            "cve": "CVE-2020-27783",
-            "id": "pyup.io-39256",
+            "advisory": "Lifx-control-panel 1.5.4 fixes a pretty major security exploit. It adds safe-scopes to all 'eval()' calls.\r\nhttps://github.com/samclane/LIFX-Control-Panel/commit/3f95fd5362b52144b44e47102ab386baa511f143",
+            "cve": "PVE-2021-37424",
+            "id": "pyup.io-37424",
             "specs": [
-                "<0.2.59"
+                "<1.5.4"
             ],
-            "v": "<0.2.59"
+            "v": "<1.5.4"
         },
         {
-            "advisory": "An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-40819",
+            "advisory": "Lifx-control-panel 1.6.3 removes all 'eval()' statements for security.\r\nhttps://github.com/samclane/LIFX-Control-Panel/commit/feccb386549e25414f15b3ef4b85018d0a836125",
+            "cve": "PVE-2021-37423",
+            "id": "pyup.io-37423",
             "specs": [
-                "<0.2.69"
+                "<1.6.3"
             ],
-            "v": "<0.2.69"
+            "v": "<1.6.3"
         },
         {
-            "advisory": "Jake version 0.2.70 updates its dependency \"Pyyaml\" to v5.4.1 to include a security fix.",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-40820",
-            "specs": [
-                "<0.2.70"
-            ],
-            "v": "<0.2.70"
-        }
-    ],
-    "jcrypt": [
-        {
-            "advisory": "The encryption method in Jcrypt 1.1.0 includes security and speed improvements.",
-            "cve": "PVE-2021-38425",
-            "id": "pyup.io-38425",
+            "advisory": "lifx-control-panel 1.7.6:\r\n* Pyinstaller 3.6 fixes several security vulnerabilities \r\n* Updated other key repositories, increasing security and speed",
+            "cve": "PVE-2021-37853",
+            "id": "pyup.io-37853",
             "specs": [
-                "<1.1.0"
+                "<1.7.6"
             ],
-            "v": "<1.1.0"
+            "v": "<1.7.6"
         }
     ],
-    "jeIlyfish": [
+    "limnoria": [
         {
-            "advisory": "JeIlyfish is a malicious Python library caught stealing SSH and GPG keys. Note that the first \"L\" is a capital \"i\". Reference: <https://www.zdnet.com/article/two-malicious-python-libraries-removed-from-pypi/>.",
-            "cve": "PVE-2021-38694",
-            "id": "pyup.io-38694",
+            "advisory": "Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.",
+            "cve": "CVE-2019-19010",
+            "id": "pyup.io-42267",
             "specs": [
-                ">0",
-                "<0"
+                "<2019.11.09"
             ],
-            "v": ">0,<0"
+            "v": "<2019.11.09"
         }
     ],
-    "jetforce": [
+    "lin-cms": [
         {
-            "advisory": "For security, unhandled exceptions in jetforce 0.2.0 display a generic error message instead of the plain exception string.",
-            "cve": "PVE-2021-38130",
-            "id": "pyup.io-38130",
+            "advisory": "Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py' (https://github.com/TaleLin/lin-cms-flask/issues/27). See CVE-2020-18698.",
+            "cve": "CVE-2020-18698",
+            "id": "pyup.io-41182",
             "specs": [
-                "<0.2.0"
+                "<0.2.0b1"
             ],
-            "v": "<0.2.0"
+            "v": "<0.2.0b1"
         },
         {
-            "advisory": "Jetforce 0.2.3 fixes a security vulnerability that allowed maliciously crafted URLs to break out of the root server directory.",
-            "cve": "PVE-2021-38324",
-            "id": "pyup.io-38324",
+            "advisory": "Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets (https://github.com/TaleLin/lin-cms-flask/issues/30). See CVE-2020-18701.",
+            "cve": "CVE-2020-18701",
+            "id": "pyup.io-41184",
             "specs": [
-                "<0.2.3"
+                "<0.2.0b1"
             ],
-            "v": "<0.2.3"
-        }
-    ],
-    "jiant": [
+            "v": "<0.2.0b1"
+        },
         {
-            "advisory": "Jiant 1.2.0 updates the NLTK requirement to version 3.4.5 to avoid a potential security issue.",
-            "cve": "PVE-2021-38864",
-            "id": "pyup.io-38864",
+            "advisory": "Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the 'Username' parameter of the in component 'app/api/cms/user.py' (https://github.com/TaleLin/lin-cms-flask/issues/28). See CVE-2020-18699.",
+            "cve": "CVE-2020-18699",
+            "id": "pyup.io-41183",
             "specs": [
-                "<1.2.0"
+                "<0.2.0b1"
             ],
-            "v": "<1.2.0"
+            "v": "<0.2.0b1"
         }
     ],
-    "jina": [
+    "lin-cms-flask": [
         {
-            "advisory": "Jina version 2.0.0rc9 updates its dependency \"tensorflow\", which had known vulnerabilities.\r\nhttps://github.com/jina-ai/jina/pull/2744",
-            "cve": "PVE-2021-41713",
-            "id": "pyup.io-41713",
+            "advisory": "Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets (https://github.com/TaleLin/lin-cms-flask/issues/30). See CVE-2020-18701.",
+            "cve": "CVE-2020-18701",
+            "id": "pyup.io-41214",
             "specs": [
-                "<2.0.0rc9"
+                "==0.1.1"
             ],
-            "v": "<2.0.0rc9"
+            "v": "==0.1.1"
         },
         {
-            "advisory": "Jina version 2.0.24 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-41712",
+            "advisory": "Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py' (https://github.com/TaleLin/lin-cms-flask/issues/28). See CVE-2020-18699.",
+            "cve": "CVE-2020-18699",
+            "id": "pyup.io-41215",
             "specs": [
-                "<2.0.24"
+                "==0.1.1"
             ],
-            "v": "<2.0.24"
+            "v": "==0.1.1"
         },
         {
-            "advisory": "Jina version 2.0.24 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-43528",
+            "advisory": "Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py' (https://github.com/TaleLin/lin-cms-flask/issues/27). See CVE-2020-18698.",
+            "cve": "CVE-2020-18698",
+            "id": "pyup.io-41216",
             "specs": [
-                "<2.0.24"
+                "==0.1.1"
             ],
-            "v": "<2.0.24"
+            "v": "==0.1.1"
         }
     ],
-    "jinja": [
-        {
-            "advisory": "jinja 2.7.2 fixes a security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems.  See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747 for more information.",
-            "cve": "PVE-2021-25863",
-            "id": "pyup.io-25863",
-            "specs": [
-                "<2.7.2"
-            ],
-            "v": "<2.7.2"
-        },
+    "line-item-manager": [
         {
-            "advisory": "jinja 2.7.3 fixes a security issue: Corrected the security fix for the cache folder.",
-            "cve": "PVE-2021-25864",
-            "id": "pyup.io-25864",
+            "advisory": "Line-item-manager 0.2.2 upgrades the 'jinja2' dependency to 2.11.3 and the 'PyYAML' due to security vulnerabilities.",
+            "cve": "PVE-2021-40555",
+            "id": "pyup.io-40555",
             "specs": [
-                "<2.7.3"
+                "<0.2.2"
             ],
-            "v": "<2.7.3"
+            "v": "<0.2.2"
         }
     ],
-    "jinja2": [
+    "lithops": [
         {
-            "advisory": "This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory. See: CVE-2020-28493.",
-            "cve": "CVE-2020-28493",
-            "id": "pyup.io-39525",
+            "advisory": "Lithops 1.0.1 fixes a flask security issues. See: CVE-2018-1000656.",
+            "cve": "CVE-2018-1000656",
+            "id": "pyup.io-38787",
             "specs": [
-                "<2.11.3"
+                "<1.0.1"
             ],
-            "v": "<2.11.3"
+            "v": "<1.0.1"
         },
         {
-            "advisory": "jinja2 2.7.2 fixes a security issue: Changed the default folder for the filesystem cache to be user specific and read and write protected on UNIX systems.  See http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=734747 for more information.",
-            "cve": "PVE-2021-25865",
-            "id": "pyup.io-25865",
+            "advisory": "Lithops 1.0.19 fixes a CVE-2019-12855 security alert.",
+            "cve": "CVE-2019-12855",
+            "id": "pyup.io-38786",
             "specs": [
-                "<2.7.2"
+                "<1.0.19"
             ],
-            "v": "<2.7.2"
-        },
+            "v": "<1.0.19"
+        }
+    ],
+    "livefyre": [
         {
-            "advisory": "The default configuration for bccache.FileSystemBytecodeCache in Jinja2 before 2.7.2 does not properly create temporary files, which allows local users to gain privileges via a crafted .cache file with a name starting with __jinja2_ in /tmp.",
-            "cve": "CVE-2014-1402",
-            "id": "pyup.io-25866",
+            "advisory": "livefyre before 2.0.3 uses a release of a transitive dependency with known security vulnerabilities  (PyJWT).",
+            "cve": "PVE-2021-34170",
+            "id": "pyup.io-34170",
             "specs": [
-                "<2.7.3"
+                "<2.0.3"
             ],
-            "v": "<2.7.3"
+            "v": "<2.0.3"
         }
     ],
-    "jinjafx": [
+    "localstack": [
         {
-            "advisory": "Jinjafx 1.3.4 fixes an Arbitrary Code Execution vulnerability related to yaml.FullLoader().\r\nhttps://github.com/cmason3/jinjafx/commit/de9218a7d204317695a2573d446ddda887ba153f\r\nhttps://github.com/cmason3/jinjafx/commit/2e60b6e24e4a7affea3beb4aadf1de90d3227cc8",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-42841",
+            "advisory": "Localstack 0.12.14 fixes CORS setup to prevent CSRF.\r\nhttps://github.com/localstack/localstack/commit/809235e3079a1060dae599ce83ed06c84b0e34a5",
+            "cve": "PVE-2021-41059",
+            "id": "pyup.io-41059",
             "specs": [
-                "<1.3.4"
+                "<0.12.14"
             ],
-            "v": "<1.3.4"
+            "v": "<0.12.14"
         },
         {
-            "advisory": "Jinjafx 1.5.0 adds support for DataTemplate revisions to mitigate 0-RTT replay attacks.\r\nhttps://github.com/cmason3/jinjafx/commit/fa906c025429fe3c51a567e8502a9cc8a2a854ea",
-            "cve": "PVE-2021-42840",
-            "id": "pyup.io-42840",
+            "advisory": "Localstack 0.12.15 binds Edge Service to 127.0.0.1 by default instead of to 0.0.0.0.\r\nhttps://github.com/localstack/localstack/pull/4223",
+            "cve": "PVE-2021-42834",
+            "id": "pyup.io-42834",
             "specs": [
-                "<1.5.0"
+                "<0.12.15"
             ],
-            "v": "<1.5.0"
+            "v": "<0.12.15"
         },
         {
-            "advisory": "Jinjafx 1.6.1 drops support for IE11, as it represents a security risk.\r\nhttps://github.com/cmason3/jinjafx/commit/2f6c03711f1d509e6aeff1f3c381ea1e3f144436",
-            "cve": "PVE-2021-42839",
-            "id": "pyup.io-42839",
+            "advisory": "Localstack 0.12.17 replaces Docker CLI commands with Docker Python SDK client to reduce the number of shell calls.\r\nhttps://github.com/localstack/localstack/pull/4442",
+            "cve": "PVE-2021-42833",
+            "id": "pyup.io-42833",
             "specs": [
-                "<1.6.1"
+                "<0.12.17"
             ],
-            "v": "<1.6.1"
+            "v": "<0.12.17"
         },
         {
-            "advisory": "Jinjafx 1.6.1 fixes a race condition in password prompts.\r\nhttps://github.com/cmason3/jinjafx/commit/af5910ff137a6d8e3cce477ed2e17f4f328fe510",
-            "cve": "PVE-2021-42839",
-            "id": "pyup.io-42941",
+            "advisory": "Localstack is vulnerable to Denial of Service via regular expressions (ReDoS). After disclosure, vendor said that these threats \"are not considered a key concern since LocalStack is executed on a local machine\". There's no information about patches for these vulnerabilities.\r\nhttps://blog.sonarsource.com/hack-the-stack-with-localstack",
+            "cve": "PVE-2021-42837",
+            "id": "pyup.io-42837",
             "specs": [
-                "<1.6.1"
+                ">0"
             ],
-            "v": "<1.6.1"
+            "v": ">0"
         },
         {
-            "advisory": "Jinjafx 1.7.0 improves the security of the HAProxy Dockerfile by dropping to a non-root user.",
-            "cve": "PVE-2021-42838",
-            "id": "pyup.io-42838",
-            "specs": [
-                "<1.7.0"
-            ],
-            "v": "<1.7.0"
-        }
-    ],
-    "jnitrace": [
-        {
-            "advisory": "Jnitrace 1.0.6 includes a fix for CVE-2020-7598: Minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.",
-            "cve": "CVE-2020-7598",
-            "id": "pyup.io-38061",
+            "advisory": "Localstack is vulnerable to CVE-2021-32091: A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6. After disclosure, vendor said that these threats \"are not considered a key concern since LocalStack is executed on a local machine\". There's no information about patches for these vulnerabilities.\r\nhttps://blog.sonarsource.com/hack-the-stack-with-localstack",
+            "cve": "CVE-2021-32091",
+            "id": "pyup.io-42836",
             "specs": [
-                "<1.0.6"
+                ">0"
             ],
-            "v": "<1.0.6"
+            "v": ">0"
         },
         {
-            "advisory": "Jnitrace 2.2.1 upgrades eslint-package to patch security vulnerability.",
-            "cve": "PVE-2021-37427",
-            "id": "pyup.io-37427",
+            "advisory": "Localstack is vulnerable to CVE-2021-32090: The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter. After disclosure, vendor said that these threats \"are not considered a key concern since LocalStack is executed on a local machine\". There's no information about patches for these vulnerabilities.\r\nhttps://blog.sonarsource.com/hack-the-stack-with-localstack",
+            "cve": "CVE-2021-32090",
+            "id": "pyup.io-42835",
             "specs": [
-                "<2.2.1"
+                ">0"
             ],
-            "v": "<2.2.1"
-        },
+            "v": ">0"
+        }
+    ],
+    "locopy": [
         {
-            "advisory": "Jnitrace 3.0.5 includes a fix for CVE-2020-7598: Minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a \"constructor\" or \"__proto__\" payload.",
-            "cve": "CVE-2020-7598",
-            "id": "pyup.io-38060",
+            "advisory": "Locopy version 0.3.8 includes a security patch for the function 'read_config_yaml' in 'locopy/utility.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/capitalone/locopy/pull/105",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41335",
             "specs": [
-                ">=3.0.0,<3.0.5"
+                "<0.3.8"
             ],
-            "v": ">=3.0.0,<3.0.5"
+            "v": "<0.3.8"
         }
     ],
-    "jno": [
+    "locustio": [
         {
-            "advisory": "Jno 0.4.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
-            "cve": "CVE-2021-45105",
-            "id": "pyup.io-43590",
+            "advisory": "locustio before 0.7 uses pickle.",
+            "cve": "PVE-2021-25878",
+            "id": "pyup.io-25878",
             "specs": [
-                "<=0.4.0"
+                "<0.7"
             ],
-            "v": "<=0.4.0"
-        },
+            "v": "<0.7"
+        }
+    ],
+    "logilab-common": [
         {
-            "advisory": "Jno 0.4.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43589",
+            "advisory": "The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.",
+            "cve": "CVE-2014-1839",
+            "id": "pyup.io-35525",
             "specs": [
-                "<=0.4.0"
+                "<0.61.0"
             ],
-            "v": "<=0.4.0"
+            "v": "<0.61.0"
         },
         {
-            "advisory": "Jno 0.4.0 and prior uses a version of Arduino IDE that depends on a version of 'log4j' containing severe and critical vulnerabilities.",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43588",
+            "advisory": "The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.",
+            "cve": "CVE-2014-1838",
+            "id": "pyup.io-35524",
             "specs": [
-                "<=0.4.0"
+                "<0.61.0"
             ],
-            "v": "<=0.4.0"
+            "v": "<0.61.0"
         }
     ],
-    "jose": [
+    "lookatme": [
         {
-            "advisory": "jose 0.3.0 fixed critical JWT vulnerability.",
-            "cve": "PVE-2021-25867",
-            "id": "pyup.io-25867",
+            "advisory": "In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in \"terminal\" and \"file_loader\" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme. See CVE-2020-15271.",
+            "cve": "CVE-2020-15271",
+            "id": "pyup.io-38950",
             "specs": [
-                "<0.3.0"
+                "<2.3.0"
             ],
-            "v": "<0.3.0"
+            "v": "<2.3.0"
         }
     ],
-    "js-videojs": [
+    "luckycharms": [
         {
-            "advisory": "js-videojs  4.12.5 updates videojs-swf to v4.5.4 to fix a potential security issue ([view](https://github.com/videojs/video.js/pull/1955)",
-            "cve": "PVE-2021-36130",
-            "id": "pyup.io-36130",
+            "advisory": "Luckycharms 0.5.2 upgrades some dependencies with security vulnerabilities.",
+            "cve": "PVE-2021-37144",
+            "id": "pyup.io-37144",
             "specs": [
-                "<4.12.5"
+                "<0.5.2"
             ],
-            "v": "<4.12.5"
+            "v": "<0.5.2"
         }
     ],
-    "json2xml": [
+    "luigi": [
         {
-            "advisory": "Json2xml version 3.0.0 updates its dependency \"requests\" minimum requirement to v2.20.0 to include a security fix.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-42097",
+            "advisory": "luigi 2.1.1 fixes a security issue where malicious users can run arbitrary code if they have file system (even external mounts!)+network access on the machine running luigid (executed by the user that you run luigid with).",
+            "cve": "PVE-2021-34671",
+            "id": "pyup.io-34671",
             "specs": [
-                "<3.0.0"
+                "<2.1.1"
             ],
-            "v": "<3.0.0"
+            "v": "<2.1.1"
         },
         {
-            "advisory": "Json2xml version 3.8.0 replaces its dependency \"xml.dom\" with the more secure \"defusedxml\".",
-            "cve": "PVE-2021-42096",
-            "id": "pyup.io-42096",
+            "advisory": "Luigi before 2.7.5 allowed an XSS attack using GET parameters, relying on the Jquery 'append' function.\r\nhttps://github.com/spotify/luigi/pull/2391",
+            "cve": "PVE-2021-36315",
+            "id": "pyup.io-36315",
             "specs": [
-                "<3.8.0"
+                "<2.7.5"
             ],
-            "v": "<3.8.0"
+            "v": "<2.7.5"
         }
     ],
-    "jsoneditor": [
+    "lurklite": [
         {
-            "advisory": "Jsoneditor 2.2.2 fixes a security error in the server side file retriever script of the web application.",
-            "cve": "PVE-2021-40863",
-            "id": "pyup.io-40863",
+            "advisory": "Lurklite 0.4.9 includes a change that allows Discord administrators to be specified with user IDs as well as usernamediscriminator, improving security with username changes.",
+            "cve": "PVE-2021-38394",
+            "id": "pyup.io-38394",
             "specs": [
-                "<2.2.2"
+                "<0.4.9"
             ],
-            "v": "<2.2.2"
+            "v": "<0.4.9"
         }
     ],
-    "jsonpickle": [
+    "lxml": [
         {
-            "advisory": "Jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. See CVE-2020-22083.",
-            "cve": "CVE-2020-22083",
-            "id": "pyup.io-39319",
+            "advisory": "Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.",
+            "cve": "CVE-2014-3146",
+            "id": "pyup.io-35549",
             "specs": [
-                "<=1.4.1"
+                "<3.3.5"
             ],
-            "v": "<=1.4.1"
-        }
-    ],
-    "jsonrpc-pyclient": [
+            "v": "<3.3.5"
+        },
         {
-            "advisory": "jsonrpc-pyclient 0.7.0 fixes security issues in unixdomainsocket connectors.",
-            "cve": "PVE-2021-25869",
-            "id": "pyup.io-25869",
+            "advisory": "In lxml before 4.4.0, when writing to file paths that contain the URL escape character '%', the file path could wrongly be mangled by URL unescaping and thus write to a different file or directory.  Code that writes to file paths that are provided by untrusted sources, but that must work with previous versions of lxml, should best either reject paths that contain '%' characters, or otherwise make sure that the path does not contain maliciously injected '%XX' URL hex escapes for paths like '../'.\r\nhttps://github.com/lxml/lxml/commit/0245aba002f069a0b157282707bdf77418d1b5be",
+            "cve": "PVE-2021-39195",
+            "id": "pyup.io-39195",
             "specs": [
-                "<0.7.0"
+                "<4.4.0"
             ],
-            "v": "<0.7.0"
-        }
-    ],
-    "jumpssh": [
+            "v": "<4.4.0"
+        },
         {
-            "advisory": "Jumpssh 1.6.3 removes pytest-runner from setup_requires as this is deprecated for security reasons, see https://github.com/pytest-dev/pytest-runner",
-            "cve": "PVE-2021-38051",
-            "id": "pyup.io-38051",
+            "advisory": "Lxml 4.6.2 includes a fix for CVE-2020-27783: A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.",
+            "cve": "CVE-2020-27783",
+            "id": "pyup.io-39194",
             "specs": [
-                "<1.6.3"
+                "<4.6.2"
             ],
-            "v": "<1.6.3"
-        }
-    ],
-    "junos-eznc": [
+            "v": "<4.6.2"
+        },
         {
-            "advisory": "Junos-eznc 2.2.1 fixes PyYAML as per CVE-2017-18342.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-37081",
+            "advisory": "Lxml version 4.6.3 includes a fix for CVE-2021-28957: An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formation attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML.\r\nhttps://bugs.launchpad.net/lxml/+bug/1888153",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-40072",
             "specs": [
-                "<2.2.1"
+                "<4.6.3"
             ],
-            "v": "<2.2.1"
-        }
-    ],
-    "jupyter-jsmol": [
+            "v": "<4.6.3"
+        },
         {
-            "advisory": "Jupyter-jsmol 2021.9.0 includes \"fixing security suggestions\". No further information is available.",
-            "cve": "PVE-2021-41252",
-            "id": "pyup.io-41252",
+            "advisory": "Lxml 4.6.5 includes a fix for CVE-2021-43818: Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs. Users that employ the HTML cleaner in a security relevant context should upgrade to lxml 4.6.5 to receive a patch. There are no known workarounds available.\r\nhttps://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8",
+            "cve": "CVE-2021-43818",
+            "id": "pyup.io-43366",
             "specs": [
-                "<2021.9.0"
+                "<4.6.5"
             ],
-            "v": "<2021.9.0"
+            "v": "<4.6.5"
         }
     ],
-    "jupyter-matlab-proxy": [
-        {
-            "advisory": "Jupyter-matlab-proxy 0.1.1 includes bug fixes and security patches.",
-            "cve": "PVE-2021-41081",
-            "id": "pyup.io-41081",
-            "specs": [
-                "<0.1.1"
-            ],
-            "v": "<0.1.1"
-        },
+    "mackup": [
         {
-            "advisory": "Jupyter-matlab-proxy 0.2.0 includes internal security patches.",
-            "cve": "PVE-2021-41080",
-            "id": "pyup.io-41080",
+            "advisory": "Mackup 0.8.28 includes a vulnerability fix. No details were given.",
+            "cve": "PVE-2021-38383",
+            "id": "pyup.io-38383",
             "specs": [
-                "<0.2.0"
+                "<0.8.28"
             ],
-            "v": "<0.2.0"
+            "v": "<0.8.28"
         }
     ],
-    "jupyter-nbrequirements": [
+    "maestral": [
         {
-            "advisory": "Jupyter-nbrequirements 0.6.0 bumps bleach from 3.1.0 to 3.1.1 because it provides better security.",
-            "cve": "PVE-2021-38077",
-            "id": "pyup.io-38077",
+            "advisory": "Communication between the sync daemon and frontend (GUI or CLI) in maestral 0.4.1 is faster and more secure than in previous versions. Additionally, it uses Unix domain sockets instead of TCP/IP sockets for communication with daemon. This means that communication is lighter, faster and more secure (other users on the same PC  can no longer connect to your sync daemon).",
+            "cve": "PVE-2021-37523",
+            "id": "pyup.io-37523",
             "specs": [
-                "<0.6.0"
+                "<0.4.1"
             ],
-            "v": "<0.6.0"
+            "v": "<0.4.1"
         }
     ],
-    "jupyter-server": [
+    "maestrowf": [
         {
-            "advisory": "Jupyter-server 0.2.0 adds a \"secure_write\" to function for cookie/token saves. See: <https://github.com/jupyter/jupyter_server/pull/77>.",
-            "cve": "PVE-2021-38212",
-            "id": "pyup.io-38212",
+            "advisory": "Maestrowf 1.1.6 updates PyYAML to v4.2b1 to include a security fix.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-38297",
             "specs": [
-                "<0.2.0"
+                "<1.1.6"
             ],
-            "v": "<0.2.0"
-        },
+            "v": "<1.1.6"
+        }
+    ],
+    "mailman": [
         {
-            "advisory": "Jupyter-server 1.0.6 fixes an open redirect vulnerability. See: CVE-2020-26232.",
-            "cve": "CVE-2020-26232",
-            "id": "pyup.io-39167",
+            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.",
+            "cve": "CVE-2011-0707",
+            "id": "pyup.io-25879",
             "specs": [
-                "<1.0.6"
+                "<2.1.14"
             ],
-            "v": "<1.0.6"
+            "v": "<2.1.14"
         },
         {
-            "advisory": "Jupyter-server 1.1.0 includes a security advisory fix (pull 345).",
-            "cve": "PVE-2021-39272",
-            "id": "pyup.io-39272",
+            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.",
+            "cve": "CVE-2010-3089",
+            "id": "pyup.io-25880",
             "specs": [
-                "<1.1.0"
+                "<2.1.14rc1"
             ],
-            "v": "<1.1.0"
+            "v": "<2.1.14rc1"
         },
         {
-            "advisory": "The Jupyter Server provides the backend (i.e. the core services, APIs, and REST endpoints) for Jupyter web applications like Jupyter notebook, JupyterLab, and Voila. In Jupyter Server before version 1.1.1, an open redirect vulnerability could cause the jupyter server to redirect the browser to a different malicious website. All jupyter servers running without a base_url prefix are technically affected, however, these maliciously crafted links can only be reasonably made for known jupyter server hosts. A link to your jupyter server may *appear* safe, but ultimately redirect to a spoofed server on the public internet. This same vulnerability was patched in upstream notebook v5.7.8. This is fixed in jupyter_server 1.1.1. If upgrade is not available, a workaround can be to run your server on a url prefix: \"jupyter server --ServerApp.base_url=/jupyter/\".",
-            "cve": "CVE-2020-26275",
-            "id": "pyup.io-42289",
+            "advisory": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.",
+            "cve": "CVE-2015-2775",
+            "id": "pyup.io-25881",
             "specs": [
-                "<1.1.1"
+                "<2.1.20"
             ],
-            "v": "<1.1.1"
+            "v": "<2.1.20"
         },
         {
-            "advisory": "Jupyter-server 1.10.2 fixes bytes decoding process from secure cookies.",
-            "cve": "PVE-2021-41065",
-            "id": "pyup.io-41065",
+            "advisory": "Unspecified vulnerability in Mailman before 2.1.28 has unknown impact and attack vectors.",
+            "cve": "CVE-2018-13796",
+            "id": "pyup.io-36319",
             "specs": [
-                "<1.10.2"
+                "<2.1.28"
             ],
-            "v": "<1.10.2"
+            "v": "<2.1.28"
         },
         {
-            "advisory": "Jupyter-server 1.12.0 sets 'xsrf' and 'jupyterhub-session-id' cookies on base url to avoid they are shared between instances.\r\nhttps://github.com/jupyter-server/jupyter_server/pull/612",
-            "cve": "PVE-2021-42779",
-            "id": "pyup.io-42779",
+            "advisory": "Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.",
+            "cve": "CVE-2018-0618",
+            "id": "pyup.io-36348",
             "specs": [
-                "<1.12.0"
+                "<=2.1.26"
             ],
-            "v": "<1.12.0"
-        },
+            "v": "<=2.1.26"
+        }
+    ],
+    "mako": [
         {
-            "advisory": "Jupyter-server version 1.6.2 improves xsrf checks.\r\nhttps://github.com/jupyter-server/jupyter_server/pull/478",
-            "cve": "PVE-2021-41836",
-            "id": "pyup.io-41836",
+            "advisory": "Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.",
+            "cve": "CVE-2010-2480",
+            "id": "pyup.io-25882",
             "specs": [
-                "<1.6.2"
+                "<0.3.4"
             ],
-            "v": "<1.6.2"
+            "v": "<0.3.4"
         }
     ],
-    "jupyterhub": [
+    "manifest-tool": [
         {
-            "advisory": "The maintainers of jupyterhub acknowledge in their changelog notes for version 0.2 that when the environment dictionary is used for authentication as an admin, jupyterhub becomes vulnerable to pre-existing security issues because these environment variables may be passed to the user via the batch submit command.",
-            "cve": "PVE-2021-38973",
-            "id": "pyup.io-38973",
+            "advisory": "Manifest-tool 2.0.0 adds an option to sign candidate image using update private key, allowing to implement secure boot on a device side.",
+            "cve": "PVE-2021-38628",
+            "id": "pyup.io-38628",
             "specs": [
-                "<=0.2"
+                "<2.0.0"
             ],
-            "v": "<=0.2"
+            "v": "<2.0.0"
         }
     ],
-    "jupyterhub-systemdspawner": [
+    "manila": [
         {
-            "advisory": "Jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units, which are accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default.",
-            "cve": "PVE-2021-39244",
-            "id": "pyup.io-39244",
+            "advisory": "OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks. See: CVE-2020-9543.",
+            "cve": "CVE-2020-9543",
+            "id": "pyup.io-38052",
             "specs": [
-                "<0.15"
+                "<7.4.1",
+                ">=8.0.0,<8.1.1",
+                ">=9.0.0,<9.1.1"
             ],
-            "v": "<0.15"
-        },
+            "v": "<7.4.1,>=8.0.0,<8.1.1,>=9.0.0,<9.1.1"
+        }
+    ],
+    "mantissa": [
         {
-            "advisory": "jupyterhub-systemdspawner enables JupyterHub to spawn single-user notebook servers using systemd. In jupyterhub-systemdspawner before version 0.15 user API tokens issued to single-user servers are specified in the environment of systemd units. These tokens are incorrectly accessible to all users. In particular, the-littlest-jupyterhub is affected, which uses systemdspawner by default. This is patched in jupyterhub-systemdspawner v0.15",
-            "cve": "CVE-2020-26261",
-            "id": "pyup.io-42288",
+            "advisory": "mantissa before 0.6.14 in xmantissa.webtheme allows access to arbitrary filesystem contents.",
+            "cve": "PVE-2021-25883",
+            "id": "pyup.io-25883",
             "specs": [
-                "<0.15"
+                "<0.6.14"
             ],
-            "v": "<0.15"
+            "v": "<0.6.14"
         }
     ],
-    "jupyterlab": [
+    "markdown2": [
         {
-            "advisory": "Jupyterlab 3.0.8 updates the 'marked' dependency to address a vulnerability. See also <https://github.com/jupyterlab/jupyterlab/pull/9809>.",
-            "cve": "PVE-2021-40042",
-            "id": "pyup.io-40042",
+            "advisory": "Python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues. See CVE-2009-3724.",
+            "cve": "CVE-2009-3724",
+            "id": "pyup.io-37735",
             "specs": [
-                "<3.0.8"
+                "<1.0.1.14"
             ],
-            "v": "<3.0.8"
+            "v": "<1.0.1.14"
         },
         {
-            "advisory": "Jupyterlab 3.1.0 upgrades the 'marked' dependency to fix a vulnerability.",
-            "cve": "PVE-2021-41038",
-            "id": "pyup.io-41038",
+            "advisory": "markdown2 before 1.0.1.14 has a security hole in the md5-hashing scheme for handling HTML  chunks during processing.",
+            "cve": "PVE-2021-25884",
+            "id": "pyup.io-25884",
             "specs": [
-                "<3.1.0"
+                "<1.0.1.14"
             ],
-            "v": "<3.1.0"
+            "v": "<1.0.1.14"
         },
         {
-            "advisory": "Jupyterlab 3.1.0b2 upgrades the 'marked' underlying dependency from '@jupyterlab/rendermime' with a known security vulnerability.",
-            "cve": "PVE-2021-40969",
-            "id": "pyup.io-40969",
+            "advisory": "An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.",
+            "cve": "CVE-2018-5773",
+            "id": "pyup.io-35760",
             "specs": [
-                "<3.1.0b2"
+                "<2.3.5"
             ],
-            "v": "<3.1.0b2"
+            "v": "<2.3.5"
         },
         {
-            "advisory": "Jupyterlab versions 3.1.4, 3.0.17, 2.3.2, 2.2.10 and 1.2.21 include a fix for CVE-2021-32797: In affected versions, an untrusted notebook can execute code on load. In particular, jupyterlab doesn\u2019t sanitize the action attribute of html \"<form>\". Using this it is possible to trigger the form validation outside of the form itself. This is a remote code execution, but requires user action to open a notebook.\r\nhttps://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-4952-p58q-6crx\r\nhttps://github.com/jupyterlab/jupyterlab/commit/504825938c0abfa2fb8ff8d529308830a5ae42ed",
-            "cve": "CVE-2021-32797",
-            "id": "pyup.io-41707",
+            "advisory": "python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \\w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.",
+            "cve": "CVE-2020-11888",
+            "id": "pyup.io-38198",
             "specs": [
-                ">=3.1.0a0,<3.1.4",
-                ">=3.0.0a0,<3.0.17",
-                ">=2.3.0a0,<2.3.2",
-                ">=2.2.0a0,<2.2.10",
-                "<1.2.21"
+                "<=2.3.8"
             ],
-            "v": ">=3.1.0a0,<3.1.4,>=3.0.0a0,<3.0.17,>=2.3.0a0,<2.3.2,>=2.2.0a0,<2.2.10,<1.2.21"
-        }
-    ],
-    "jupyterlab-git": [
+            "v": "<=2.3.8"
+        },
         {
-            "advisory": "Jupyterlab-git 0.32.0 upgrades underlying packages to address security warnings.",
-            "cve": "PVE-2021-41073",
-            "id": "pyup.io-41073",
+            "advisory": "markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time. See CVE-2021-26813.",
+            "cve": "CVE-2021-26813",
+            "id": "pyup.io-39670",
             "specs": [
-                "<0.32.0"
+                ">=1.0.1.18,<2.4.0"
             ],
-            "v": "<0.32.0"
+            "v": ">=1.0.1.18,<2.4.0"
         }
     ],
-    "jupyterlab-theme-solarized-dark": [
-        {
-            "advisory": "Jupyterlab-theme-solarized-dark 1.0.2 updates its dependency \"lodash\" to a secure version.",
-            "cve": "PVE-2021-41738",
-            "id": "pyup.io-41738",
-            "specs": [
-                "<1.0.2"
-            ],
-            "v": "<1.0.2"
-        },
+    "marshmallow": [
         {
-            "advisory": "Jupyterlab-theme-solarized-dark version 2.0.1 updates its dependency 'lodash' to v4.17.21 to include a security fix.\r\nhttps://github.com/AllanChain/jupyterlab-theme-solarized-dark/pull/9",
-            "cve": "CVE-2020-28500",
-            "id": "pyup.io-41741",
+            "advisory": "marshmallow 2.15.1 fixes behavior when an empty list is passed as the ``only`` argument. (CVE-2018-17175)",
+            "cve": "CVE-2018-17175",
+            "id": "pyup.io-36499",
             "specs": [
-                "<2.0.1"
+                "<2.15.1",
+                "==3.0.0a1",
+                "==3.0.0b1",
+                "==3.0.0b2",
+                "==3.0.0b3",
+                "==3.0.0b4",
+                "==3.0.0b5",
+                "==3.0.0b6",
+                "==3.0.0b7",
+                "==3.0.0b8"
             ],
-            "v": "<2.0.1"
+            "v": "<2.15.1,==3.0.0a1,==3.0.0b1,==3.0.0b2,==3.0.0b3,==3.0.0b4,==3.0.0b5,==3.0.0b6,==3.0.0b7,==3.0.0b8"
         },
         {
-            "advisory": "Jupyterlab-theme-solarized-dark version 2.0.1 updates its dependency 'lodash' to v4.17.21 to include a security fix.\r\nhttps://github.com/AllanChain/jupyterlab-theme-solarized-dark/pull/9",
-            "cve": "CVE-2021-23337",
-            "id": "pyup.io-41742",
+            "advisory": "In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").",
+            "cve": "CVE-2018-17175",
+            "id": "pyup.io-36496",
             "specs": [
-                "<2.0.1"
+                "<2.15.1,>3.0.0,<3.0.0b9"
             ],
-            "v": "<2.0.1"
+            "v": "<2.15.1,>3.0.0,<3.0.0b9"
         }
     ],
-    "jupyterquiz": [
+    "martypy": [
         {
-            "advisory": "Jupyterquiz version 1.7.5 improves security of decoding JSON question data.",
-            "cve": "PVE-2021-41822",
-            "id": "pyup.io-41822",
+            "advisory": "martypy 1.2 requests security issues in `requests` and `urllib3` dependencies",
+            "cve": "PVE-2021-36739",
+            "id": "pyup.io-36739",
             "specs": [
-                "<1.7.5"
+                "<1.2"
             ],
-            "v": "<1.7.5"
+            "v": "<1.2"
         }
     ],
-    "jupytext": [
+    "masonite": [
         {
-            "advisory": "Jupytext 1.10.3 updates 'marked', an indirect dependency of the 'jupyterlab-jupytext' extension, to fix a moderate vulnerability (https://github.com/mwouts/jupytext/issues/750).",
-            "cve": "PVE-2021-40093",
-            "id": "pyup.io-40093",
+            "advisory": "Masonite 2.3.25 improves requests checking to add CSRF headers.\r\nhttps://github.com/MasoniteFramework/masonite/commit/9f8b326a209be2b8cf5b0208dc8c69ebd5dd6a97",
+            "cve": "PVE-2021-43626",
+            "id": "pyup.io-43626",
             "specs": [
-                "<1.10.3"
+                "<2.3.25"
             ],
-            "v": "<1.10.3"
+            "v": "<2.3.25"
         },
         {
-            "advisory": "Jupytext 1.11.3 updates dependencies of the 'JupyterLab' extension to fix a security vulnerability.",
-            "cve": "PVE-2021-40645",
-            "id": "pyup.io-40645",
+            "advisory": "Masonite 3.0.5 improves requests checking to add CSRF headers.\r\nhttps://github.com/MasoniteFramework/masonite/commit/9e48f134539659b9438ae91cd930b38c7ca76847",
+            "cve": "PVE-2021-43625",
+            "id": "pyup.io-43625",
             "specs": [
-                "<1.11.3"
+                "<3.0.5"
             ],
-            "v": "<1.11.3"
-        },
+            "v": "<3.0.5"
+        }
+    ],
+    "masz": [
         {
-            "advisory": "Jupytext 1.11.5 updates dependencies to address several security issues.\r\nhttps://github.com/mwouts/jupytext/issues/842\r\nhttps://github.com/mwouts/jupytext/issues/843",
-            "cve": "PVE-2021-41249",
-            "id": "pyup.io-41249",
+            "advisory": "Masz 1.11.5 fixes dependency vulnerabilities.",
+            "cve": "PVE-2021-41058",
+            "id": "pyup.io-41058",
             "specs": [
                 "<1.11.5"
             ],
             "v": "<1.11.5"
         },
         {
-            "advisory": "Jupytext version 1.13.0 updates its jupyterlab extension's dependencies (especially \"ansi-regex\") to handle security vulnerabilities. See CVE-2021-3807.\r\nhttps://github.com/mwouts/jupytext/issues/857",
-            "cve": "CVE-2021-3807",
-            "id": "pyup.io-41777",
+            "advisory": "Masz 1.8.1 improves filesystem security.",
+            "cve": "PVE-2021-40625",
+            "id": "pyup.io-40625",
             "specs": [
-                "<1.13.0"
+                "<1.8.1"
             ],
-            "v": "<1.13.0"
+            "v": "<1.8.1"
         }
     ],
-    "jw.util": [
+    "matlabreport": [
         {
-            "advisory": "An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python. When loading a configuration with FromString or FromStream with YAML, one can execute arbitrary Python code, resulting in OS command execution, because safe_load is not used. See: CVE-2020-13388.",
-            "cve": "CVE-2020-13388",
-            "id": "pyup.io-38315",
+            "advisory": "Matlabreport version 0.6.0 includes a security patch for the function 'makeReport' in 'matlabreport/makereport.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/ahoetker/matlabreport/commit/31fccc6076457d0212b624a1da79515801ae39c2",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41336",
             "specs": [
-                "<2.3"
+                "<0.6.0"
             ],
-            "v": "<2.3"
+            "v": "<0.6.0"
         }
     ],
-    "jwcrypto": [
+    "matrix-registration": [
         {
-            "advisory": "The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before 0.3.2 lacks the Random Filling protection mechanism, which makes it easier for remote attackers to obtain cleartext data via a Million Message Attack (MMA).",
-            "cve": "CVE-2016-6298",
-            "id": "pyup.io-42243",
+            "advisory": "Matrix-registration 0.7.1 updates the waitress dependency because versions below 1.4.2 contain a vulnerability. See CVE-2019-16789.",
+            "cve": "CVE-2019-16789",
+            "id": "pyup.io-39271",
             "specs": [
-                "<0.3.2"
+                "<0.7.1"
             ],
-            "v": "<0.3.2"
+            "v": "<0.7.1"
         }
     ],
-    "jwql": [
+    "matrix-sydent": [
         {
-            "advisory": "Jwql 0.16.0 updates its dependency 'Django' to v2.1.2 to include a security fix.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-37148",
+            "advisory": "util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring. See: CVE-2019-11340.",
+            "cve": "CVE-2019-11340",
+            "id": "pyup.io-37073",
             "specs": [
-                "<0.16.0"
+                "<1.0.2"
+            ],
+            "v": "<1.0.2"
+        },
+        {
+            "advisory": "Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1, 0523511, f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.",
+            "cve": "CVE-2021-29430",
+            "id": "pyup.io-42308",
+            "specs": [
+                "<2.3.0"
+            ],
+            "v": "<2.3.0"
+        },
+        {
+            "advisory": "Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.",
+            "cve": "CVE-2021-29431",
+            "id": "pyup.io-42309",
+            "specs": [
+                "<2.3.0"
+            ],
+            "v": "<2.3.0"
+        },
+        {
+            "advisory": "Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.",
+            "cve": "CVE-2021-29432",
+            "id": "pyup.io-42310",
+            "specs": [
+                "<2.3.0"
+            ],
+            "v": "<2.3.0"
+        }
+    ],
+    "matrix-synapse": [
+        {
+            "advisory": "Synapse 1.28.0 includes a fix for CVE-2021-21392: In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when using transitional IPv6 addresses. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks.\r\nhttps://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78",
+            "cve": "CVE-2021-21392",
+            "id": "pyup.io-42303",
+            "specs": [
+                "<1.28.0"
             ],
-            "v": "<0.16.0"
-        }
-    ],
-    "kafkacrypto": [
+            "v": "<1.28.0"
+        },
         {
-            "advisory": "Kafkacrypto 0.9.5 includes one low severity security fix identified during the crypto review.",
-            "cve": "PVE-2021-37515",
-            "id": "pyup.io-37515",
+            "advisory": "Matrix-synapse 1.33.2 includes a fix for CVE-2021-29471: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 \"Push rules\" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.",
+            "cve": "CVE-2021-29471",
+            "id": "pyup.io-40438",
             "specs": [
-                "<0.9.5"
+                "<1.33.2"
             ],
-            "v": "<0.9.5"
+            "v": "<1.33.2"
         },
         {
-            "advisory": "Kafkacrypto 0.9.8 includes:\r\n-  Implementation of allowlist and denylists. This removes the need for separate code pathways for root of trusts, enabling them to be treated as entries in allowlist.\r\n- Implementation of automatic processing of messages to adjust allowlists, denylists, and chains. This enables very short chain lifetimes, a security benefit. It also enables a private key to self-sign that it should be revoked.\r\n- Implementation of a pathlength constraint for further tightening of chains. Minimum usable value is typically 1, unless the end of the chain will not sign any further messages.\r\n- Fix kafka wrapper poll implementation to make the timeout optional.",
-            "cve": "PVE-2021-37560",
-            "id": "pyup.io-37560",
+            "advisory": "Matrix-synapse 1.47.1 includes a fix for CVE-2021-41281: Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing '../'s, against the whitelist. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.\r\nhttps://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c",
+            "cve": "CVE-2021-41281",
+            "id": "pyup.io-42808",
             "specs": [
-                "<0.9.8"
+                "<1.47.1"
             ],
-            "v": "<0.9.8"
-        }
-    ],
-    "kako": [
+            "v": "<1.47.1"
+        },
         {
-            "advisory": "Kako 1.1.0 updates a few dependencies to resolve dependabot complaints around security issues in \"pyyaml\", \"requests\" and to resolve exceptions raised by `cerberus` when an incorrect simulation is provided.",
-            "cve": "PVE-2021-38720",
-            "id": "pyup.io-38720",
+            "advisory": "Synapse 1.28.0 includes a fix for CVE-2021-21393. Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields.\r\nhttps://github.com/matrix-org/synapse/security/advisories/GHSA-jrh7-mhhx-6h88",
+            "cve": "CVE-2021-21393",
+            "id": "pyup.io-42304",
             "specs": [
-                "<1.1.0"
+                ">0.24.0,<1.28.0"
             ],
-            "v": "<1.1.0"
-        }
-    ],
-    "kalliope": [
+            "v": ">0.24.0,<1.28.0"
+        },
         {
-            "advisory": "Kalliope 0.5.3 updates 'requests' dependency to v2.20.1 to fix a security vulnerability.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36808",
+            "advisory": "Synapse 1.28.0 includes a fix for CVE-2021-21394: Synapse before version 1.28.0 is missing input validation of some parameters on the endpoints used to confirm third-party identifiers. The bug could be used to cause excessive use of disk space and memory, leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary.\r\nhttps://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362",
+            "cve": "CVE-2021-21394",
+            "id": "pyup.io-42305",
             "specs": [
-                "<0.5.3"
+                ">=0.17.0,<1.28.0"
             ],
-            "v": "<0.5.3"
+            "v": ">=0.17.0,<1.28.0"
         }
     ],
-    "kandinsky": [
+    "matrixctl": [
         {
-            "advisory": "Kandinsky 1.4 fixes window security.\r\nhttps://github.com/ZetaMap/Kandinsky-Numworks/commit/d87106d11b34fd68b7b596a45f6ae891edeaffae",
-            "cve": "PVE-2021-42409",
-            "id": "pyup.io-42409",
+            "advisory": "Matrixctl 0.10.0 starts to use secure, temporary directory for ansible_runner's private data.",
+            "cve": "PVE-2021-40785",
+            "id": "pyup.io-40785",
             "specs": [
-                "<1.4"
+                "<0.10.0"
             ],
-            "v": "<1.4"
+            "v": "<0.10.0"
         }
     ],
-    "karlovic": [
+    "matthisk-httpsig": [
         {
-            "advisory": "Karlovic 0.1.3beta includes a fix for a vulnerable Pillow function.",
-            "cve": "PVE-2021-38963",
-            "id": "pyup.io-38963",
+            "advisory": "matthisk-httpsig before 1.0.0 allowed reading keyfiles from disk as this is a huge security hole if this is used in a server framework like drf-httpsig.",
+            "cve": "PVE-2021-25886",
+            "id": "pyup.io-25886",
             "specs": [
-                "<0.1.3beta"
+                "<1.0.0"
             ],
-            "v": "<0.1.3beta"
+            "v": "<1.0.0"
         }
     ],
-    "katal": [
+    "mautrix-telegram": [
         {
-            "advisory": "katal before 0.0.6 uses eval() internally.",
-            "cve": "PVE-2021-34247",
-            "id": "pyup.io-34247",
+            "advisory": "Mautrix-telegram 0.6.0 fixes a vulnerability in event handling.",
+            "cve": "PVE-2021-37432",
+            "id": "pyup.io-37432",
             "specs": [
-                "<0.0.6"
+                "<0.6.0"
             ],
-            "v": "<0.0.6"
+            "v": "<0.6.0"
         }
     ],
-    "katka-core": [
+    "maxminddb": [
         {
-            "advisory": "Katka-core 0.11.0 decreases the amount of gaping security holes related to broken authentication.\r\nhttps://github.com/kpn/katka-core/commit/adeffeff55c5b58d73bbbe9ccbf5735677f1b650",
-            "cve": "PVE-2021-36914",
-            "id": "pyup.io-36914",
+            "advisory": "maxminddb 1.1.2 includes a number of important security fixes. Among these fixes is improved validation of the database metadata. Unfortunately,  MaxMind GeoIP2 and GeoLite2 databases created earlier than January 28, 2014  had an invalid data type for the `record_size` in the metadata. Previously these databases worked on little endian machines with libmaxminddb but did not work on big endian machines. Due to increased safety checks when reading the file, these databases will no longer work on any platform. If you are using one of these databases, we recommend that you upgrade to the latest GeoLite2 or GeoIP2 database",
+            "cve": "PVE-2021-25887",
+            "id": "pyup.io-25887",
             "specs": [
-                "<0.11.0"
+                "<1.1.2"
             ],
-            "v": "<0.11.0"
+            "v": "<1.1.2"
         }
     ],
-    "katsdptelstate": [
+    "mayan-edms": [
         {
-            "advisory": "Katsdptelstate 0.9 disable pickles by default for security.",
-            "cve": "PVE-2021-38321",
-            "id": "pyup.io-38321",
+            "advisory": "Mayan-edms versions before 3.0.2 are affected by CVE-2018-16406:\r\nThe Cabinets app has XSS via a crafted cabinet label.\r\nhttps://gitlab.com/mayan-edms/mayan-edms/blob/master/HISTORY.rst\r\nhttps://gitlab.com/mayan-edms/mayan-edms/commit/48dfc06e49c7f773749e063f8cc69c95509d1c32\r\nhttps://gitlab.com/mayan-edms/mayan-edms/issues/495",
+            "cve": "CVE-2018-16406",
+            "id": "pyup.io-41710",
             "specs": [
-                "<0.9"
+                "<3.0.2"
             ],
-            "v": "<0.9"
-        }
-    ],
-    "kaze-python": [
+            "v": "<3.0.2"
+        },
         {
-            "advisory": "kaze-python 0.6.5 fixes vulnerability to RPC invoke functionality that can send node into unclosed loop during 'test' invokes.",
-            "cve": "PVE-2021-36494",
-            "id": "pyup.io-36494",
+            "advisory": "Mayan-edms versions before 3.0.2 are affected by CVE-2018-16405:\r\nThe Appearance app sets window.location directly, leading to XSS.\r\nhttps://gitlab.com/mayan-edms/mayan-edms/blob/master/HISTORY.rst\r\nhttps://gitlab.com/mayan-edms/mayan-edms/commit/9ebe80595afe4fdd1e2c74358d6a9421f4ce130e\r\nhttps://gitlab.com/mayan-edms/mayan-edms/issues/494",
+            "cve": "CVE-2018-16405",
+            "id": "pyup.io-41709",
             "specs": [
-                "<0.6.5"
+                "<3.0.2"
             ],
-            "v": "<0.6.5"
+            "v": "<3.0.2"
         },
         {
-            "advisory": "kaze-python 0.7.8 fixes vulnerability to RPC invoke functionality that can send node into unclosed loop during 'test' invokes.",
-            "cve": "PVE-2021-36493",
-            "id": "pyup.io-36493",
+            "advisory": "Mayan-edms versions before 3.0.3 are affected by CVE-2018-16407:\r\nThe Tags app has XSS because tag label values are mishandled.\r\nhttps://gitlab.com/mayan-edms/mayan-edms/blob/master/HISTORY.rst\r\nhttps://gitlab.com/mayan-edms/mayan-edms/commit/076468a9225e4630a463c0bbceb8e5b805fe380c\r\nhttps://gitlab.com/mayan-edms/mayan-edms/issues/496",
+            "cve": "CVE-2018-16407",
+            "id": "pyup.io-41711",
             "specs": [
-                "<0.7.8"
+                "<3.0.3"
             ],
-            "v": "<0.7.8"
+            "v": "<3.0.3"
         }
     ],
-    "kdcproxy": [
+    "md4c": [
         {
-            "advisory": "python-kdcproxy before 0.3.2 allows remote attackers to cause a denial of service via a large POST request.",
-            "cve": "CVE-2015-5159",
-            "id": "pyup.io-36597",
+            "advisory": "Md4c (Python bindings) v1.0.0 includes a fix for 'ISANYOF' macro, which is vulnerable in md4c main package versions before 0.4.6: The mentioned macro could provide unexpected results when encountering zero byte in the input text; in some cases leading to broken internal state of the parser. The bug could result in a denial of service and possibly also in other security implications.\r\nhttps://github.com/mity/md4c/issues/130",
+            "cve": "PVE-2021-42027",
+            "id": "pyup.io-42027",
             "specs": [
-                "<0.3.2"
+                "<1.0.0"
             ],
-            "v": "<0.3.2"
+            "v": "<1.0.0"
         }
     ],
-    "kedro-viz": [
-        {
-            "advisory": "Kedro-viz 2.1.0 fixes an infosec vulnerability in LoDash (16).",
-            "cve": "PVE-2021-37353",
-            "id": "pyup.io-37353",
-            "specs": [
-                "<2.1.0"
-            ],
-            "v": "<2.1.0"
-        },
+    "mdbackup": [
         {
-            "advisory": "Kedro-viz 3.0.0 includes a Snyk fix for one, unspecified vulnerability.",
-            "cve": "PVE-2021-37615",
-            "id": "pyup.io-37615",
+            "advisory": "Mdbackup 0.2.0 comes with some bug fixes that made the utility more secure. It introduces the ``Vault secret backend``, where important data (like passwords) can be stored, and the ``File secret backend`` (a fallback secret backend) where secrets are read from the file system directly.",
+            "cve": "PVE-2021-37725",
+            "id": "pyup.io-37725",
             "specs": [
-                "<3.0.0"
+                "<0.2.0"
             ],
-            "v": "<3.0.0"
-        },
+            "v": "<0.2.0"
+        }
+    ],
+    "mdcatch": [
         {
-            "advisory": "Kedro-viz 3.3.0 adds bandit for security scanning as a pre-commit hook.",
-            "cve": "PVE-2021-38329",
-            "id": "pyup.io-38329",
+            "advisory": "Mdcatch 0.9.1 increases security by removing \"shell=True\".\r\nhttps://github.com/azazellochg/MDCatch/pull/14/commits/c4a6551cdd80d3f3bb9a76bc9e2ee08fcab2e818",
+            "cve": "PVE-2021-38433",
+            "id": "pyup.io-38433",
             "specs": [
-                "<3.3.0"
+                "<0.9.1"
             ],
-            "v": "<3.3.0"
+            "v": "<0.9.1"
         }
     ],
-    "keepkey": [
+    "mega.py": [
         {
-            "advisory": "Keepkey 6.6.0 includes vulnerability fixes. No more information was disclosed.",
-            "cve": "PVE-2021-41885",
-            "id": "pyup.io-41885",
+            "advisory": "Mega.py 3.6.2 includes SMS verification for enhanced security.",
+            "cve": "PVE-2021-37617",
+            "id": "pyup.io-37617",
             "specs": [
-                "<6.6.0"
+                "<3.6.2"
             ],
-            "v": "<6.6.0"
+            "v": "<3.6.2"
         }
     ],
-    "keplergl": [
+    "megalib": [
         {
-            "advisory": "Keplergl 0.3.1 fixes several security vulnerabilities related to packages resolutions.\r\nhttps://github.com/keplergl/kepler.gl/pull/1294/commits/8a5a3fb07a498425b60841033fbd12ff9791f873",
-            "cve": "PVE-2021-39211",
-            "id": "pyup.io-39211",
+            "advisory": "Megalib 0.9.5alpha updates requirements.txt to fix a vulnerability.",
+            "cve": "PVE-2021-37099",
+            "id": "pyup.io-37099",
             "specs": [
-                "<0.3.1"
+                "<0.9.5alpha"
             ],
-            "v": "<0.3.1"
+            "v": "<0.9.5alpha"
         }
     ],
-    "keras": [
+    "mei2volpiano": [
         {
-            "advisory": "Keras 2.6.0rc3 fixes a security issue for loading keras models via yaml, which could allow arbitrary code execution. See CVE-2021-37678.\r\nhttps://github.com/keras-team/keras/commit/32febb6cdebe166fc70ad72f2da37607c13bb11a",
-            "cve": "CVE-2021-37678",
-            "id": "pyup.io-41100",
+            "advisory": "Mei2volpiano version 0.8.0 includes the function secure_volpiano() to validate volpiano inputs.",
+            "cve": "PVE-2021-42005",
+            "id": "pyup.io-42005",
             "specs": [
-                "<2.6.0rc3"
+                "<0.8.0"
             ],
-            "v": "<2.6.0rc3"
+            "v": "<0.8.0"
         }
     ],
-    "kerberos": [
+    "meinheld": [
         {
-            "advisory": "The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.",
-            "cve": "CVE-2015-3206",
-            "id": "pyup.io-42240",
+            "advisory": "Meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. See: CVE-2020-7658.",
+            "cve": "CVE-2020-7658",
+            "id": "pyup.io-38317",
             "specs": [
-                ">0"
+                "<1.0.2"
             ],
-            "v": ">0"
+            "v": "<1.0.2"
         }
     ],
-    "kerko": [
+    "mercurial": [
         {
-            "advisory": "Kerko 0.7.1 fixes unescaped date fields which could allow XSS attacks.\r\nhttps://github.com/whiskyechobravo/kerko/commit/28740a2c14d4c40ec119dc79b34a2d7d404039cf",
-            "cve": "PVE-2021-42709",
-            "id": "pyup.io-42709",
+            "advisory": "In Mercurial before 4.1.3, \"hg serve --stdio\" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.",
+            "cve": "CVE-2017-9462",
+            "id": "pyup.io-35757",
             "specs": [
-                ">=0.7,<0.7.1"
+                "<4.1.3"
             ],
-            "v": ">=0.7,<0.7.1"
+            "v": "<4.1.3"
         }
     ],
-    "keyring": [
+    "metadataproxy": [
         {
-            "advisory": "Python keyring lib before 0.10 created keyring files with world-readable permissions. See: CVE-2012-5577.",
-            "cve": "CVE-2012-5577",
-            "id": "pyup.io-37610",
+            "advisory": "metadataproxy before 1.1.1 has a flaw in the proxy functionality when used in passthrough mode that would expose the host's IAM role credentials when extra paths were added to the end of the security-credentials end-point. metadataproxy will now properly capture any call to iam/security-credentials/<role> and return the scoped credentials, rather than the host's credentials.",
+            "cve": "PVE-2021-25888",
+            "id": "pyup.io-25888",
             "specs": [
-                "<0.10"
+                "<1.1.1"
             ],
-            "v": "<0.10"
-        },
+            "v": "<1.1.1"
+        }
+    ],
+    "metpx-sarracenia": [
         {
-            "advisory": "Python Keyring 0.9.1 does not securely initialize the cipher when encrypting passwords for CryptedFileKeyring files, which makes it easier for local users to obtain passwords via a brute-force attack.",
-            "cve": "CVE-2012-4571",
-            "id": "pyup.io-25870",
+            "advisory": "Metpx-sarracenia 2.20.4b2 removes recursion in the connection recovery, which was vulnerable to stack exhaustion on long failures.",
+            "cve": "PVE-2021-38182",
+            "id": "pyup.io-38182",
             "specs": [
-                "<0.9.1"
+                "<2.20.4b2"
             ],
-            "v": "<0.9.1"
-        },
+            "v": "<2.20.4b2"
+        }
+    ],
+    "metron-tagger": [
         {
-            "advisory": "Python keyring has insecure permissions on new databases allowing world-readable files to be created. See: CVE-2012-5578.",
-            "cve": "CVE-2012-5578",
-            "id": "pyup.io-37743",
+            "advisory": "Metron-tagger 1.0.7 uses a more secure SSL context.",
+            "cve": "PVE-2021-38645",
+            "id": "pyup.io-38645",
             "specs": [
-                "<=0.10"
+                "<1.0.7"
             ],
-            "v": "<=0.10"
+            "v": "<1.0.7"
         }
     ],
-    "keystone": [
+    "mezzanine": [
         {
-            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times. See: CVE-2020-12692.",
-            "cve": "CVE-2020-12692",
-            "id": "pyup.io-38584",
+            "advisory": "Mezzanine 0.10.5 fixes Ajax in admin not using CSRF token for forms.\r\nhttps://github.com/stephenmcd/mezzanine/commit/2cf8c388305c8121668c186b5a98aa0ec6046c3d",
+            "cve": "PVE-2021-42776",
+            "id": "pyup.io-42776",
             "specs": [
-                "<15.0.1",
-                "==16.0.0"
+                "<0.10.5"
             ],
-            "v": "<15.0.1,==16.0.0"
+            "v": "<0.10.5"
         },
         {
-            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. See: CVE-2020-12689.",
-            "cve": "CVE-2020-12689",
-            "id": "pyup.io-38587",
+            "advisory": "Mezzanine 0.5.2 adds more robust CSRF protection and applies it to forms too.\r\nhttps://github.com/stephenmcd/mezzanine/commit/6e8decd877516bd18689a41786dbf0f93ca58d08",
+            "cve": "PVE-2021-42778",
+            "id": "pyup.io-42778",
             "specs": [
-                "<15.0.1",
-                "==16.0.0"
+                "<0.5.2"
             ],
-            "v": "<15.0.1,==16.0.0"
+            "v": "<0.5.2"
         },
         {
-            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access. See: CVE-2020-12690.",
-            "cve": "CVE-2020-12690",
-            "id": "pyup.io-38583",
+            "advisory": "Mezzanine 1.4.8 fixes an issue where ACCOUNTS_VERIFICATION_REQUIRED could be bypassed.\r\nhttps://github.com/stephenmcd/mezzanine/issues/691",
+            "cve": "PVE-2021-42775",
+            "id": "pyup.io-42775",
             "specs": [
-                "<15.0.1",
-                "==16.0.0"
+                "<1.4.8"
             ],
-            "v": "<15.0.1,==16.0.0"
+            "v": "<1.4.8"
         },
         {
-            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. See: CVE-2020-12691.",
-            "cve": "CVE-2020-12691",
-            "id": "pyup.io-38585",
+            "advisory": "mezzanine  4.3.0 fixes a potential security vulnerability in which the password reset url is exposed to untrusted intermediary nodes in the network.\r\nhttps://github.com/stephenmcd/mezzanine/commit/788a9d20fa79b338750090224e0359ef2c8aeb72",
+            "cve": "PVE-2021-36270",
+            "id": "pyup.io-36270",
             "specs": [
-                "<15.0.1",
-                "==16.0.0"
+                "<4.3.0"
             ],
-            "v": "<15.0.1,==16.0.0"
-        },
+            "v": "<4.3.0"
+        }
+    ],
+    "mgp2pdf": [
         {
-            "advisory": "OpenStack Keystone 15.0.0 and 16.0.0 are affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.) See: CVE-2019-19687.",
-            "cve": "CVE-2019-19687",
-            "id": "pyup.io-37770",
+            "advisory": "In mgp2pdf before 0.10 `%filter`` is enabled by default which is a security risk.",
+            "cve": "PVE-2021-25889",
+            "id": "pyup.io-25889",
             "specs": [
-                "==15.0.0",
-                "==16.0.0"
+                "<0.10"
             ],
-            "v": "==15.0.0,==16.0.0"
-        },
+            "v": "<0.10"
+        }
+    ],
+    "mi": [
         {
-            "advisory": "HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. See: CVE-2013-2255.",
-            "cve": "CVE-2013-2255",
-            "id": "pyup.io-38589",
+            "advisory": "Mi 0.2 adds ACL-based security.",
+            "cve": "PVE-2021-37998",
+            "id": "pyup.io-37998",
             "specs": [
-                "==2013"
+                "<0.2"
             ],
-            "v": "==2013"
+            "v": "<0.2"
         },
         {
-            "advisory": "It is possible to remotely trigger a crash in Keystone by sending an extremely long password. When Keystone is validating the password, glibc allocates space on the stack for the entire password. If the password is long enough, stack space can be exhausted, resulting in a crash. This vulnerability is mitigated by a patch to impose a reasonable limit on password length (4 kB). Reportedly, all versions are affected. See also: CVE-2012-1572 and https://security.openstack.org/ossa/OSSA-2012-002.html.",
-            "cve": "CVE-2012-1572",
-            "id": "pyup.io-38586",
+            "advisory": "mi 0.4.2 changes the default paster template generator to use ``Paste#http`` server rather than ``PasteScript#cherrpy`` server.  The cherrypy server has a security risk in it when ``REMOTE_USER`` is trusted by the downstream application.",
+            "cve": "PVE-2021-37993",
+            "id": "pyup.io-37993",
             "specs": [
-                ">0",
-                "<0"
+                "<0.4.2"
             ],
-            "v": ">0,<0"
-        }
-    ],
-    "keystonemiddleware": [
+            "v": "<0.4.2"
+        },
         {
-            "advisory": "Keystonemiddleware versions 0.11.0 and 1.2.0 include a fix for CVE-2014-7144: OpenStack keystonemiddleware (formerly python-keystoneclient) 0.x before 0.11.0 and 1.x before 1.2.0 disables certification verification when the \"insecure\" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate.\r\nhttp://www.openwall.com/lists/oss-security/2014/09/25/51\r\nhttps://bugs.launchpad.net/python-keystoneclient/+bug/1353315\r\nhttp://rhn.redhat.com/errata/RHSA-2014-1783.html\r\nhttp://rhn.redhat.com/errata/RHSA-2014-1784.html\r\nhttp://rhn.redhat.com/errata/RHSA-2015-0020.html\r\nhttp://www.ubuntu.com/usn/USN-2705-1\r\nhttp://www.securityfocus.com/bid/69864\r\nhttp://secunia.com/advisories/62709",
-            "cve": "CVE-2014-7144",
-            "id": "pyup.io-42222",
+            "advisory": "In mi before 1.0a3, the pylons_* paster template used the same string (``your_app_secret_string``) for the ``session.secret`` setting in the  generated ``development.ini``.  This was a security risk if left unchanged  in a project that used one of the templates to produce production applications.  It now uses a randomly generated string.",
+            "cve": "PVE-2021-37982",
+            "id": "pyup.io-37982",
             "specs": [
-                "<0.11.0",
-                ">=1.0.0,<1.2.0"
+                "<1.0a3"
             ],
-            "v": "<0.11.0,>=1.0.0,<1.2.0"
+            "v": "<1.0a3"
         },
         {
-            "advisory": "The identity service in OpenStack Identity (Keystone) before 2015.1.3 (Kilo) and 8.0.x before 8.0.2 (Liberty) and keystonemiddleware (formerly python-keystoneclient) before 1.5.4 (Kilo) and Liberty before 2.3.3 does not properly invalidate authorization tokens when using the PKI or PKIZ token providers, which allows remote authenticated users to bypass intended access restrictions and gain access to cloud resources by manipulating byte fields within a revoked token.",
-            "cve": "CVE-2015-7546",
-            "id": "pyup.io-25871",
+            "advisory": "The AuthTktAuthenticationPolicy before mi 1.3a1 did not use a timing-attack-aware string comparator.  See https://github.com/Pylons/pyramid/pull/320 for more info.",
+            "cve": "PVE-2021-37974",
+            "id": "pyup.io-37974",
             "specs": [
-                "<1.5.4",
-                ">=2.0,<2.3.3"
+                "<1.3a1"
             ],
-            "v": "<1.5.4,>=2.0,<2.3.3"
+            "v": "<1.3a1"
         },
         {
-            "advisory": "The s3_token middleware in OpenStack keystonemiddleware before 1.6.0 and python-keystoneclient before 1.4.0 disables certification verification when the \"insecure\" option is set in a paste configuration (paste.ini) file regardless of the value, which allows remote attackers to conduct man-in-the-middle attacks via a crafted certificate, a different vulnerability than CVE-2014-7144.",
-            "cve": "CVE-2015-1852",
-            "id": "pyup.io-25872",
+            "advisory": "Mi 1.6a1 improves robustness to timing attacks in the ``AuthTktCookieHelper`` and the ``SignedCookieSessionFactory`` classes by using the stdlib's ``hmac.compare_digest`` if it is available (such as Python 2.7.7+ and 3.3+). See: <https://github.com/Pylons/pyramid/pull/1457>. Additionally, it avoids timing attacks against CSRF tokens. See: <https://github.com/Pylons/pyramid/pull/1574>.",
+            "cve": "PVE-2021-38003",
+            "id": "pyup.io-38003",
             "specs": [
-                "<1.6.0"
+                "<1.6a1"
             ],
-            "v": "<1.6.0"
-        }
-    ],
-    "kglab": [
+            "v": "<1.6a1"
+        },
         {
-            "advisory": "Kglab 0.4.1 includes a minimum version requirement for its dependency 'jupyterlab' to include a security fix.",
-            "cve": "CVE-2021-32797",
-            "id": "pyup.io-42895",
+            "advisory": "mi 1.6a2 further fixes the JSONP renderer by prefixing the returned content with  a comment. This should mitigate attacks from Flash (See CVE-2014-4671). See https://github.com/Pylons/pyramid/pull/1649",
+            "cve": "CVE-2014-4671",
+            "id": "pyup.io-38002",
             "specs": [
-                "<0.4.1"
+                "<1.6a2"
             ],
-            "v": "<0.4.1"
+            "v": "<1.6a2"
         }
     ],
-    "khoros": [
-        {
-            "advisory": "Khoros 2.2.0 includes changes to the :doc:`supporting modules <supporting-modules>`. The ``yaml.load()`` function call got replaced with ``yaml.safe_load()`` in :py:func:`khoros.utils.helper.import_yaml_file` as it is a better security practice.",
-            "cve": "PVE-2021-38223",
-            "id": "pyup.io-38223",
-            "specs": [
-                "<2.2.0"
-            ],
-            "v": "<2.2.0"
-        },
+    "mihifepe": [
         {
-            "advisory": "Khoros 3.5.0 added the '.github/workflows/bandit.yml' GitHub Action workflow configuration file to leverage the 'Python security check using Bandit' action to perform security audits with each push event. It also changed the default value for the 'shell' parameter to be 'False' in the :py:func:khoros.utils.core_utils.run_cmd function to improve overall security of the library. See also <https://bandit.readthedocs.io/en/latest/plugins/b602_subprocess_popen_with_shell_equals_true.html>.",
-            "cve": "PVE-2021-40102",
-            "id": "pyup.io-40102",
+            "advisory": "Mihifepe version 0.2.2 includes security patches for several functions. They contained OS injection vulnerabilities: subprocess call with shell=True.\r\nhttps://github.com/Craven-Biostat-Lab/mihifepe/commit/b69847025764efc5c6b134c73e18fcfb11b42e0f",
+            "cve": "PVE-2021-41348",
+            "id": "pyup.io-41348",
             "specs": [
-                "<3.5.0"
+                "<0.2.2"
             ],
-            "v": "<3.5.0"
-        },
+            "v": "<0.2.2"
+        }
+    ],
+    "mikado": [
         {
-            "advisory": "Khoros 4.2.0 replaces the module :py:mod:\"xml.etree.ElementTree\" with :py:mod:\"defusedxml.ElementTree\" to proactively mitigate a known XML vulnerability.\r\nhttps://github.com/jeffshurtliff/khoros/pull/42\r\nhttps://bandit.readthedocs.io/en/latest/blacklists/blacklist_calls.html#b313-b320-xml",
-            "cve": "PVE-2021-41300",
-            "id": "pyup.io-41300",
+            "advisory": "Mikado 2.1.0 removes unsafe calls to 'tempfile.mktemp' and other such files, for increased security according to CodeQL.",
+            "cve": "PVE-2021-40159",
+            "id": "pyup.io-40159",
             "specs": [
-                "<4.2.0"
+                "<2.1.0"
             ],
-            "v": "<4.2.0"
+            "v": "<2.1.0"
         }
     ],
-    "khorosjx": [
+    "mindspore": [
         {
-            "advisory": "khorosjx 2.3.1 upgrades the bleach package to version 3.1.1 to mitigate an XSS security issue",
-            "cve": "PVE-2021-37935",
-            "id": "pyup.io-37935",
+            "advisory": "Mindspore 0.5.0-beta updates its dependency \"Sqlite\" to version 3.32.2, to handle CVE-2020-15358.",
+            "cve": "CVE-2020-15358",
+            "id": "pyup.io-40837",
             "specs": [
-                "<2.3.1"
+                "<0.5.0-beta"
             ],
-            "v": "<2.3.1"
+            "v": "<0.5.0-beta"
         },
         {
-            "advisory": "Khorosjx 2.5.0 updates its dependency 'bleach' to v3.1.2 to include a security fix.",
-            "cve": "CVE-2020-6816",
-            "id": "pyup.io-38236",
+            "advisory": "Mindspore 0.5.0b includes a fix for CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.",
+            "cve": "CVE-2020-11655",
+            "id": "pyup.io-40834",
             "specs": [
-                "<2.5.0"
+                "<0.5.0b"
             ],
-            "v": "<2.5.0"
+            "v": "<0.5.0b"
         },
         {
-            "advisory": "Khorosjx 2.5.1 bumps the included version of bleach to 3.1.4 to include some security fixes.",
-            "cve": "PVE-2021-38235",
-            "id": "pyup.io-38235",
+            "advisory": "Mindspore 0.5.0beta upgrades the 'SQLite' dependency to 3.32.2 to handle CVE-2020-13434.",
+            "cve": "CVE-2020-13434",
+            "id": "pyup.io-40840",
             "specs": [
-                "<2.5.1"
+                "<0.5.0beta"
             ],
-            "v": "<2.5.1"
+            "v": "<0.5.0beta"
         },
         {
-            "advisory": "Khorosjx 3.0.0 updates its dependency \"twine\" to a secure version.",
-            "cve": "PVE-2021-41754",
-            "id": "pyup.io-41754",
-            "specs": [
-                "<3.0.0"
-            ],
-            "v": "<3.0.0"
-        }
-    ],
-    "kili": [
-        {
-            "advisory": "Kili 2.87.0 secured its core API. From 16/09/2021 on, package maintainers prompt all users of the Python SDK on the SaaS application to upgrade kili to its last version. No more details were given.",
-            "cve": "PVE-2021-41724",
-            "id": "pyup.io-41724",
+            "advisory": "Mindspore 0.5.0beta upgrades the 'SQLite' dependency to 3.32.2 to handle CVE-2020-13435.",
+            "cve": "CVE-2020-13435",
+            "id": "pyup.io-40841",
             "specs": [
-                "<2.87.0"
+                "<0.5.0beta"
             ],
-            "v": "<2.87.0"
-        }
-    ],
-    "kinto": [
+            "v": "<0.5.0beta"
+        },
         {
-            "advisory": "kinto 12.0.2\r\n **security**: Fix a pagination bug in the PostgreSQL backend that could leak records between collections",
-            "cve": "PVE-2021-36841",
-            "id": "pyup.io-36841",
+            "advisory": "Mindspore 0.5.0beta upgrades its dependency 'SQLite' to handle CVE-2020-13871.",
+            "cve": "CVE-2020-13871",
+            "id": "pyup.io-40833",
             "specs": [
-                "<12.0.2"
+                "<0.5.0beta"
             ],
-            "v": "<12.0.2"
+            "v": "<0.5.0beta"
         },
         {
-            "advisory": "kinto 13.0.0 **security**: Fix a pagination bug in the PostgreSQL backend that could leak records between collections",
-            "cve": "PVE-2021-36840",
-            "id": "pyup.io-36840",
+            "advisory": "Mindspore 0.5.0beta upgrades its dependency 'SQLite' to handle CVE-2020-9327.",
+            "cve": "CVE-2020-9327",
+            "id": "pyup.io-40835",
             "specs": [
-                "<13.0.0"
+                "<0.5.0beta"
             ],
-            "v": "<13.0.0"
+            "v": "<0.5.0beta"
         },
         {
-            "advisory": "kinto 5.1.0 replaced insecure use of ``random.random()`` and ``random.choice(...)`` with more secure ``random.SystemRandom().random()`` and ``random.SystemRandom().choice(...)``.",
-            "cve": "PVE-2021-25873",
-            "id": "pyup.io-25873",
+            "advisory": "Mindspore 0.5.0beta upgrades its dependency 'SQLite' to handle CVE-2020-13630.",
+            "cve": "CVE-2020-13630",
+            "id": "pyup.io-40836",
             "specs": [
-                "<5.1.0"
+                "<0.5.0beta"
             ],
-            "v": "<5.1.0"
+            "v": "<0.5.0beta"
         },
         {
-            "advisory": "Kinto 5.3.5 prevents injections in the PostgreSQL permission backend.",
-            "cve": "PVE-2021-38954",
-            "id": "pyup.io-38954",
+            "advisory": "Mindspore 0.5.0beta upgrades the 'SQLite' dependency to 3.32.2 to handle CVE-2020-13631.",
+            "cve": "CVE-2020-13631",
+            "id": "pyup.io-40838",
             "specs": [
-                "<5.3.5"
+                "<0.5.0beta"
             ],
-            "v": "<5.3.5"
-        }
-    ],
-    "kinto-dist": [
+            "v": "<0.5.0beta"
+        },
         {
-            "advisory": "Signer parameters in kinto-dist before 15.0.2 were displayed in capabilities. This was a security concern.",
-            "cve": "PVE-2021-37169",
-            "id": "pyup.io-37169",
+            "advisory": "Mindspore 0.5.0beta upgrades its depedency 'SQLite' to 3.32.2 to handle CVE-2020-13632.",
+            "cve": "CVE-2020-13632",
+            "id": "pyup.io-40839",
             "specs": [
-                "<15.0.2"
+                "<0.5.0beta"
             ],
-            "v": "<15.0.2"
+            "v": "<0.5.0beta"
         },
         {
-            "advisory": "Kinto-dist 17.0.0 fixes a pagination bug in the PostgreSQL backend that could leak records between collections.",
-            "cve": "PVE-2021-36153",
-            "id": "pyup.io-36153",
+            "advisory": "Mindspore 0.6.0b, 0.7.0b and 1.0.0 updates the underlying 'libjpeg-turbo' dependency to 2.0.4 to handle CVE-2020-13790.",
+            "cve": "CVE-2020-13790",
+            "id": "pyup.io-41016",
             "specs": [
-                "<17.0.0"
+                "<0.6.0b",
+                "<0.7.0b",
+                "<1.0.0"
             ],
-            "v": "<17.0.0"
+            "v": "<0.6.0b,<0.7.0b,<1.0.0"
         },
         {
-            "advisory": "Kinto-dist between 6.0.0 and 6.0.2 included Kinto 8.2.0 where the `account` plugin had a security flaw where the password wasn't verified during the session duration.",
-            "cve": "PVE-2021-36291",
-            "id": "pyup.io-36291",
+            "advisory": "Mindspore 1.0.0, 0.7.0b, 0.6.0b, and 0.5.0b includes a fix for CVE-2020-11656: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.",
+            "cve": "CVE-2020-11656",
+            "id": "pyup.io-41006",
             "specs": [
-                ">=6.0.0,<=6.0.2"
+                "<0.6.0b",
+                "<0.7.0b",
+                "<1.0.0",
+                "<0.5.0b"
             ],
-            "v": ">=6.0.0,<=6.0.2"
+            "v": "<0.6.0b,<0.7.0b,<1.0.0,<0.5.0b"
         }
     ],
-    "kiosk-client": [
+    "mini-amf": [
         {
-            "advisory": "Kiosk-client 0.2.1 updates Twisted to the latest version due to CVE-2019-12855. In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections.",
-            "cve": "CVE-2019-12855",
-            "id": "pyup.io-38382",
+            "advisory": "mini-amf before 0.8 is vulnerable to XML entity attacks.",
+            "cve": "PVE-2021-33048",
+            "id": "pyup.io-33048",
             "specs": [
-                "<0.2.1"
+                "<0.8"
             ],
-            "v": "<0.2.1"
-        },
+            "v": "<0.8"
+        }
+    ],
+    "miniwdl": [
         {
-            "advisory": "Kiosk-client 0.2.2 update Pillow to >=6.2.0 to address CVE-2019-16865.\r\n\r\nAn issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.",
-            "cve": "CVE-2019-16865",
-            "id": "pyup.io-38601",
+            "advisory": "Miniwdl 0.6.0 manipulates ownership/permissions to improve security and user experience:\r\n* as run completes, chown everything in run directory to invoking user and primary group\r\n* run task commands with membership in invoking user's primary group, ensuring access to working directory even if they've dropped privileges (a good docker security practice)\r\n* `--as-me` to force all task commands to run as invoking user (more secure, but blocks commands that assume root e.g. apt-get)\r\n* Revert to always running command in bash (as required by WDL spec) rather than container $SHELL",
+            "cve": "PVE-2021-37814",
+            "id": "pyup.io-37814",
             "specs": [
-                "<0.2.2"
+                "<0.6.0"
             ],
-            "v": "<0.2.2"
+            "v": "<0.6.0"
         }
     ],
-    "kiwitcms": [
+    "mirahezebot-plugins": [
         {
-            "advisory": "Kiwitcms 3.36.0 no longer include Regular Expression Denial of Service (ReDoS) vulnerabilities in the included `moment` Javascript library.",
-            "cve": "PVE-2021-39074",
-            "id": "pyup.io-39074",
+            "advisory": "Mirahezebot-plugins 9.0.2 includes a fix for CVE-2020-15251: In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2.\r\nhttps://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5",
+            "cve": "CVE-2020-15251",
+            "id": "pyup.io-42193",
             "specs": [
-                "<3.36.0"
+                ">=9.0.0,<9.0.2"
             ],
-            "v": "<3.36.0"
-        },
+            "v": ">=9.0.0,<9.0.2"
+        }
+    ],
+    "misago": [
         {
-            "advisory": "Kiwitcms 3.8.102 fixes bug 1133912: Script injection in notes field.",
-            "cve": "PVE-2021-39075",
-            "id": "pyup.io-39075",
+            "advisory": "Misago 0.19.4 updates requests to 2.20.0 resolving a potential vulnerability in HTTP connections handling.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36607",
             "specs": [
-                "<3.8.102"
+                "<0.19.4"
             ],
-            "v": "<3.8.102"
-        },
+            "v": "<0.19.4"
+        }
+    ],
+    "mishmash": [
         {
-            "advisory": "Kiwi TCMS 4.2 starts using the more cryptographically secure module 'secrets' for activation keys.\r\nhttps://github.com/kiwitcms/Kiwi/commit/e45dde2f42336df74a284678a4d59bea699d5994",
-            "cve": "PVE-2021-42529",
-            "id": "pyup.io-42529",
+            "advisory": "mishmash 0.3b12 - Pyaml >= 4.2b1 for security alert.",
+            "cve": "PVE-2021-36795",
+            "id": "pyup.io-36795",
             "specs": [
-                "<4.2"
+                "<0.3b12"
             ],
-            "v": "<4.2"
-        },
+            "v": "<0.3b12"
+        }
+    ],
+    "misp-maltego": [
         {
-            "advisory": "Kiwi TCMS 4.2 uses SHA256 instead of insecure MD5 and SHA1.\r\nhttps://github.com/kiwitcms/Kiwi/commit/e17c071623e055c24a0fdf203991819d446c8f09",
-            "cve": "PVE-2021-42528",
-            "id": "pyup.io-42528",
+            "advisory": "Misp-maltego 1.4.5 resolves an information disclosure vulnerability when using MISP-maltego as remote transform server. The transform server would cache the MISP credentials of the first user connected, and provide access to that MISP instance for any later user.  See: CVE-2020-12889.",
+            "cve": "CVE-2020-12889",
+            "id": "pyup.io-38487",
             "specs": [
-                "<4.2"
+                "<1.4.5"
             ],
-            "v": "<4.2"
-        },
+            "v": "<1.4.5"
+        }
+    ],
+    "mistral": [
         {
-            "advisory": "Kiwi TCMS 4.2 removes an unnecessary AJAX view that had a remote code execution vulnerability.\r\nhttps://github.com/kiwitcms/Kiwi/commit/bb986000ed3cb222832e1e4535dd6316d32503f8",
-            "cve": "PVE-2021-38543",
-            "id": "pyup.io-38543",
+            "advisory": "An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information. See: CVE-2019-3866 and https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3866.",
+            "cve": "CVE-2019-3866",
+            "id": "pyup.io-37774",
             "specs": [
-                "<4.2"
+                "<7.1.0",
+                ">=8.0,<8.1.0",
+                ">=9.0,<9.0.1"
             ],
-            "v": "<4.2"
+            "v": "<7.1.0,>=8.0,<8.1.0,>=9.0,<9.0.1"
         },
         {
-            "advisory": "Kiwi TCMS 4.2 updates its dependency 'patternfly' to version 3.36.0 to include security fixes.",
-            "cve": "PVE-2021-42530",
-            "id": "pyup.io-42530",
+            "advisory": "A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service. See: CVE-2018-16848.",
+            "cve": "CVE-2018-16848",
+            "id": "pyup.io-38424",
             "specs": [
-                "<4.2"
+                "<=7.0.3"
             ],
-            "v": "<4.2"
-        },
+            "v": "<=7.0.3"
+        }
+    ],
+    "mistune": [
         {
-            "advisory": "Kiwitcms 6.0 updates its dependency Django to v2.1.2 to include a security fix.",
-            "cve": "CVE-2018-16984",
-            "id": "pyup.io-36649",
+            "advisory": "Mistune before 0.7.2 is vulnerable to an XSS attack. It is possible to bypass the renderer's link security check.\r\nhttps://github.com/lepture/mistune/issues/87",
+            "cve": "PVE-2021-25890",
+            "id": "pyup.io-25890",
             "specs": [
-                "<6.0"
+                "<0.7.2"
             ],
-            "v": "<6.0"
+            "v": "<0.7.2"
         },
         {
-            "advisory": "Kiwitcms 6.10 updates Django from 2.2.1 to 2.2.2 (see CVE-2019-12308).",
-            "cve": "CVE-2019-12308",
-            "id": "pyup.io-38537",
+            "advisory": "mistune before 0.8.1 has a cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py which allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the \"key\" argument.",
+            "cve": "CVE-2017-16876",
+            "id": "pyup.io-36332",
             "specs": [
-                "<6.10"
+                "<0.8.1"
             ],
-            "v": "<6.10"
+            "v": "<0.8.1"
         },
         {
-            "advisory": "Kiwitcms 6.10 updates its dependency 'Django' to include security fixes.",
-            "cve": "CVE-2019-11358",
-            "id": "pyup.io-39590",
+            "advisory": "Mistune.py in mistune 0.7.4 allows XSS via an unexpected newline (such as in java\\nscript:) or a crafted email address, related to the escape and autolink functions. See CVE-2017-15612.\r\nhttps://github.com/lepture/mistune/pull/140",
+            "cve": "CVE-2017-15612",
+            "id": "pyup.io-35030",
             "specs": [
-                "<6.10"
+                "==0.7.4"
             ],
-            "v": "<6.10"
-        },
+            "v": "==0.7.4"
+        }
+    ],
+    "mitiq": [
         {
-            "advisory": "Kiwitcms v6.10 adds missing permission checks for menus in Test run page UI template.\r\nhttps://github.com/kiwitcms/Kiwi/issues/716",
-            "cve": "PVE-2021-42119",
-            "id": "pyup.io-42119",
+            "advisory": "Mitiq 0.4.0 updates notebook version in requirements to resolve a vulnerability. See CVE-2020-26215.\r\nhttps://github.com/unitaryfund/mitiq/pull/445",
+            "cve": "CVE-2020-26215",
+            "id": "pyup.io-39241",
             "specs": [
-                "<6.10"
+                "<0.4.0"
             ],
-            "v": "<6.10"
-        },
+            "v": "<0.4.0"
+        }
+    ],
+    "mitmproxy": [
         {
-            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
-            "cve": "CVE-2019-12781",
-            "id": "pyup.io-38544",
+            "advisory": "Mitmproxy before 0.17 has a XSS vulnerability in HTTP errors.\r\nhttps://github.com/mitmproxy/mitmproxy/pull/1066",
+            "cve": "PVE-2021-25891",
+            "id": "pyup.io-25891",
             "specs": [
-                "<6.11"
+                "<0.17"
             ],
-            "v": "<6.11"
+            "v": "<0.17"
         },
         {
-            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
-            "cve": "CVE-2019-14232",
-            "id": "pyup.io-43690",
+            "advisory": "Mitmproxy version 4.0.0 includes a fix to correctly block connections from remote clients with IPv4-mapped IPv6 client addresses.\r\nhttps://github.com/mitmproxy/mitmproxy/issues/3024",
+            "cve": "PVE-2021-41864",
+            "id": "pyup.io-41864",
             "specs": [
-                "<6.11"
+                "<4.0.0"
             ],
-            "v": "<6.11"
+            "v": "<4.0.0"
         },
         {
-            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
-            "cve": "CVE-2019-14233",
-            "id": "pyup.io-43691",
+            "advisory": "mitmproxy before 4.0.3 does not protect mitmweb against DNS rebinding.",
+            "cve": "CVE-2018-14505",
+            "id": "pyup.io-36353",
             "specs": [
-                "<6.11"
+                "<4.0.3"
             ],
-            "v": "<6.11"
+            "v": "<4.0.3"
         },
         {
-            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
-            "cve": "CVE-2019-14235",
-            "id": "pyup.io-43693",
+            "advisory": "mitmproxy before 4.0.4 does not protect mitmweb against DNS rebinding.",
+            "cve": "CVE-2018-14505",
+            "id": "pyup.io-36352",
             "specs": [
-                "<6.11"
+                "<4.0.4"
             ],
-            "v": "<6.11"
+            "v": "<4.0.4"
         },
         {
-            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Marked' to v0.7.0 to include a security fix.\r\nhttps://github.com/kiwitcms/Kiwi/commit/e5e90133973d1e46ff50718b180e84bd8217db1e",
-            "cve": "PVE-2021-43694",
-            "id": "pyup.io-43694",
+            "advisory": "Mitmproxy 5.0 fixes command injection vulnerabilities when exporting flows as curl/httpie commands. It also does not echo unsanitized user input in HTTP error responses.",
+            "cve": "PVE-2021-38179",
+            "id": "pyup.io-38179",
             "specs": [
-                "<6.11"
+                "<5.0"
             ],
-            "v": "<6.11"
+            "v": "<5.0"
         },
         {
-            "advisory": "Kiwi TCMS 6.11 updates its dependency 'Django' to v2.2.4 to include security fixes.",
-            "cve": "CVE-2019-14234",
-            "id": "pyup.io-43692",
+            "advisory": "Mitmproxy 5.0.0 includes fixes for:\r\n- Command injection vulnerabilities when exporting flows as curl/httpie commands\r\n- Do not echo unsanitized user input in HTTP error responses",
+            "cve": "PVE-2021-41862",
+            "id": "pyup.io-41862",
             "specs": [
-                "<6.11"
+                "<5.0.0"
             ],
-            "v": "<6.11"
+            "v": "<5.0.0"
         },
         {
-            "advisory": "SimpleMDE 1.11.2 has XSS via an onerror attribute of a crafted IMG element, or via certain input with [ and ( characters, which is mishandled during construction of an A element.",
-            "cve": "CVE-2018-19057",
-            "id": "pyup.io-42323",
+            "advisory": "Mitmproxy version 7.0.3 includes a fix for CVE-2021-39214: In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless one uses mitmproxy to protect an HTTP/1 service, no action is required.",
+            "cve": "CVE-2021-39214",
+            "id": "pyup.io-41855",
             "specs": [
-                "<6.3"
+                "<7.0.3"
             ],
-            "v": "<6.3"
-        },
+            "v": "<7.0.3"
+        }
+    ],
+    "mitogen": [
         {
-            "advisory": "Kiwi TCMS 6.3 resolves a medium severity XSS vulnerability which can be exploited when previewing malicious text in Simple MDE editor. Additionally, it uses 'mozilla/bleach' before rendering Markdown to the user as a second layer of protection against the previously mentioned XSS vulnerability.\r\nhttps://github.com/kiwitcms/Kiwi/commit/27b1ff7ab243d5112f63fa64b703c59a3504996c\r\nhttps://github.com/kiwitcms/Kiwi/commit/0bb3f7a1320a8d6a6ce71d0225049f93483da814",
-            "cve": "CVE-2018-19057",
-            "id": "pyup.io-38542",
+            "advisory": "Before mitogen version 0.2.8, unidirectional routing, where contexts may optionally only communicate with parents and never siblings (so that air-gapped networks cannot be unintentionally bridged) was not inherited when a child was initiated directly from another child. This did not effect Ansible, since the controller initiates any new child used for routing, only forked tasks are initiated by children [gh:commit:`5924af15`].",
+            "cve": "PVE-2021-37381",
+            "id": "pyup.io-37381",
             "specs": [
-                "<6.3"
+                "<0.2.8"
             ],
-            "v": "<6.3"
-        },
+            "v": "<0.2.8"
+        }
+    ],
+    "mixminion": [
         {
-            "advisory": "Kiwitcms 6.4 includes fix for CVE-2019-3498: In Django 1.11.x before 1.11.18, 2.0.x before 2.0.10, and 2.1.x before 2.1.5, an Improper Neutralization of Special Elements in Output Used by a Downstream Component issue exists in django.views.defaults.page_not_found(), leading to content spoofing (in a 404 error page) if a user fails to recognize that a crafted URL has malicious content.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-38541",
+            "advisory": "mixminion before 0.0.2 is vulnerable to certain trivial DoS attacks. In particular, it's possible to send zlib bombs or flood a server with open connections.",
+            "cve": "PVE-2021-25892",
+            "id": "pyup.io-25892",
             "specs": [
-                "<6.4"
+                "<0.0.2"
             ],
-            "v": "<6.4"
-        },
+            "v": "<0.0.2"
+        }
+    ],
+    "mkdocs-material": [
         {
-            "advisory": "Kiwi TCMS 6.4 updates Patternfly to version 3.59.0, which deals with an XSS issue in bootstrap (CVE-2018-14041 - In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy). By default session cookies will expire after 24 hours. This can now be controlled via the ``SESSION_COOKIE_AGE`` setting. See https://github.com/kiwitcms/Kiwi/issues/556.",
-            "cve": "CVE-2018-14041",
-            "id": "pyup.io-39589",
+            "advisory": "mkdocs-material before 1.0.0 uses _blank targets on links which make it vulnerable to Cross Site Scripting attacks.",
+            "cve": "PVE-2021-32121",
+            "id": "pyup.io-32121",
             "specs": [
-                "<6.4"
+                "<1.0.0"
             ],
-            "v": "<6.4"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Kiwi TCMS 6.5 includes a better override of SimpleMDE markdown rendering to prevent XSS vulnerabilities in SimpleMDE.",
-            "cve": "CVE-2018-19057",
-            "id": "pyup.io-38540",
+            "advisory": "Mkdocs-material 7.0.6 improves the security of the Docker image.",
+            "cve": "PVE-2021-39706",
+            "id": "pyup.io-39706",
             "specs": [
-                "<6.5"
+                "<7.0.6"
             ],
-            "v": "<6.5"
-        },
+            "v": "<7.0.6"
+        }
+    ],
+    "ml-versioning-tools": [
         {
-            "advisory": "Kiwi TCMS 6.5.3 updates Django from 2.1.5 to 2.1.7 to prevent memory exhaustion in `django.utils.numberformat.format()`. See CVE-2019-6975.",
-            "cve": "CVE-2019-6975",
-            "id": "pyup.io-38539",
+            "advisory": "Ml-versioning-tools version 2.0.1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/peopledoc/mlvtools/commit/8a18faaea26c0fc93dad15f03b8e9b81473a4120",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41350",
             "specs": [
-                "<6.5.3"
+                "<2.0.1"
             ],
-            "v": "<6.5.3"
-        },
+            "v": "<2.0.1"
+        }
+    ],
+    "mlalchemy": [
         {
-            "advisory": "Kiwi TCMS 6.6 explicitly requires marked v0.6.1 to fix medium severity ReDoS vulnerability.",
-            "cve": "PVE-2021-38538",
-            "id": "pyup.io-38538",
+            "advisory": "An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.",
+            "cve": "CVE-2017-16615",
+            "id": "pyup.io-35718",
             "specs": [
-                "<6.6"
+                "<0.2.2"
             ],
-            "v": "<6.6"
-        },
+            "v": "<0.2.2"
+        }
+    ],
+    "mlconjug3": [
         {
-            "advisory": "Kiwi TCMS 7.0 removes the API method ``BugSystem.filter()``. It was possible to use this method to steal passwords or keys used for Issue Tracker integration. This vulnerability could be exploited by users logged into Kiwi TCMS and is classified as medium severity.",
-            "cve": "PVE-2021-38536",
-            "id": "pyup.io-38536",
+            "advisory": "Mlconjug3 3.7.16 updates its dependency 'cryptography' to include a security fix.",
+            "cve": "CVE-2020-36242",
+            "id": "pyup.io-42361",
             "specs": [
-                "<7.0"
+                "<3.7.16"
             ],
-            "v": "<7.0"
+            "v": "<3.7.16"
         },
         {
-            "advisory": "Kiwi TCMS 7.3 includes a fix for CVE-2019-19844: potential account hijack via password reset form.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-38535",
+            "advisory": "Mlconjug3 3.7.16 updates its dependency \"pyyaml\" to include a security fix.",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-42366",
             "specs": [
-                "<7.3"
+                "<3.7.16"
             ],
-            "v": "<7.3"
-        },
+            "v": "<3.7.16"
+        }
+    ],
+    "mlf-core": [
         {
-            "advisory": "Kiwitcms 8.1 includes a fix for CVE-2020-9402: Django 1.11 before 1.11.29, 2.2 before 2.2.11, and 3.0 before 3.0.4 allows SQL Injection if untrusted data is used as a tolerance parameter in GIS functions and aggregates on Oracle. By passing a suitably crafted tolerance to GIS functions and aggregates on Oracle, it was possible to break escaping and inject malicious SQL.",
-            "cve": "CVE-2020-9402",
-            "id": "pyup.io-37503",
+            "advisory": "Mlf-core 1.10.0 includes a fix for insecure MD5 (from Bandit report).",
+            "cve": "PVE-2021-39705",
+            "id": "pyup.io-39705",
             "specs": [
-                "<8.1"
+                "<1.10.0"
             ],
-            "v": "<8.1"
+            "v": "<1.10.0"
         }
     ],
-    "knowledge-repo": [
+    "mlrun": [
         {
-            "advisory": "Knowledge-repo 0.8.0 removed two security vulnerabilities associated with arbitrary code execution from code stored in knowledge repositories on both clients and servers via knowledge repository configuration and embedded tooling.\r\nhttps://github.com/airbnb/knowledge-repo/pull/382",
-            "cve": "PVE-2021-36510",
-            "id": "pyup.io-36510",
+            "advisory": "Mlrun 0.9.0rc7 fixes the encoding of project secrets.\r\nhttps://github.com/mlrun/mlrun/pull/1536",
+            "cve": "PVE-2021-42973",
+            "id": "pyup.io-42973",
             "specs": [
-                "<0.8.0"
+                "<0.9.0rc7"
             ],
-            "v": "<0.8.0"
+            "v": "<0.9.0rc7"
         }
     ],
-    "kombu": [
+    "mockintosh": [
         {
-            "advisory": "Kombu 5.2.1 updates Amazon sqs dependency 'urllib3' minimum version to 1.26.7 to include security fixes.\r\nhttps://github.com/celery/kombu/commit/f3b04558fa0df4ecc383c93e0b3b300d95e17c47",
-            "cve": "PVE-2021-42497",
-            "id": "pyup.io-42497",
+            "advisory": "Mockintosh 0.4 adds the ability to refer to external files (containing request and response bodies) and makes it secure by disallowing files outside the mock config hierarchy.",
+            "cve": "PVE-2021-39463",
+            "id": "pyup.io-39463",
             "specs": [
-                "<5.2.1"
+                "<0.4"
             ],
-            "v": "<5.2.1"
+            "v": "<0.4"
         }
     ],
-    "kotti": [
+    "mockup": [
         {
-            "advisory": "kotti 1.3.2 fixes a CSRF (Cross Site Request Forgery) security vulnerablity which was reported in 551. You should upgrade your installations ASAP.",
-            "cve": "PVE-2021-36142",
-            "id": "pyup.io-36142",
+            "advisory": "Mockup before 2.1.3 has a XSS vulnerability in structure and relateditem patterns.\r\nhttps://github.com/plone/mockup/pull/629\r\nhttps://github.com/plone/mockup/pull/627",
+            "cve": "PVE-2021-25893",
+            "id": "pyup.io-25893",
             "specs": [
-                "<1.3.2"
+                "<2.1.3"
             ],
-            "v": "<1.3.2"
+            "v": "<2.1.3"
         }
     ],
-    "kuber": [
+    "moin": [
         {
-            "advisory": "Kuber 10.0.1 includes a fix for CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.",
-            "cve": "CVE-2019-11324",
-            "id": "pyup.io-38099",
+            "advisory": "The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe, which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.",
+            "cve": "CVE-2008-6549",
+            "id": "pyup.io-25894",
             "specs": [
-                "<10.0.1"
+                "<1.6.1"
             ],
-            "v": "<10.0.1"
+            "v": "<1.6.1"
         },
         {
-            "advisory": "Kuber 9.0.0a1 includes a fix for CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.",
-            "cve": "CVE-2018-20060",
-            "id": "pyup.io-36979",
+            "advisory": "Moin versions 1.8.7 and 1.9.2 include a fix for CVE-2010-0669: MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.",
+            "cve": "CVE-2010-0669",
+            "id": "pyup.io-36453",
             "specs": [
-                "<9.0.0a1"
+                "<1.8.7",
+                ">1.8.7,<1.9.2"
             ],
-            "v": "<9.0.0a1"
-        }
-    ],
-    "kubernetes": [
+            "v": "<1.8.7,>1.8.7,<1.9.2"
+        },
         {
-            "advisory": "Kubernetes 12.0.0a1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/kubernetes-client/python/commit/3240b45c46b1115890b011032c3c38e538d55d3c",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41747",
+            "advisory": "Moin 1.9.10 includes a security fix for CVE-2016-7146.",
+            "cve": "CVE-2016-7146",
+            "id": "pyup.io-39588",
+            "specs": [
+                "<1.9.10"
+            ],
+            "v": "<1.9.10"
+        },
+        {
+            "advisory": "Moin 1.9.10 includes a security fix for CVE-2017-5934, XSS in GUI editor related code.",
+            "cve": "CVE-2017-5934",
+            "id": "pyup.io-36447",
+            "specs": [
+                "<1.9.10"
+            ],
+            "v": "<1.9.10"
+        },
+        {
+            "advisory": "Moin 1.9.10 includes a security fix for CVE-2016-9119.",
+            "cve": "CVE-2016-9119",
+            "id": "pyup.io-39587",
+            "specs": [
+                "<1.9.10"
+            ],
+            "v": "<1.9.10"
+        },
+        {
+            "advisory": "Moin 1.9.11 includes a fix for CVE-2020-15275: In MoinMoin before version 1.9.11, an attacker with write permissions can upload an SVG file that contains malicious javascript. This javascript will be executed in a user's browser when the user is viewing that SVG file on the wiki. Users are strongly advised to upgrade to a patched version.\r\nhttps://github.com/moinwiki/moin-1.9/security/advisories/GHSA-4q96-6xhq-ff43",
+            "cve": "CVE-2020-15275",
+            "id": "pyup.io-36475",
             "specs": [
-                "<12.0.0a1"
+                "<1.9.11"
             ],
-            "v": "<12.0.0a1"
+            "v": "<1.9.11"
         },
         {
-            "advisory": "Kubernetes 7.0.1, 8.0.1 and 9.0.0a1 include a fix for CVE-2018-20060: urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.",
-            "cve": "CVE-2018-20060",
-            "id": "pyup.io-36762",
+            "advisory": "Moin 1.9.3 includes a fix for CVE-2011-1058: A cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when \"format rst\" is set, allows remote attackers to inject arbitrary web script or HTML via javascript: URL in the refuri attribute.",
+            "cve": "CVE-2011-1058",
+            "id": "pyup.io-36452",
             "specs": [
-                "<7.0.1",
-                ">=8.0,<8.0.1",
-                ">=9.0,<9.0.0a1"
+                "<1.9.3"
             ],
-            "v": "<7.0.1,>=8.0,<8.0.1,>=9.0,<9.0.0a1"
+            "v": "<1.9.3"
         },
         {
-            "advisory": "Kubernetes 10.0.1 includes a fix for CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.",
-            "cve": "CVE-2019-11324",
-            "id": "pyup.io-38036",
+            "advisory": "Moin 1.9.9 includes a fix for CVE-2016-7148: MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=AttachFile (via page name) component.",
+            "cve": "CVE-2016-7148",
+            "id": "pyup.io-36448",
             "specs": [
-                ">=10.0,<10.0.1"
+                "==1.9.8"
             ],
-            "v": ">=10.0,<10.0.1"
-        }
-    ],
-    "kubernetes-asyncio": [
+            "v": "==1.9.8"
+        },
         {
-            "advisory": "kubernetes-asyncio 8.0.3 uses `yaml.safe_load`, `yaml.safe_dump` for security reasons.",
-            "cve": "PVE-2021-36777",
-            "id": "pyup.io-36777",
+            "advisory": "Moin version 1.9.1 includes a fix for CVE-2010-0667: MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain sensitive information via unspecified vectors.",
+            "cve": "CVE-2010-0667",
+            "id": "pyup.io-36454",
             "specs": [
-                "<8.0.3"
+                ">=1.9.0,<1.9.1"
             ],
-            "v": "<8.0.3"
+            "v": ">=1.9.0,<1.9.1"
         }
     ],
-    "kubetest": [
+    "mollie-api-python": [
         {
-            "advisory": "Kubetest 0.1.0 updates the pyyaml version for security reasons. See: CVE-2017-18342.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-37070",
+            "advisory": "Mollie-api-python 2.0.4 updates requests to v2.20.0 because of a vulnerability in previous versions.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36650",
             "specs": [
-                "<0.1.0"
+                "<2.0.4"
             ],
-            "v": "<0.1.0"
+            "v": "<2.0.4"
         }
     ],
-    "kvm48": [
+    "money-to-prisoners-common": [
         {
-            "advisory": "Kvm48 version 1.3.600 includes a security patch for the function 'load' in 'kvm48/config.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/SNH48Live/KVM48/commit/1cd560899b8bbb10de64ce5a4f6e88fd61f4199d#diff-ebd9623cdd31ae084d3bdeb718bdcf42de239f8b24a1170581c4c6f89dedeaae",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41333",
+            "advisory": "Money-to-prisoners-common version 12.0.1 updates its dependency \"cryptography\" to  include security fixes.",
+            "cve": "PVE-2021-41827",
+            "id": "pyup.io-41827",
             "specs": [
-                "<1.3.600"
+                "<12.0.1"
             ],
-            "v": "<1.3.600"
+            "v": "<12.0.1"
         }
     ],
-    "kytos": [
+    "monoshape": [
         {
-            "advisory": "Kytos 2019.1b1 updates the 'pyyaml' and 'requests' requirements versions, in order to fix vulnerabilities.",
-            "cve": "PVE-2021-38938",
-            "id": "pyup.io-38938",
+            "advisory": "Monoshape 1.2 includes a vulnerable version of Pillow (6.2).",
+            "cve": "CVE-2020-5311",
+            "id": "pyup.io-37605",
             "specs": [
-                "<2019.1b1"
+                "<1.2"
             ],
-            "v": "<2019.1b1"
+            "v": "<1.2"
         },
         {
-            "advisory": "kytos 2019.1b3 change: Changed some dependencies versions in order to fix security bugs",
-            "cve": "PVE-2021-37226",
-            "id": "pyup.io-37226",
-            "specs": [
-                "<2019.1b3"
-            ],
-            "v": "<2019.1b3"
-        }
-    ],
-    "kytos-utils": [
-        {
-            "advisory": "Kytos-utils 2019.1b3 updates requirements versions in order to fix some security bugs.",
-            "cve": "PVE-2021-37225",
-            "id": "pyup.io-37225",
+            "advisory": "Monoshape 1.2 includes a vulnerable version of Pillow (6.2).",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-43459",
             "specs": [
-                "<2019.1b3"
+                "<1.2"
             ],
-            "v": "<2019.1b3"
-        }
-    ],
-    "ladon": [
+            "v": "<1.2"
+        },
         {
-            "advisory": "Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: https://bitbucket.org/jakobsg/ladon/src/42944fc012a3a48214791c120ee5619434505067/src/ladon/interfaces/soap.py#lines-688. The attack vector is: Send a specially crafted SOAP call.",
-            "cve": "CVE-2019-1010268",
-            "id": "pyup.io-42258",
+            "advisory": "Monoshape 1.2 includes a vulnerable version of Pillow (6.2).",
+            "cve": "CVE-2021-25288",
+            "id": "pyup.io-43460",
             "specs": [
-                "==0.6.1"
+                "<1.2"
             ],
-            "v": "==0.6.1"
+            "v": "<1.2"
         }
     ],
-    "lagmat": [
+    "mopidy-jellyfin": [
         {
-            "advisory": "Lagmat 0.3.3 updates its dependency 'numpy' to v1.19.5 to include a security fix.",
-            "cve": "CVE-2019-6446",
-            "id": "pyup.io-43624",
+            "advisory": "Mopidy-jellyfin 0.3.1 addresses a security vulnerability in one of its dependencies.",
+            "cve": "PVE-2021-37281",
+            "id": "pyup.io-37281",
             "specs": [
-                "<0.3.3"
+                "<0.3.1"
             ],
-            "v": "<0.3.3"
+            "v": "<0.3.1"
         }
     ],
-    "lambda-tools": [
+    "morepath": [
         {
-            "advisory": "lambda-tools before 0.1.2 used an unsafe way to load untrusted lambda definitions via `yaml.load`.",
-            "cve": "PVE-2021-35209",
-            "id": "pyup.io-35209",
+            "advisory": "morepath before 0.14 has no host header validation to protect against header poisoning attacks.",
+            "cve": "PVE-2021-25895",
+            "id": "pyup.io-25895",
             "specs": [
-                "<0.1.2"
+                "<0.14"
             ],
-            "v": "<0.1.2"
+            "v": "<0.14"
         }
     ],
-    "lambdajson": [
+    "mortimer": [
         {
-            "advisory": "lambdajson 0.1.5 includes a security fix. Using ast.literal_eval as eval.",
-            "cve": "PVE-2021-25874",
-            "id": "pyup.io-25874",
+            "advisory": "Mortimer 0.4.5 further increases the data protection and data security through an improved handling of access to the alfred database from inside experiments.",
+            "cve": "PVE-2021-38277",
+            "id": "pyup.io-38277",
             "specs": [
-                "<0.1.5"
+                "<0.4.5"
             ],
-            "v": "<0.1.5"
+            "v": "<0.4.5"
         }
     ],
-    "lander": [
+    "mosql": [
         {
-            "advisory": "Lander 0.1.15 updates 'requests' to 2.20.0 for security reasons.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-38375",
+            "advisory": "mosql 0.10 includes several security related changes.",
+            "cve": "PVE-2021-25896",
+            "id": "pyup.io-25896",
             "specs": [
-                "<0.1.15"
+                "<0.10"
             ],
-            "v": "<0.1.15"
+            "v": "<0.10"
         }
     ],
-    "lando": [
+    "motionblinds": [
         {
-            "advisory": "Lando 0.11.3 adds `cluster_api_settings .ssl_ca_cert` config flag to allow secure k8s connections. See <https://github.com/Duke-GCB/lando/pull/209>.",
-            "cve": "PVE-2021-37414",
-            "id": "pyup.io-37414",
+            "advisory": "Motionblinds 0.5.7 hides sensitive information from logs.\r\nhttps://github.com/starkillerOG/motion-blinds/commit/716af4bbfcbf8001b30629427e37d02c37e40233",
+            "cve": "PVE-2021-42718",
+            "id": "pyup.io-42718",
             "specs": [
-                "<0.11.3"
+                "<0.5.7"
             ],
-            "v": "<0.11.3"
+            "v": "<0.5.7"
         }
     ],
-    "language-formatters-pre-commit-hooks": [
+    "moto": [
         {
-            "advisory": "Language-formatters-pre-commit-hooks 1.6.0 enhances its security in commands execution  to prevent shell-injection.\r\nhttps://github.com/macisamuele/language-formatters-pre-commit-hooks/pull/38/files",
-            "cve": "PVE-2021-38926",
-            "id": "pyup.io-38926",
+            "advisory": "Moto 1.3.7 updates a dependency (cryptography) with a known security vulnerability (CVE-2018-10903).\r\nhttps://github.com/spulec/moto/issues/1839",
+            "cve": "CVE-2018-10903",
+            "id": "pyup.io-41706",
             "specs": [
-                "<1.6.0"
+                "<1.3.7"
             ],
-            "v": "<1.6.0"
+            "v": "<1.3.7"
         }
     ],
-    "lapdog": [
+    "mpxj": [
         {
-            "advisory": "Lapdog 0.18.7 improves API security by switching to custom Lapdog OAuth tokens. Currently this is only supported by Broad accounts. Non-broad accounts will continue to use standard Google application-default credentials when authenticating through the Lapdog API.",
-            "cve": "PVE-2021-37597",
-            "id": "pyup.io-37597",
+            "advisory": "Mpxj 5.0.0 fixes a XXE security vulnerability. See also <https://sourceforge.net/p/mpxj/bugs/267>.",
+            "cve": "PVE-2021-39675",
+            "id": "pyup.io-39675",
             "specs": [
-                "<0.18.7"
+                "<5.0.0"
             ],
-            "v": "<0.18.7"
-        }
-    ],
-    "laporte-mqtt": [
+            "v": "<5.0.0"
+        },
         {
-            "advisory": "Laporte-mqtt version 0.2.2 includes a security patch for the function 'load_config' in 'laporte_mqtt/config.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/vinklat/laporte-mqtt/commit/db24ded1c1ed0232c42bb826b9c1dc30fb925f2e",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41334",
+            "advisory": "Mpxj 8.1.4 addresses the CVE-2020-25020 XXE vulnerability.",
+            "cve": "CVE-2020-25020",
+            "id": "pyup.io-39674",
             "specs": [
-                "<0.2.2"
+                "<8.1.4"
             ],
-            "v": "<0.2.2"
-        }
-    ],
-    "launchdarkly-server-sdk": [
+            "v": "<8.1.4"
+        },
         {
-            "advisory": "Launchdarkly-server-sdk 6.11.2 uses 'yaml.safe_load()' instead of 'yaml.load()' for YAML/JSON test data parsing to fix an arbitrary code execution vulnerability.\r\nhttps://github.com/launchdarkly/python-server-sdk/issues/136",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-43004",
+            "advisory": "common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.",
+            "cve": "CVE-2020-35460",
+            "id": "pyup.io-42293",
             "specs": [
-                "<6.11.2"
+                "<8.3.5"
             ],
-            "v": "<6.11.2"
+            "v": "<8.3.5"
         },
         {
-            "advisory": "Setting `verify_ssl` to `False` in the client configuration of launchdarkly-server-sdk before 6.12.2 did not have the expected effect of completely turning off SSL/TLS verification, because it still left _certificate_ verification in effect, so it would allow a totally insecure connection but reject a secure connection whose certificate had an unknown CA. This has been changed so that it will turn off certificate verification as well. This is not a recommended practice and a future version of the SDK will add a way to specify a custom certificate authority instead (to support, for instance, using the Relay Proxy with a self-signed certificate).",
-            "cve": "PVE-2021-38082",
-            "id": "pyup.io-38082",
+            "advisory": "Mpxj 8.3.5 addresses the CVE-2020-35460 zip slip vulnerability.",
+            "cve": "PVE-2021-39673",
+            "id": "pyup.io-39673",
             "specs": [
-                "<6.12.2"
+                "<8.3.5"
             ],
-            "v": "<6.12.2"
+            "v": "<8.3.5"
         }
     ],
-    "launchkey": [
+    "mpymodcore": [
         {
-            "advisory": "Launchkey 3.9.1 updates its dependency 'jinja2' to v2.11.3 to include a security fix.",
-            "cve": "CVE-2020-28493",
-            "id": "pyup.io-40654",
+            "advisory": "Mpymodcore 0.0.12 hardens the WindUp security (user module), and secures router with a redirect/bad request response.",
+            "cve": "PVE-2021-38431",
+            "id": "pyup.io-38431",
             "specs": [
-                "<3.9.1"
+                "<0.0.12"
             ],
-            "v": "<3.9.1"
-        }
-    ],
-    "layeredimage": [
+            "v": "<0.0.12"
+        },
         {
-            "advisory": "Layeredimage 2020.6.4 updates pyora, which has security benefits.",
-            "cve": "PVE-2021-38288",
-            "id": "pyup.io-38288",
+            "advisory": "Mpymodcore 0.0.9 includes a WindUp security hardening, an user module, and a secure router with redirect/bad request response.",
+            "cve": "PVE-2021-41234",
+            "id": "pyup.io-41234",
             "specs": [
-                "<2020.6.4"
+                "<0.0.9"
             ],
-            "v": "<2020.6.4"
+            "v": "<0.0.9"
         },
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-40327",
+            "advisory": "Mpymodcore 0.0.9 includes hardening of WindUp security and it also secures router with a redirect/bad request response.",
+            "cve": "PVE-2021-38218",
+            "id": "pyup.io-38218",
             "specs": [
-                "<2021.2.1"
+                "<0.0.9"
             ],
-            "v": "<2021.2.1"
+            "v": "<0.0.9"
         },
         {
-            "advisory": "Layeredimage 2021.2.1 updates the 'Pillow' dependency >= 8.1.1 due to high severity security vulnerabilities (CVE-2020-35654).",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-40328",
+            "advisory": "The changelog of mpymodcore 0.0.14 mentions some backlogged tasks, among which: \"WindUp security hardening, user module, secure router with redirect/bad request response\"",
+            "cve": "PVE-2021-38795",
+            "id": "pyup.io-38795",
             "specs": [
-                "<2021.2.1"
+                "<=0.0.14"
             ],
-            "v": "<2021.2.1"
+            "v": "<=0.0.14"
         },
         {
-            "advisory": "Layeredimage 2021.2.1 updates the 'Pillow' dependency >= 8.1.1 due to high severity security vulnerabilities (CVE-2020-35655).",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-40332",
+            "advisory": "Mpymodcore version 0.0.15 and below (and possibly later version, too) are in need of WindUp security hardening. This is listed in the backlog.",
+            "cve": "PVE-2021-38872",
+            "id": "pyup.io-38872",
             "specs": [
-                "<2021.2.1"
+                "<=0.0.15"
             ],
-            "v": "<2021.2.1"
+            "v": "<=0.0.15"
         },
         {
-            "advisory": "Layeredimage 2021.0.1 includes a fix for CVE-2020-35653: In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-40329",
+            "advisory": "Mpymodcore 0.0.17 mentions in its changelog that WindUp security hardening is a backlogged task.",
+            "cve": "PVE-2021-38980",
+            "id": "pyup.io-38980",
             "specs": [
-                "<2021.2.1"
+                "<=0.0.17"
             ],
-            "v": "<2021.2.1"
+            "v": "<=0.0.17"
         },
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-40330",
+            "advisory": "Mpymodcore 0.0.18 includes a note in its list of backlogged tasks to harden the security of WindUp, securing the router with a redirect/bad request response.",
+            "cve": "PVE-2021-39161",
+            "id": "pyup.io-39161",
             "specs": [
-                "<2021.2.1"
+                "<=0.0.18"
             ],
-            "v": "<2021.2.1"
+            "v": "<=0.0.18"
         },
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-40331",
+            "advisory": "Mpymodcore 0.0.19 was released with the acknowledgement that WindUp requires security hardening.",
+            "cve": "PVE-2021-39273",
+            "id": "pyup.io-39273",
             "specs": [
-                "<2021.2.1"
+                "<=0.0.19"
             ],
-            "v": "<2021.2.1"
+            "v": "<=0.0.19"
         }
     ],
-    "ldap3": [
+    "mqtt-io": [
         {
-            "advisory": "ldap3 before 0.9.5.4 has several security issues in lazy connections.",
-            "cve": "PVE-2021-25875",
-            "id": "pyup.io-25875",
+            "advisory": "Mqtt-io 0.5.2 updates PyYAML to a version that doesn't suffer from CVE-2020-1747 vulnerability.",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-40018",
             "specs": [
-                "<0.9.5.4"
+                "<0.5.2"
             ],
-            "v": "<0.9.5.4"
-        },
+            "v": "<0.5.2"
+        }
+    ],
+    "mr.migrator": [
         {
-            "advisory": "ldap3 2.4 includes a security fix in the rebind() method of the Connection object.",
-            "cve": "PVE-2021-35053",
-            "id": "pyup.io-35053",
+            "advisory": "Mr.migrator 1.2 fixes a form problem with security hotfix from its dependency package 'Plone'.\r\nhttps://plone.org/security/hotfix/20160830",
+            "cve": "CVE-2016-7136",
+            "id": "pyup.io-25897",
             "specs": [
-                "<2.4"
+                "<1.2"
             ],
-            "v": "<2.4"
+            "v": "<1.2"
         }
     ],
-    "lemur": [
+    "msgpack": [
         {
-            "advisory": "Lemur 0.9.0 fixes three critical vulnerabilities where an authenticated user could retrieve/access unauthorized information. See also <https://github.com/Netflix/lemur/issues/3463>.",
-            "cve": "PVE-2021-40028",
-            "id": "pyup.io-40028",
+            "advisory": "msgpack 0.6.0 contains some backward incompatible changes for security reason (DoS).",
+            "cve": "PVE-2021-36700",
+            "id": "pyup.io-36700",
             "specs": [
-                "<0.9.0"
+                "<0.6.0"
             ],
-            "v": "<0.9.0"
-        },
+            "v": "<0.6.0"
+        }
+    ],
+    "mss": [
         {
-            "advisory": "Lemur 0.1.5 includes a fix for CVE-2015-7764: Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.\r\nhttp://www.openwall.com/lists/oss-security/2015/10/20/3\r\nhttps://github.com/Netflix/lemur/issues/117\r\nhttps://github.com/kvesteri/sqlalchemy-utils/issues/166",
-            "cve": "CVE-2015-7764",
-            "id": "pyup.io-25876",
+            "advisory": "mss before 2.0.18 has a undisclosed security issue.",
+            "cve": "PVE-2021-25898",
+            "id": "pyup.io-25898",
             "specs": [
-                "==0.1.4"
+                "<2.0.18"
             ],
-            "v": "==0.1.4"
+            "v": "<2.0.18"
         }
     ],
-    "lg-rez": [
+    "msticpy": [
         {
-            "advisory": "Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28677",
-            "id": "pyup.io-42105",
+            "advisory": "Msticpy 1.1.0 updates its dependency 'lxml' to v4.6.3 to include security fixes.",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-40859",
             "specs": [
-                "<2.1.4"
+                "<1.1.0"
             ],
-            "v": "<2.1.4"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Lg-rez version 2.1.4 updates its dependency 'rsa' to v4.7 to include security fixes.",
-            "cve": "CVE-2020-25658",
-            "id": "pyup.io-42106",
+            "advisory": "Msticpy 1.1.0 updates its dependency 'lxml' to v4.6.3 to include security fixes.",
+            "cve": "PVE-2021-39195",
+            "id": "pyup.io-43645",
             "specs": [
-                "<2.1.4"
+                "<1.1.0"
             ],
-            "v": "<2.1.4"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28678",
-            "id": "pyup.io-42049",
+            "advisory": "Msticpy 1.1.0 updates its dependency 'lxml' to v4.6.3 to include security fixes.",
+            "cve": "CVE-2020-27783",
+            "id": "pyup.io-43646",
             "specs": [
-                "<2.1.4"
+                "<1.1.0"
             ],
-            "v": "<2.1.4"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28675",
-            "id": "pyup.io-42103",
+            "advisory": "Msticpy 1.1.0 updates its dependency 'aiohttp' to v3.7.4 to include a security fix.",
+            "cve": "CVE-2021-21330",
+            "id": "pyup.io-43648",
             "specs": [
-                "<2.1.4"
+                "<1.1.0"
             ],
-            "v": "<2.1.4"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Lg-rez version 2.1.4 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28676",
-            "id": "pyup.io-42104",
+            "advisory": "Msticpy 1.1.0 updates its dependency 'lxml' to v4.6.3 to include security fixes.",
+            "cve": "CVE-2014-3146",
+            "id": "pyup.io-43647",
             "specs": [
-                "<2.1.4"
+                "<1.1.0"
             ],
-            "v": "<2.1.4"
+            "v": "<1.1.0"
         }
     ],
-    "libgenesis": [
+    "mstr-rest-requests": [
         {
-            "advisory": "Libgenesis 0.1.8 updates its dependency 'lxml' minimum version to v4.6.5 to include security fixes.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-43385",
+            "advisory": "Mstr-rest-requests 0.12.4 fixes some security issues related to dependencies.",
+            "cve": "PVE-2021-42214",
+            "id": "pyup.io-42214",
             "specs": [
-                "<0.1.8"
+                "<0.12.4"
             ],
-            "v": "<0.1.8"
-        },
+            "v": "<0.12.4"
+        }
+    ],
+    "mtga": [
         {
-            "advisory": "Libgenesis 0.1.8 updates its dependency 'lxml' minimum version to v4.6.5 to include security fixes.",
-            "cve": "CVE-2020-27783",
-            "id": "pyup.io-43386",
+            "advisory": "mtga 2.0.0beta includes API security improvements & fixes.",
+            "cve": "PVE-2021-36317",
+            "id": "pyup.io-36317",
             "specs": [
-                "<0.1.8"
+                "<2.0.0beta"
             ],
-            "v": "<0.1.8"
+            "v": "<2.0.0beta"
+        }
+    ],
+    "mtprotoproxy": [
+        {
+            "advisory": "mtprotoproxy before 1.0.0 has the potential to allow for passive detection given known string lengths.\r\nV1.0.0 now adds random paddings to prevent this.",
+            "cve": "PVE-2021-36301",
+            "id": "pyup.io-36301",
+            "specs": [
+                "<1.0.0"
+            ],
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Libgenesis 0.1.8 updates its dependency 'lxml' to v4.6.5 to include a security fix.",
-            "cve": "CVE-2021-43818",
-            "id": "pyup.io-43379",
+            "advisory": "Mtprotoproxy 1.0.6 adds more protections from replay attacks.",
+            "cve": "PVE-2021-37407",
+            "id": "pyup.io-37407",
             "specs": [
-                "<0.1.8"
+                "<1.0.6"
             ],
-            "v": "<0.1.8"
+            "v": "<1.0.6"
         }
     ],
-    "libhxl": [
+    "muffnn": [
         {
-            "advisory": "For web-security reasons, libhxl 4.21.3 blocks the fetching of datasets from localhost, *.localdomain (or any dotted quad) unless allow_local is True.",
-            "cve": "PVE-2021-39450",
-            "id": "pyup.io-39450",
+            "advisory": "Muffnn 2.3.1 increases the minimum version of tensorflow to v1.15.2 to fix the security vulnerability reported in https://github.com/tensorflow/tensorflow/security/advisories/GHSA-977j-xj7q-2jr9",
+            "cve": "CVE-2020-5215",
+            "id": "pyup.io-38154",
             "specs": [
-                "<4.21.3"
+                "<2.3.1"
             ],
-            "v": "<4.21.3"
-        }
-    ],
-    "libtaxii": [
+            "v": "<2.3.1"
+        },
         {
-            "advisory": "libtaxii before 1.1.105 has multiple XML parsing related vulnerabilities.",
-            "cve": "PVE-2021-25877",
-            "id": "pyup.io-25877",
+            "advisory": "Muffnn 2.3.1 increases the minimum version of tensorflow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-16778",
+            "id": "pyup.io-43788",
+            "specs": [
+                "<2.3.1"
+            ],
+            "v": "<2.3.1"
+        },
+        {
+            "advisory": "Muffnn 2.3.1 increases the minimum version of tensorflow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-5482",
+            "id": "pyup.io-43792",
+            "specs": [
+                "<2.3.1"
+            ],
+            "v": "<2.3.1"
+        },
+        {
+            "advisory": "Muffnn 2.3.1 increases the minimum version of tensorflow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-19646",
+            "id": "pyup.io-43789",
+            "specs": [
+                "<2.3.1"
+            ],
+            "v": "<2.3.1"
+        },
+        {
+            "advisory": "Muffnn 2.3.1 increases the minimum version of tensorflow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-5481",
+            "id": "pyup.io-43790",
+            "specs": [
+                "<2.3.1"
+            ],
+            "v": "<2.3.1"
+        },
+        {
+            "advisory": "Muffnn 2.3.1 increases the minimum version of tensorflow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-16168",
+            "id": "pyup.io-43791",
             "specs": [
-                "<1.1.105"
+                "<2.3.1"
             ],
-            "v": "<1.1.105"
-        }
-    ],
-    "libtorrent": [
+            "v": "<2.3.1"
+        },
         {
-            "advisory": "Libtorrent 2.0.3 (the underlying core dependency of the Python bindings) fixes an integer overflow in hash_picker and properly restricts max file sizes in torrents.\r\nhttps://github.com/arvidn/libtorrent/commit/58a489332ca05303e8001c24478f27338309c858",
-            "cve": "PVE-2021-43049",
-            "id": "pyup.io-43049",
+            "advisory": "Muffnn 2.3.1 increases the minimum version of tensorflow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-9635",
+            "id": "pyup.io-43793",
             "specs": [
-                "<2.0.3"
+                "<2.3.1"
             ],
-            "v": "<2.0.3"
-        }
-    ],
-    "lief": [
+            "v": "<2.3.1"
+        },
         {
-            "advisory": "An issue was discovered in LIEF through 0.11.4. A heap-buffer-overflow exists in the function main located in pe_reader.c. It allows an attacker to cause code Execution.",
-            "cve": "CVE-2021-32297",
-            "id": "pyup.io-42313",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to fix the security vulnerability reported in https://github.com/advisories/GHSA-4g9f-63rx-5cw4.",
+            "cve": "CVE-2020-15190",
+            "id": "pyup.io-39222",
             "specs": [
-                "<0.11.4"
+                "<2.3.2"
             ],
-            "v": "<0.11.4"
-        }
-    ],
-    "lifx-control-panel": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Lifx-control-panel 1.5.4 fixes a pretty major security exploit. It adds safe-scopes to all 'eval()' calls.\r\nhttps://github.com/samclane/LIFX-Control-Panel/commit/3f95fd5362b52144b44e47102ab386baa511f143",
-            "cve": "PVE-2021-37424",
-            "id": "pyup.io-37424",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15211",
+            "id": "pyup.io-43757",
             "specs": [
-                "<1.5.4"
+                "<2.3.2"
             ],
-            "v": "<1.5.4"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Lifx-control-panel 1.6.3 removes all 'eval()' statements for security.\r\nhttps://github.com/samclane/LIFX-Control-Panel/commit/feccb386549e25414f15b3ef4b85018d0a836125",
-            "cve": "PVE-2021-37423",
-            "id": "pyup.io-37423",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13630",
+            "id": "pyup.io-43758",
             "specs": [
-                "<1.6.3"
+                "<2.3.2"
             ],
-            "v": "<1.6.3"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "lifx-control-panel 1.7.6:\r\n* Pyinstaller 3.6 fixes several security vulnerabilities \r\n* Updated other key repositories, increasing security and speed",
-            "cve": "PVE-2021-37853",
-            "id": "pyup.io-37853",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15194",
+            "id": "pyup.io-43759",
             "specs": [
-                "<1.7.6"
+                "<2.3.2"
             ],
-            "v": "<1.7.6"
-        }
-    ],
-    "limnoria": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Eval injection in the Math plugin of Limnoria (before 2019.11.09) and Supybot (through 2018-05-09) allows remote unprivileged attackers to disclose information or possibly have unspecified other impact via the calc and icalc IRC commands.",
-            "cve": "CVE-2019-19010",
-            "id": "pyup.io-42267",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15205",
+            "id": "pyup.io-43761",
             "specs": [
-                "<2019.11.09"
+                "<2.3.2"
             ],
-            "v": "<2019.11.09"
-        }
-    ],
-    "lin-cms": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py' (https://github.com/TaleLin/lin-cms-flask/issues/27). See CVE-2020-18698.",
-            "cve": "CVE-2020-18698",
-            "id": "pyup.io-41182",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15202",
+            "id": "pyup.io-43762",
             "specs": [
-                "<0.2.0b1"
+                "<2.3.2"
             ],
-            "v": "<0.2.0b1"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets (https://github.com/TaleLin/lin-cms-flask/issues/30). See CVE-2020-18701.",
-            "cve": "CVE-2020-18701",
-            "id": "pyup.io-41184",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15206",
+            "id": "pyup.io-43763",
             "specs": [
-                "<0.2.0b1"
+                "<2.3.2"
             ],
-            "v": "<0.2.0b1"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the 'Username' parameter of the in component 'app/api/cms/user.py' (https://github.com/TaleLin/lin-cms-flask/issues/28). See CVE-2020-18699.",
-            "cve": "CVE-2020-18699",
-            "id": "pyup.io-41183",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15208",
+            "id": "pyup.io-43764",
             "specs": [
-                "<0.2.0b1"
+                "<2.3.2"
             ],
-            "v": "<0.2.0b1"
-        }
-    ],
-    "lin-cms-flask": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the application not invalidating a user's authentication token upon logout, which allows for replaying packets (https://github.com/TaleLin/lin-cms-flask/issues/30). See CVE-2020-18701.",
-            "cve": "CVE-2020-18701",
-            "id": "pyup.io-41214",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13434",
+            "id": "pyup.io-43767",
             "specs": [
-                "==0.1.1"
+                "<2.3.2"
             ],
-            "v": "==0.1.1"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'Username' parameter of the in component 'app/api/cms/user.py' (https://github.com/TaleLin/lin-cms-flask/issues/28). See CVE-2020-18699.",
-            "cve": "CVE-2020-18699",
-            "id": "pyup.io-41215",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13631",
+            "id": "pyup.io-43770",
             "specs": [
-                "==0.1.1"
+                "<2.3.2"
             ],
-            "v": "==0.1.1"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'login' function in the component 'app/api/cms/user.py' (https://github.com/TaleLin/lin-cms-flask/issues/27). See CVE-2020-18698.",
-            "cve": "CVE-2020-18698",
-            "id": "pyup.io-41216",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15209",
+            "id": "pyup.io-43771",
             "specs": [
-                "==0.1.1"
+                "<2.3.2"
             ],
-            "v": "==0.1.1"
-        }
-    ],
-    "line-item-manager": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Line-item-manager 0.2.2 upgrades the 'jinja2' dependency to 2.11.3 and the 'PyYAML' due to security vulnerabilities.",
-            "cve": "PVE-2021-40555",
-            "id": "pyup.io-40555",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-9327",
+            "id": "pyup.io-43772",
             "specs": [
-                "<0.2.2"
+                "<2.3.2"
             ],
-            "v": "<0.2.2"
-        }
-    ],
-    "lithops": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Lithops 1.0.1 fixes a flask security issues. See: CVE-2018-1000656.",
-            "cve": "CVE-2018-1000656",
-            "id": "pyup.io-38787",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15203",
+            "id": "pyup.io-43775",
             "specs": [
-                "<1.0.1"
+                "<2.3.2"
             ],
-            "v": "<1.0.1"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Lithops 1.0.19 fixes a CVE-2019-12855 security alert.",
-            "cve": "CVE-2019-12855",
-            "id": "pyup.io-38786",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15210",
+            "id": "pyup.io-43776",
             "specs": [
-                "<1.0.19"
+                "<2.3.2"
             ],
-            "v": "<1.0.19"
-        }
-    ],
-    "livefyre": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "livefyre before 2.0.3 uses a release of a transitive dependency with known security vulnerabilities  (PyJWT).",
-            "cve": "PVE-2021-34170",
-            "id": "pyup.io-34170",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-15601",
+            "id": "pyup.io-43778",
             "specs": [
-                "<2.0.3"
+                "<2.3.2"
             ],
-            "v": "<2.0.3"
-        }
-    ],
-    "localstack": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Localstack 0.12.14 fixes CORS setup to prevent CSRF.\r\nhttps://github.com/localstack/localstack/commit/809235e3079a1060dae599ce83ed06c84b0e34a5",
-            "cve": "PVE-2021-41059",
-            "id": "pyup.io-41059",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2018-19664",
+            "id": "pyup.io-43779",
             "specs": [
-                "<0.12.14"
+                "<2.3.2"
             ],
-            "v": "<0.12.14"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Localstack 0.12.15 binds Edge Service to 127.0.0.1 by default instead of to 0.0.0.0.\r\nhttps://github.com/localstack/localstack/pull/4223",
-            "cve": "PVE-2021-42834",
-            "id": "pyup.io-42834",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2018-17190",
+            "id": "pyup.io-43780",
             "specs": [
-                "<0.12.15"
+                "<2.3.2"
             ],
-            "v": "<0.12.15"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Localstack 0.12.17 replaces Docker CLI commands with Docker Python SDK client to reduce the number of shell calls.\r\nhttps://github.com/localstack/localstack/pull/4442",
-            "cve": "PVE-2021-42833",
-            "id": "pyup.io-42833",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-19244",
+            "id": "pyup.io-43782",
             "specs": [
-                "<0.12.17"
+                "<2.3.2"
             ],
-            "v": "<0.12.17"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Localstack is vulnerable to Denial of Service via regular expressions (ReDoS). After disclosure, vendor said that these threats \"are not considered a key concern since LocalStack is executed on a local machine\". There's no information about patches for these vulnerabilities.\r\nhttps://blog.sonarsource.com/hack-the-stack-with-localstack",
-            "cve": "PVE-2021-42837",
-            "id": "pyup.io-42837",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-19880",
+            "id": "pyup.io-43783",
             "specs": [
-                ">0"
+                "<2.3.2"
             ],
-            "v": ">0"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Localstack is vulnerable to CVE-2021-32091: A Cross-site scripting (XSS) vulnerability exists in StackLift LocalStack 0.12.6. After disclosure, vendor said that these threats \"are not considered a key concern since LocalStack is executed on a local machine\". There's no information about patches for these vulnerabilities.\r\nhttps://blog.sonarsource.com/hack-the-stack-with-localstack",
-            "cve": "CVE-2021-32091",
-            "id": "pyup.io-42836",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2018-20330",
+            "id": "pyup.io-43784",
             "specs": [
-                ">0"
+                "<2.3.2"
             ],
-            "v": ">0"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Localstack is vulnerable to CVE-2021-32090: The dashboard component of StackLift LocalStack 0.12.6 allows attackers to inject arbitrary shell commands via the functionName parameter. After disclosure, vendor said that these threats \"are not considered a key concern since LocalStack is executed on a local machine\". There's no information about patches for these vulnerabilities.\r\nhttps://blog.sonarsource.com/hack-the-stack-with-localstack",
-            "cve": "CVE-2021-32090",
-            "id": "pyup.io-42835",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2018-11770",
+            "id": "pyup.io-43786",
             "specs": [
-                ">0"
+                "<2.3.2"
             ],
-            "v": ">0"
-        }
-    ],
-    "locopy": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Locopy version 0.3.8 includes a security patch for the function 'read_config_yaml' in 'locopy/utility.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/capitalone/locopy/pull/105",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41335",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-13960",
+            "id": "pyup.io-43787",
             "specs": [
-                "<0.3.8"
+                "<2.3.2"
             ],
-            "v": "<0.3.8"
-        }
-    ],
-    "locustio": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "locustio before 0.7 uses pickle.",
-            "cve": "PVE-2021-25878",
-            "id": "pyup.io-25878",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15204",
+            "id": "pyup.io-43760",
             "specs": [
-                "<0.7"
+                "<2.3.2"
             ],
-            "v": "<0.7"
-        }
-    ],
-    "logilab-common": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "The Execute class in shellutils in logilab-commons before 0.61.0 uses tempfile.mktemp, which allows local users to have an unspecified impact by pre-creating the temporary file.",
-            "cve": "CVE-2014-1839",
-            "id": "pyup.io-35525",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-11656",
+            "id": "pyup.io-43765",
             "specs": [
-                "<0.61.0"
+                "<2.3.2"
             ],
-            "v": "<0.61.0"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "The (1) extract_keys_from_pdf and (2) fill_pdf functions in pdf_ext.py in logilab-commons before 0.61.0 allows local users to overwrite arbitrary files and possibly have other unspecified impact via a symlink attack on /tmp/toto.fdf.",
-            "cve": "CVE-2014-1838",
-            "id": "pyup.io-35524",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-11655",
+            "id": "pyup.io-43766",
             "specs": [
-                "<0.61.0"
+                "<2.3.2"
             ],
-            "v": "<0.61.0"
-        }
-    ],
-    "lookatme": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "In lookatme (python/pypi package) versions prior to 2.3.0, the package automatically loaded the built-in \"terminal\" and \"file_loader\" extensions. Users that use lookatme to render untrusted markdown may have malicious shell commands automatically run on their system. This is fixed in version 2.3.0. As a workaround, the `lookatme/contrib/terminal.py` and `lookatme/contrib/file_loader.py` files may be manually deleted. Additionally, it is always recommended to be aware of what is being rendered with lookatme. See CVE-2020-15271.",
-            "cve": "CVE-2020-15271",
-            "id": "pyup.io-38950",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13435",
+            "id": "pyup.io-43768",
             "specs": [
-                "<2.3.0"
+                "<2.3.2"
             ],
-            "v": "<2.3.0"
-        }
-    ],
-    "luckycharms": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Luckycharms 0.5.2 upgrades some dependencies with security vulnerabilities.",
-            "cve": "PVE-2021-37144",
-            "id": "pyup.io-37144",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13871",
+            "id": "pyup.io-43769",
             "specs": [
-                "<0.5.2"
+                "<2.3.2"
             ],
-            "v": "<0.5.2"
-        }
-    ],
-    "luigi": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "luigi 2.1.1 fixes a security issue where malicious users can run arbitrary code if they have file system (even external mounts!)+network access on the machine running luigid (executed by the user that you run luigid with).",
-            "cve": "PVE-2021-34671",
-            "id": "pyup.io-34671",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15195",
+            "id": "pyup.io-43773",
             "specs": [
-                "<2.1.1"
+                "<2.3.2"
             ],
-            "v": "<2.1.1"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Luigi before 2.7.5 allowed an XSS attack using GET parameters, relying on the Jquery 'append' function.\r\nhttps://github.com/spotify/luigi/pull/2391",
-            "cve": "PVE-2021-36315",
-            "id": "pyup.io-36315",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15207",
+            "id": "pyup.io-43774",
             "specs": [
-                "<2.7.5"
+                "<2.3.2"
             ],
-            "v": "<2.7.5"
-        }
-    ],
-    "lurklite": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Lurklite 0.4.9 includes a change that allows Discord administrators to be specified with user IDs as well as usernamediscriminator, improving security with username changes.",
-            "cve": "PVE-2021-38394",
-            "id": "pyup.io-38394",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15358",
+            "id": "pyup.io-43777",
             "specs": [
-                "<0.4.9"
+                "<2.3.2"
             ],
-            "v": "<0.4.9"
-        }
-    ],
-    "lxml": [
+            "v": "<2.3.2"
+        },
         {
-            "advisory": "Incomplete blacklist vulnerability in the lxml.html.clean module in lxml before 3.3.5 allows remote attackers to conduct cross-site scripting (XSS) attacks via control characters in the link scheme to the clean_html function.",
-            "cve": "CVE-2014-3146",
-            "id": "pyup.io-35549",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-19645",
+            "id": "pyup.io-43781",
             "specs": [
-                "<3.3.5"
+                "<2.3.2"
             ],
-            "v": "<3.3.5"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "In lxml before 4.4.0, when writing to file paths that contain the URL escape character '%', the file path could wrongly be mangled by URL unescaping and thus write to a different file or directory.  Code that writes to file paths that are provided by untrusted sources, but that must work with previous versions of lxml, should best either reject paths that contain '%' characters, or otherwise make sure that the path does not contain maliciously injected '%XX' URL hex escapes for paths like '../'.\r\nhttps://github.com/lxml/lxml/commit/0245aba002f069a0b157282707bdf77418d1b5be",
-            "cve": "PVE-2021-39195",
-            "id": "pyup.io-39195",
+            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-10099",
+            "id": "pyup.io-43785",
             "specs": [
-                "<4.4.0"
+                "<2.3.2"
             ],
-            "v": "<4.4.0"
-        },
+            "v": "<2.3.2"
+        }
+    ],
+    "multi-model-server": [
         {
-            "advisory": "Lxml 4.6.2 includes a fix for CVE-2020-27783: A XSS vulnerability was discovered in python-lxml's clean module. The module's parser didn't properly imitate browsers, which caused different behaviors between the sanitizer and the user's page. A remote attacker could exploit this flaw to run arbitrary HTML/JS code.",
-            "cve": "CVE-2020-27783",
-            "id": "pyup.io-39194",
+            "advisory": "Multi-model-server 1.1.5 updates its dependency 'log4j' to v2.16.0 to fix critical vulnerabilities.\r\nhttps://github.com/awslabs/multi-model-server/commit/664b188156ef2c7312cc6be39230e8f6667593ac",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43404",
             "specs": [
-                "<4.6.2"
+                "<1.1.5"
             ],
-            "v": "<4.6.2"
+            "v": "<1.1.5"
         },
         {
-            "advisory": "An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3. When disabling the safe_attrs_only and forms arguments, the Cleaner class does not remove the formaction attribute allowing for JS to bypass the sanitizer. A remote attacker could exploit this flaw to run arbitrary JS code on users who interact with incorrectly sanitized HTML. This issue is patched in lxml 4.6.3.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-40072",
+            "advisory": "Multi-model-server 1.1.5 updates its dependency 'log4j' to v2.16.0 to fix critical vulnerabilities.\r\nhttps://github.com/awslabs/multi-model-server/commit/664b188156ef2c7312cc6be39230e8f6667593ac",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43405",
             "specs": [
-                "<4.6.3"
+                "<1.1.5"
             ],
-            "v": "<4.6.3"
+            "v": "<1.1.5"
         },
         {
-            "advisory": "Lxml 4.6.5 includes a fix for CVE-2021-43818: Prior to version 4.6.5, the HTML Cleaner in lxml.html lets certain crafted script content pass through, as well as script content in SVG files embedded using data URIs.\r\nhttps://github.com/lxml/lxml/security/advisories/GHSA-55x5-fj6c-h6m8",
-            "cve": "CVE-2021-43818",
-            "id": "pyup.io-43366",
+            "advisory": "Multi-model-server 1.1.7 updates its dependency 'log4j' to v2.17.0 to fix a severe vulnerability.\r\nhttps://github.com/awslabs/multi-model-server/commit/2499f5e7a60b998eb6de74c6a932571ef25bf7e7",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-43438",
             "specs": [
-                "<4.6.5"
+                "<1.1.7"
             ],
-            "v": "<4.6.5"
-        }
-    ],
-    "mackup": [
+            "v": "<1.1.7"
+        },
         {
-            "advisory": "Mackup 0.8.28 includes a vulnerability fix. No details were given.",
-            "cve": "PVE-2021-38383",
-            "id": "pyup.io-38383",
+            "advisory": "Multi-model-server 1.1.8 updates its dependency 'log4j' to v2.17.1 to include a security fix.\r\nhttps://github.com/awslabs/multi-model-server/commit/769ad6bd6fb85a8013bccdea709beda491f6e048",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44560",
             "specs": [
-                "<0.8.28"
+                "<1.1.8"
             ],
-            "v": "<0.8.28"
+            "v": "<1.1.8"
         }
     ],
-    "maestral": [
+    "murano-dashboard": [
         {
-            "advisory": "Communication between the sync daemon and frontend (GUI or CLI) in maestral 0.4.1 is faster and more secure than in previous versions. Additionally, it uses Unix domain sockets instead of TCP/IP sockets for communication with daemon. This means that communication is lighter, faster and more secure (other users on the same PC  can no longer connect to your sync daemon).",
-            "cve": "PVE-2021-37523",
-            "id": "pyup.io-37523",
+            "advisory": "OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.",
+            "cve": "CVE-2016-4972",
+            "id": "pyup.io-25899",
             "specs": [
-                "<0.4.1"
+                ">=2.0,<2.0.1",
+                "<1.0.3"
             ],
-            "v": "<0.4.1"
+            "v": ">=2.0,<2.0.1,<1.0.3"
         }
     ],
-    "maestrowf": [
+    "music21": [
         {
-            "advisory": "Maestrowf 1.1.6 updates PyYAML to v4.2b1 to include a security fix.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-38297",
+            "advisory": "Music21 6.1.0 is no longer packaged with external modules; these will be installed when installing music21 via pip (otherwise run `pip install -r requirements.txt`).  Speed and security improvements come with this.",
+            "cve": "PVE-2021-38746",
+            "id": "pyup.io-38746",
             "specs": [
-                "<1.1.6"
+                "<6.1.0"
             ],
-            "v": "<1.1.6"
+            "v": "<6.1.0"
         }
     ],
-    "mailman": [
+    "mxnet": [
         {
-            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in Cgi/confirm.py in GNU Mailman 2.1.14 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) full name or (2) username field in a confirmation message.",
-            "cve": "CVE-2011-0707",
-            "id": "pyup.io-25879",
+            "advisory": "In mxnet before 1.0.0, mxnet listens on all available interfaces when running training in distributed mode.",
+            "cve": "PVE-2021-35115",
+            "id": "pyup.io-35115",
             "specs": [
-                "<2.1.14"
+                "<1.0.0"
             ],
-            "v": "<2.1.14"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in GNU Mailman before 2.1.14rc1 allow remote authenticated users to inject arbitrary web script or HTML via vectors involving (1) the list information field or (2) the list description field.",
-            "cve": "CVE-2010-3089",
-            "id": "pyup.io-25880",
+            "advisory": "Mxnet between versions 1.4.0 and 1.6.0 (included) use a version of 'log4j' affected by critical and severe vulnerabilities.",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43442",
             "specs": [
-                "<2.1.14rc1"
+                ">=1.4.0,<=1.6.0"
             ],
-            "v": "<2.1.14rc1"
+            "v": ">=1.4.0,<=1.6.0"
         },
         {
-            "advisory": "Directory traversal vulnerability in GNU Mailman before 2.1.20, when not using a static alias, allows remote attackers to execute arbitrary files via a .. (dot dot) in a list name.",
-            "cve": "CVE-2015-2775",
-            "id": "pyup.io-25881",
+            "advisory": "Mxnet between versions 1.4.0 and 1.6.0 (included) use a version of 'log4j' affected by critical and severe vulnerabilities.",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-43449",
             "specs": [
-                "<2.1.20"
+                ">=1.4.0,<=1.6.0"
             ],
-            "v": "<2.1.20"
+            "v": ">=1.4.0,<=1.6.0"
         },
         {
-            "advisory": "Unspecified vulnerability in Mailman before 2.1.28 has unknown impact and attack vectors.",
-            "cve": "CVE-2018-13796",
-            "id": "pyup.io-36319",
+            "advisory": "Mxnet between versions 1.4.0 and 1.6.0 (included) use a version of 'log4j' affected by critical and severe vulnerabilities.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44455",
             "specs": [
-                "<2.1.28"
+                ">=1.4.0,<=1.6.0"
             ],
-            "v": "<2.1.28"
+            "v": ">=1.4.0,<=1.6.0"
         },
         {
-            "advisory": "Cross-site scripting vulnerability in Mailman 2.1.26 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.",
-            "cve": "CVE-2018-0618",
-            "id": "pyup.io-36348",
+            "advisory": "Mxnet between versions 1.4.0 and 1.6.0 (included) use a version of 'log4j' affected by critical and severe vulnerabilities.",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43448",
             "specs": [
-                "<=2.1.26"
+                ">=1.4.0,<=1.6.0"
             ],
-            "v": "<=2.1.26"
+            "v": ">=1.4.0,<=1.6.0"
         }
     ],
-    "mako": [
+    "mypwd": [
         {
-            "advisory": "Mako before 0.3.4 relies on the cgi.escape function in the Python standard library for cross-site scripting (XSS) protection, which makes it easier for remote attackers to conduct XSS attacks via vectors involving single-quote characters and a JavaScript onLoad event handler for a BODY element.",
-            "cve": "CVE-2010-2480",
-            "id": "pyup.io-25882",
+            "advisory": "Mypwd 0.4.0 includes security improvements related to data validation.",
+            "cve": "PVE-2021-41990",
+            "id": "pyup.io-41990",
             "specs": [
-                "<0.3.4"
+                "<0.4.0"
             ],
-            "v": "<0.3.4"
+            "v": "<0.4.0"
         }
     ],
-    "manifest-tool": [
+    "mysql-connector": [
         {
-            "advisory": "Manifest-tool 2.0.0 adds an option to sign candidate image using update private key, allowing to implement secure boot on a device side.",
-            "cve": "PVE-2021-38628",
-            "id": "pyup.io-38628",
+            "advisory": "Unspecified vulnerability in the MySQL Connector component 2.1.3 and earlier and 2.0.4 and earlier in Oracle MySQL allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Connector/Python.",
+            "cve": "CVE-2016-5598",
+            "id": "pyup.io-25900",
             "specs": [
-                "<2.0.0"
+                "<2.1.3"
+            ],
+            "v": "<2.1.3"
+        }
+    ],
+    "mysql-connector-python": [
+        {
+            "advisory": "Unspecified vulnerability in the MySQL Connector component 2.1.3 and earlier and 2.0.4 and earlier in Oracle MySQL allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Connector/Python.",
+            "cve": "CVE-2016-5598",
+            "id": "pyup.io-25901",
+            "specs": [
+                "<2.0.4"
+            ],
+            "v": "<2.0.4"
+        },
+        {
+            "advisory": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data.",
+            "cve": "CVE-2019-2435",
+            "id": "pyup.io-36816",
+            "specs": [
+                "<=8.0.13"
+            ],
+            "v": "<=8.0.13"
+        }
+    ],
+    "naas": [
+        {
+            "advisory": "Naas 1.17.15 updates its dependency naas-drivers to version 0.66.7. That version of naas-drivers includes a security fix: adds sensitive for randint.",
+            "cve": "PVE-2021-41245",
+            "id": "pyup.io-41245",
+            "specs": [
+                "<1.17.15"
             ],
-            "v": "<2.0.0"
-        }
-    ],
-    "manila": [
+            "v": "<1.17.15"
+        },
         {
-            "advisory": "OpenStack Manila <7.4.1, >=8.0.0 <8.1.1, and >=9.0.0 <9.1.1 allows attackers to view, update, delete, or share resources that do not belong to them, because of a context-free lookup of a UUID. Attackers may also create resources, such as shared file systems and groups of shares on such share networks. See: CVE-2020-9543.",
-            "cve": "CVE-2020-9543",
-            "id": "pyup.io-38052",
+            "advisory": "Naas 1.5.22 includes a security issue fix.",
+            "cve": "PVE-2021-40076",
+            "id": "pyup.io-40076",
             "specs": [
-                "<7.4.1",
-                ">=8.0.0,<8.1.1",
-                ">=9.0.0,<9.1.1"
+                "<1.5.22"
             ],
-            "v": "<7.4.1,>=8.0.0,<8.1.1,>=9.0.0,<9.1.1"
+            "v": "<1.5.22"
         }
     ],
-    "mantissa": [
+    "naas-drivers": [
         {
-            "advisory": "mantissa before 0.6.14 in xmantissa.webtheme allows access to arbitrary filesystem contents.",
-            "cve": "PVE-2021-25883",
-            "id": "pyup.io-25883",
+            "advisory": "Naas-drivers 0.66.7 adds sensitive for randint. This is a security measure.",
+            "cve": "PVE-2021-40871",
+            "id": "pyup.io-40871",
             "specs": [
-                "<0.6.14"
+                "<0.66.7"
             ],
-            "v": "<0.6.14"
+            "v": "<0.66.7"
         }
     ],
-    "markdown2": [
+    "nanopb": [
         {
-            "advisory": "Python-markdown2 before 1.0.1.14 has multiple cross-site scripting (XSS) issues. See CVE-2009-3724.",
-            "cve": "CVE-2009-3724",
-            "id": "pyup.io-37735",
+            "advisory": "Nanopb 0.2.8 fixes a security issue with PB_ENABLE_MALLOC.",
+            "cve": "PVE-2021-37705",
+            "id": "pyup.io-37705",
             "specs": [
-                "<1.0.1.14"
+                "<0.2.8"
             ],
-            "v": "<1.0.1.14"
+            "v": "<0.2.8"
         },
         {
-            "advisory": "markdown2 before 1.0.1.14 has a security hole in the md5-hashing scheme for handling HTML  chunks during processing.",
-            "cve": "PVE-2021-25884",
-            "id": "pyup.io-25884",
+            "advisory": "Nanopb 0.2.9.1 fixes a security issue due to size_t overflows.",
+            "cve": "PVE-2021-37808",
+            "id": "pyup.io-37808",
             "specs": [
-                "<1.0.1.14"
+                "<0.2.9.1"
             ],
-            "v": "<1.0.1.14"
+            "v": "<0.2.9.1"
         },
         {
-            "advisory": "An issue was discovered in markdown2 (aka python-markdown2) through 2.3.5. The safe_mode feature, which is supposed to sanitize user input against XSS, is flawed and does not escape the input properly. With a crafted payload, XSS can be triggered, as demonstrated by omitting the final '>' character from an IMG tag.",
-            "cve": "CVE-2018-5773",
-            "id": "pyup.io-35760",
+            "advisory": "Nanopb before 0.3.1 fixes a security issue due to size_t overflows.",
+            "cve": "PVE-2021-37704",
+            "id": "pyup.io-37704",
             "specs": [
-                "<2.3.5"
+                "<0.3.1"
             ],
-            "v": "<2.3.5"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \\w+ match succeeds. For example, an attack might use elementname@ or elementname- with an onclick attribute.",
-            "cve": "CVE-2020-11888",
-            "id": "pyup.io-38198",
+            "advisory": "Nanopb 0.2.9.1 and 0.3.1 fix a security issue due to size_t overflows (issue 132).",
+            "cve": "PVE-2021-37706",
+            "id": "pyup.io-37706",
             "specs": [
-                "<=2.3.8"
+                ">=0.3.0,<0.3.1",
+                ">=0.2.0,<0.2.9.1"
             ],
-            "v": "<=2.3.8"
-        },
+            "v": ">=0.3.0,<0.3.1,>=0.2.0,<0.2.9.1"
+        }
+    ],
+    "natcap.invest": [
         {
-            "advisory": "markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability. If an attacker provides a malicious string, it can make markdown2 processing difficult or delayed for an extended period of time. See CVE-2021-26813.",
-            "cve": "CVE-2021-26813",
-            "id": "pyup.io-39670",
+            "advisory": "Natcap.invest 3.8.1 bumps the psutil dependency requirement to psutil>=5.6.6 to address a double-free vulnerability documented in CVE-2019-18874.",
+            "cve": "CVE-2019-18874",
+            "id": "pyup.io-38271",
             "specs": [
-                ">=1.0.1.18,<2.4.0"
+                "<3.8.1"
             ],
-            "v": ">=1.0.1.18,<2.4.0"
+            "v": "<3.8.1"
         }
     ],
-    "marshmallow": [
+    "nautilus-trader": [
         {
-            "advisory": "marshmallow 2.15.1 fixes behavior when an empty list is passed as the ``only`` argument. (CVE-2018-17175)",
-            "cve": "CVE-2018-17175",
-            "id": "pyup.io-36499",
+            "advisory": "Nautilus-trader 1.137.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22817",
+            "id": "pyup.io-44601",
             "specs": [
-                "<2.15.1",
-                "==3.0.0a1",
-                "==3.0.0b1",
-                "==3.0.0b2",
-                "==3.0.0b3",
-                "==3.0.0b4",
-                "==3.0.0b5",
-                "==3.0.0b6",
-                "==3.0.0b7",
-                "==3.0.0b8"
+                "<1.137.1"
             ],
-            "v": "<2.15.1,==3.0.0a1,==3.0.0b1,==3.0.0b2,==3.0.0b3,==3.0.0b4,==3.0.0b5,==3.0.0b6,==3.0.0b7,==3.0.0b8"
+            "v": "<1.137.1"
         },
         {
-            "advisory": "In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema \"only\" option treats an empty list as implying no \"only\" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the \"only\" option, and there is a user role that produces an empty value for \"only\").",
-            "cve": "CVE-2018-17175",
-            "id": "pyup.io-36496",
+            "advisory": "Nautilus-trader 1.137.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22816",
+            "id": "pyup.io-44602",
             "specs": [
-                "<2.15.1,>3.0.0,<3.0.0b9"
+                "<1.137.1"
             ],
-            "v": "<2.15.1,>3.0.0,<3.0.0b9"
-        }
-    ],
-    "martypy": [
+            "v": "<1.137.1"
+        },
         {
-            "advisory": "martypy 1.2 requests security issues in `requests` and `urllib3` dependencies",
-            "cve": "PVE-2021-36739",
-            "id": "pyup.io-36739",
+            "advisory": "Nautilus-trader 1.137.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22815",
+            "id": "pyup.io-44603",
             "specs": [
-                "<1.2"
+                "<1.137.1"
             ],
-            "v": "<1.2"
-        }
-    ],
-    "masonite": [
+            "v": "<1.137.1"
+        },
         {
-            "advisory": "Masonite 2.3.25 improves requests checking to add CSRF headers.\r\nhttps://github.com/MasoniteFramework/masonite/commit/9f8b326a209be2b8cf5b0208dc8c69ebd5dd6a97",
-            "cve": "PVE-2021-43626",
-            "id": "pyup.io-43626",
+            "advisory": "Nautilus-trader 1.137.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2021-44525",
+            "id": "pyup.io-44562",
             "specs": [
-                "<2.3.25"
+                "<1.137.1"
             ],
-            "v": "<2.3.25"
+            "v": "<1.137.1"
         },
         {
-            "advisory": "Masonite 3.0.5 improves requests checking to add CSRF headers.\r\nhttps://github.com/MasoniteFramework/masonite/commit/9e48f134539659b9438ae91cd930b38c7ca76847",
-            "cve": "PVE-2021-43625",
-            "id": "pyup.io-43625",
+            "advisory": "Nautilus-trader 1.137.1 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2022-44524",
+            "id": "pyup.io-44600",
             "specs": [
-                "<3.0.5"
+                "<1.137.1"
             ],
-            "v": "<3.0.5"
+            "v": "<1.137.1"
         }
     ],
-    "masz": [
+    "nba-scraper": [
         {
-            "advisory": "Masz 1.11.5 fixes dependency vulnerabilities.",
-            "cve": "PVE-2021-41058",
-            "id": "pyup.io-41058",
+            "advisory": "Nba-scraper 0.2.7 removes a security flaw where it wasn't verifying SSL certificates during testing.",
+            "cve": "PVE-2021-37142",
+            "id": "pyup.io-37142",
             "specs": [
-                "<1.11.5"
+                "<0.2.7"
             ],
-            "v": "<1.11.5"
-        },
+            "v": "<0.2.7"
+        }
+    ],
+    "nbgitpuller": [
         {
-            "advisory": "Masz 1.8.1 improves filesystem security.",
-            "cve": "PVE-2021-40625",
-            "id": "pyup.io-40625",
+            "advisory": "Nbgitpuller version 0.10.2 includes a fix for CVE-2021-39160:\r\nDue to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. No workaround exists for users who can not upgrade.",
+            "cve": "CVE-2021-39160",
+            "id": "pyup.io-41221",
             "specs": [
-                "<1.8.1"
+                "<0.10.2"
             ],
-            "v": "<1.8.1"
+            "v": "<0.10.2"
         }
     ],
-    "matlabreport": [
+    "nbgrader": [
         {
-            "advisory": "Matlabreport version 0.6.0 includes a security patch for the function 'makeReport' in 'matlabreport/makereport.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/ahoetker/matlabreport/commit/31fccc6076457d0212b624a1da79515801ae39c2",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41336",
+            "advisory": "Nbgrader 0.6.0 includes instructions for how to do grading inside a Docker container, for increased protection against malicious code submitted by students.",
+            "cve": "PVE-2021-40419",
+            "id": "pyup.io-40419",
             "specs": [
                 "<0.6.0"
             ],
             "v": "<0.6.0"
         }
     ],
-    "matrix-registration": [
+    "nbsafety": [
         {
-            "advisory": "Matrix-registration 0.7.1 updates the waitress dependency because versions below 1.4.2 contain a vulnerability. See CVE-2019-16789.",
-            "cve": "CVE-2019-16789",
-            "id": "pyup.io-39271",
+            "advisory": "Nbsafety 0.0.69 includes minor security fixes in underlying NPM packages.",
+            "cve": "PVE-2021-40540",
+            "id": "pyup.io-40540",
             "specs": [
-                "<0.7.1"
+                "<0.0.69"
             ],
-            "v": "<0.7.1"
-        }
-    ],
-    "matrix-sydent": [
+            "v": "<0.0.69"
+        },
         {
-            "advisory": "util/emailutils.py in Matrix Sydent before 1.0.2 mishandles registration restrictions that are based on e-mail domain, if the allowed_local_3pids option is enabled. This occurs because of potentially unwanted behavior in Python, in which an email.utils.parseaddr call on user@bad.example.net@good.example.com returns the user@bad.example.net substring. See: CVE-2019-11340.",
-            "cve": "CVE-2019-11340",
-            "id": "pyup.io-37073",
+            "advisory": "Nbsafety version 0.0.75 updates its frontend dependencies to more secure versions.",
+            "cve": "PVE-2021-41796",
+            "id": "pyup.io-41796",
             "specs": [
-                "<1.0.2"
+                "<0.0.75"
             ],
-            "v": "<1.0.2"
-        },
+            "v": "<0.0.75"
+        }
+    ],
+    "ncbimeta": [
         {
-            "advisory": "Sydent is a reference Matrix identity server. Sydent does not limit the size of requests it receives from HTTP clients. A malicious user could send an HTTP request with a very large body, leading to memory exhaustion and denial of service. Sydent also does not limit response size for requests it makes to remote Matrix homeservers. A malicious homeserver could return a very large response, again leading to memory exhaustion and denial of service. This affects any server which accepts registration requests from untrusted clients. This issue has been patched by releases 89071a1, 0523511, f56eee3. As a workaround request sizes can be limited in an HTTP reverse-proxy. There are no known workarounds for the problem with overlarge responses.",
-            "cve": "CVE-2021-29430",
-            "id": "pyup.io-42308",
+            "advisory": "Ncbimeta 0.8.0 updates the 'lxml' dependency to v4.6.2 due to a security vulnerability.",
+            "cve": "CVE-2020-27783",
+            "id": "pyup.io-40508",
             "specs": [
-                "<2.3.0"
+                "<0.8.0"
             ],
-            "v": "<2.3.0"
-        },
+            "v": "<0.8.0"
+        }
+    ],
+    "ndn-svs": [
         {
-            "advisory": "Sydent is a reference Matrix identity server. Sydent can be induced to send HTTP GET requests to internal systems, due to lack of parameter validation or IP address blacklisting. It is not possible to exfiltrate data or control request headers, but it might be possible to use the attack to perform an internal port enumeration. This issue has been addressed in in 9e57334, 8936925, 3d531ed, 0f00412. A potential workaround would be to use a firewall to ensure that Sydent cannot reach internal HTTP resources.",
-            "cve": "CVE-2021-29431",
-            "id": "pyup.io-42309",
+            "advisory": "Ndn-svs 0.3.13 starts signing/verifying balancer data packets to prevent forgery.\r\nhttps://github.com/justincpresley/ndn-python-svs/commit/933d5d99e8d51d7c92a2fc7d1d176b8c03475ac0",
+            "cve": "PVE-2022-44449",
+            "id": "pyup.io-44449",
             "specs": [
-                "<2.3.0"
+                "<0.3.13"
             ],
-            "v": "<2.3.0"
-        },
+            "v": "<0.3.13"
+        }
+    ],
+    "nearbeach": [
         {
-            "advisory": "Sydent is a reference matrix identity server. A malicious user could abuse Sydent to send out arbitrary emails from the Sydent email address. This could be used to construct plausible phishing emails, for example. This issue has been fixed in 4469d1d.",
-            "cve": "CVE-2021-29432",
-            "id": "pyup.io-42310",
+            "advisory": "Nearbeach 0.22.1 fixes several security issues in relation to Bandit, identified by Nearbeach as BUG491, BUG492, BUG493, BUG494, BUG495, BUG496, BUG497, and BUG498.",
+            "cve": "PVE-2021-37602",
+            "id": "pyup.io-37602",
             "specs": [
-                "<2.3.0"
+                "<0.22.1"
             ],
-            "v": "<2.3.0"
+            "v": "<0.22.1"
         }
     ],
-    "matrix-synapse": [
+    "nemo": [
         {
-            "advisory": "Synapse 1.28.0 includes a fix for CVE-2021-21392: In Synapse before version 1.28.0 requests to user provided domains were not restricted to external IP addresses when using transitional IPv6 addresses. Outbound requests to federation, identity servers, when calculating the key validity for third-party invite events, sending push notifications, and generating URL previews are affected. This could cause Synapse to make requests to internal infrastructure on dual-stack networks.\r\nhttps://github.com/matrix-org/synapse/security/advisories/GHSA-5wrh-4jwv-5w78",
-            "cve": "CVE-2021-21392",
-            "id": "pyup.io-42303",
+            "advisory": "Nemo 2.3.3 updates the 'Django' dependency to v2.2.13 to include security fixes.",
+            "cve": "CVE-2020-13596",
+            "id": "pyup.io-43665",
             "specs": [
-                "<1.28.0"
+                "<2.3.3"
             ],
-            "v": "<1.28.0"
+            "v": "<2.3.3"
         },
         {
-            "advisory": "Matrix-synapse 1.33.2 includes a fix for CVE-2021-29471: Synapse is a Matrix reference homeserver written in python (pypi package matrix-synapse). Matrix is an ecosystem for open federated Instant Messaging and VoIP. In Synapse before version 1.33.2 \"Push rules\" can specify conditions under which they will match, including `event_match`, which matches event content against a pattern including wildcards. Certain patterns can cause very poor performance in the matching engine, leading to a denial-of-service when processing moderate length events. The issue is patched in version 1.33.2. A potential workaround might be to prevent users from making custom push rules, by blocking such requests at a reverse-proxy.",
-            "cve": "CVE-2021-29471",
-            "id": "pyup.io-40438",
+            "advisory": "Nemo 2.3.3 updates the 'Django' dependency to v2.2.13 to include security fixes.",
+            "cve": "CVE-2020-13254",
+            "id": "pyup.io-43666",
             "specs": [
-                "<1.33.2"
+                "<2.3.3"
             ],
-            "v": "<1.33.2"
+            "v": "<2.3.3"
         },
         {
-            "advisory": "Matrix-synapse 1.47.1 includes a fix for CVE-2021-41281: Prior to version 1.47.1, Synapse instances with the media repository enabled can be tricked into downloading a file from a remote server into an arbitrary directory. No authentication is required for the affected endpoint. The last 2 directories and file name of the path are chosen randomly by Synapse and cannot be controlled by an attacker, which limits the impact. Homeservers with the media repository disabled are unaffected. Homeservers with a federation whitelist are also unaffected, since Synapse will check the remote hostname, including the trailing '../'s, against the whitelist. Server administrators using a reverse proxy could, at the expense of losing media functionality, may block the certain endpoints as a workaround. Alternatively, non-containerized deployments can be adapted to use the hardened systemd config.\r\nhttps://github.com/matrix-org/synapse/security/advisories/GHSA-3hfw-x7gx-437c",
-            "cve": "CVE-2021-41281",
-            "id": "pyup.io-42808",
+            "advisory": "Nemo 2.3.3 updates the 'Django' dependency to v2.2.13 to include security fixes.",
+            "cve": "CVE-2020-9402",
+            "id": "pyup.io-40131",
             "specs": [
-                "<1.47.1"
+                "<2.3.3"
             ],
-            "v": "<1.47.1"
+            "v": "<2.3.3"
         },
         {
-            "advisory": "Synapse 1.28.0 includes a fix for CVE-2021-21393. Missing input validation of some parameters on the groups (also known as communities) endpoints could cause excessive use of disk space and memory leading to resource exhaustion. Additionally clients may have issues rendering large fields.\r\nhttps://github.com/matrix-org/synapse/security/advisories/GHSA-jrh7-mhhx-6h88",
-            "cve": "CVE-2021-21393",
-            "id": "pyup.io-42304",
+            "advisory": "Nemo 3.6.0 updates the 'cryptography' dependency due to vulnerability in the previous version.",
+            "cve": "PVE-2021-40130",
+            "id": "pyup.io-40130",
             "specs": [
-                ">0.24.0,<1.28.0"
+                "<3.6.0"
             ],
-            "v": ">0.24.0,<1.28.0"
+            "v": "<3.6.0"
         },
         {
-            "advisory": "Synapse 1.28.0 includes a fix for CVE-2021-21394: Synapse before version 1.28.0 is missing input validation of some parameters on the endpoints used to confirm third-party identifiers. The bug could be used to cause excessive use of disk space and memory, leading to resource exhaustion. Note that the groups feature is not part of the Matrix specification and the chosen maximum lengths are arbitrary.\r\nhttps://github.com/matrix-org/synapse/security/advisories/GHSA-w9fg-xffh-p362",
-            "cve": "CVE-2021-21394",
-            "id": "pyup.io-42305",
+            "advisory": "Nemo 3.8.0 updates the 'cryptography' dependency due to vulnerability in the previous version.",
+            "cve": "PVE-2021-40129",
+            "id": "pyup.io-40129",
             "specs": [
-                ">=0.17.0,<1.28.0"
+                "<3.8.0"
             ],
-            "v": ">=0.17.0,<1.28.0"
-        }
-    ],
-    "matrixctl": [
+            "v": "<3.8.0"
+        },
         {
-            "advisory": "Matrixctl 0.10.0 starts to use secure, temporary directory for ansible_runner's private data.",
-            "cve": "PVE-2021-40785",
-            "id": "pyup.io-40785",
+            "advisory": "Nemo 3.9.2 updates its dependency 'Django' to v2.2.20 to include a security fix.",
+            "cve": "CVE-2021-28658",
+            "id": "pyup.io-40184",
             "specs": [
-                "<0.10.0"
+                "<3.9.2"
             ],
-            "v": "<0.10.0"
+            "v": "<3.9.2"
         }
     ],
-    "matthisk-httpsig": [
+    "neo-python": [
         {
-            "advisory": "matthisk-httpsig before 1.0.0 allowed reading keyfiles from disk as this is a huge security hole if this is used in a server framework like drf-httpsig.",
-            "cve": "PVE-2021-25886",
-            "id": "pyup.io-25886",
+            "advisory": "neo-python 0.7.8 fixes vulnerability to RPC invoke functionality that can send node into unclosed loop during 'test' invokes.",
+            "cve": "PVE-2021-36441",
+            "id": "pyup.io-36441",
             "specs": [
-                "<1.0.0"
+                "<0.7.8"
             ],
-            "v": "<1.0.0"
+            "v": "<0.7.8"
         }
     ],
-    "mautrix-telegram": [
+    "neomodel": [
         {
-            "advisory": "Mautrix-telegram 0.6.0 fixes a vulnerability in event handling.",
-            "cve": "PVE-2021-37432",
-            "id": "pyup.io-37432",
+            "advisory": "Neomodel 4.0.5 fixes issue with enforcing secure URI scheme (+s).",
+            "cve": "PVE-2021-41773",
+            "id": "pyup.io-41773",
             "specs": [
-                "<0.6.0"
+                "<4.0.5"
             ],
-            "v": "<0.6.0"
+            "v": "<4.0.5"
         }
     ],
-    "maxminddb": [
+    "nepse-api": [
         {
-            "advisory": "maxminddb 1.1.2 includes a number of important security fixes. Among these fixes is improved validation of the database metadata. Unfortunately,  MaxMind GeoIP2 and GeoLite2 databases created earlier than January 28, 2014  had an invalid data type for the `record_size` in the metadata. Previously these databases worked on little endian machines with libmaxminddb but did not work on big endian machines. Due to increased safety checks when reading the file, these databases will no longer work on any platform. If you are using one of these databases, we recommend that you upgrade to the latest GeoLite2 or GeoIP2 database",
-            "cve": "PVE-2021-25887",
-            "id": "pyup.io-25887",
+            "advisory": "Nepse-api 0.3 discontinues the use of a non-maintainable 'converter.py' in 'nepse/security', the response data is now directly kept in a dataclass using 'DataClassXyz(**data)'.",
+            "cve": "PVE-2021-40589",
+            "id": "pyup.io-40589",
             "specs": [
-                "<1.1.2"
+                "<0.3"
             ],
-            "v": "<1.1.2"
+            "v": "<0.3"
         }
     ],
-    "mayan-edms": [
+    "netdumplings": [
         {
-            "advisory": "Mayan-edms versions before 3.0.2 are affected by CVE-2018-16406:\r\nThe Cabinets app has XSS via a crafted cabinet label.\r\nhttps://gitlab.com/mayan-edms/mayan-edms/blob/master/HISTORY.rst\r\nhttps://gitlab.com/mayan-edms/mayan-edms/commit/48dfc06e49c7f773749e063f8cc69c95509d1c32\r\nhttps://gitlab.com/mayan-edms/mayan-edms/issues/495",
-            "cve": "CVE-2018-16406",
-            "id": "pyup.io-41710",
+            "advisory": "Netdumplings 0.4.0 updates the websockets dependency to v7.0.0 to include a security fix.",
+            "cve": "CVE-2018-1000518",
+            "id": "pyup.io-37208",
             "specs": [
-                "<3.0.2"
+                "<0.4.0"
             ],
-            "v": "<3.0.2"
+            "v": "<0.4.0"
         },
         {
-            "advisory": "Mayan-edms versions before 3.0.2 are affected by CVE-2018-16405:\r\nThe Appearance app sets window.location directly, leading to XSS.\r\nhttps://gitlab.com/mayan-edms/mayan-edms/blob/master/HISTORY.rst\r\nhttps://gitlab.com/mayan-edms/mayan-edms/commit/9ebe80595afe4fdd1e2c74358d6a9421f4ce130e\r\nhttps://gitlab.com/mayan-edms/mayan-edms/issues/494",
-            "cve": "CVE-2018-16405",
-            "id": "pyup.io-41709",
+            "advisory": "Netdumplings 0.4.0 updates 'scapy' dependency minimum version to v2.4.2 to include a security fix.",
+            "cve": "CVE-2019-1010142",
+            "id": "pyup.io-44623",
             "specs": [
-                "<3.0.2"
+                "<0.4.0"
             ],
-            "v": "<3.0.2"
-        },
+            "v": "<0.4.0"
+        }
+    ],
+    "netfoundry": [
         {
-            "advisory": "Mayan-edms versions before 3.0.3 are affected by CVE-2018-16407:\r\nThe Tags app has XSS because tag label values are mishandled.\r\nhttps://gitlab.com/mayan-edms/mayan-edms/blob/master/HISTORY.rst\r\nhttps://gitlab.com/mayan-edms/mayan-edms/commit/076468a9225e4630a463c0bbceb8e5b805fe380c\r\nhttps://gitlab.com/mayan-edms/mayan-edms/issues/496",
-            "cve": "CVE-2018-16407",
-            "id": "pyup.io-41711",
+            "advisory": "Netfoundry 4.19.0 fixes a rake vulnerability in the `.gemspec` file.",
+            "cve": "PVE-2021-39082",
+            "id": "pyup.io-39082",
             "specs": [
-                "<3.0.3"
+                "<4.19.0"
             ],
-            "v": "<3.0.3"
+            "v": "<4.19.0"
         }
     ],
-    "md4c": [
+    "netius": [
         {
-            "advisory": "Md4c (Python bindings) v1.0.0 includes a fix for 'ISANYOF' macro, which is vulnerable in md4c main package versions before 0.4.6: The mentioned macro could provide unexpected results when encountering zero byte in the input text; in some cases leading to broken internal state of the parser. The bug could result in a denial of service and possibly also in other security implications.\r\nhttps://github.com/mity/md4c/issues/130",
-            "cve": "PVE-2021-42027",
-            "id": "pyup.io-42027",
+            "advisory": "netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks. See: CVE-2020-7655.",
+            "cve": "CVE-2020-7655",
+            "id": "pyup.io-38316",
             "specs": [
-                "<1.0.0"
+                "<1.17.58"
             ],
-            "v": "<1.0.0"
+            "v": "<1.17.58"
         }
     ],
-    "mdbackup": [
+    "netviel": [
         {
-            "advisory": "Mdbackup 0.2.0 comes with some bug fixes that made the utility more secure. It introduces the ``Vault secret backend``, where important data (like passwords) can be stored, and the ``File secret backend`` (a fallback secret backend) where secrets are read from the file system directly.",
-            "cve": "PVE-2021-37725",
-            "id": "pyup.io-37725",
+            "advisory": "Netviel 0.2 fixes security vulnerabilities. No details were provided.",
+            "cve": "PVE-2021-38366",
+            "id": "pyup.io-38366",
             "specs": [
-                "<0.2.0"
+                "<0.2"
             ],
-            "v": "<0.2.0"
+            "v": "<0.2"
         }
     ],
-    "mdcatch": [
+    "neuromynerva": [
         {
-            "advisory": "Mdcatch 0.9.1 increases security by removing \"shell=True\".\r\nhttps://github.com/azazellochg/MDCatch/pull/14/commits/c4a6551cdd80d3f3bb9a76bc9e2ee08fcab2e818",
-            "cve": "PVE-2021-38433",
-            "id": "pyup.io-38433",
+            "advisory": "Neuromynerva version 0.2.12 updates its dependencies to include security fixes.",
+            "cve": "PVE-2021-41797",
+            "id": "pyup.io-41797",
             "specs": [
-                "<0.9.1"
+                "<0.2.12"
             ],
-            "v": "<0.9.1"
+            "v": "<0.2.12"
         }
     ],
-    "mega.py": [
+    "neutron": [
         {
-            "advisory": "Mega.py 3.6.2 includes SMS verification for enhanced security.",
-            "cve": "PVE-2021-37617",
-            "id": "pyup.io-37617",
+            "advisory": "OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. See CVE-2021-38598.\r\nhttps://launchpad.net/bugs/1938670",
+            "cve": "CVE-2021-38598",
+            "id": "pyup.io-41207",
             "specs": [
-                "<3.6.2"
+                "<16.4.1",
+                ">=17.0.0.0rc1,<17.1.3",
+                "==18.0.0"
             ],
-            "v": "<3.6.2"
-        }
-    ],
-    "megalib": [
+            "v": "<16.4.1,>=17.0.0.0rc1,<17.1.3,==18.0.0"
+        },
         {
-            "advisory": "Megalib 0.9.5alpha updates requirements.txt to fix a vulnerability.",
-            "cve": "PVE-2021-37099",
-            "id": "pyup.io-37099",
+            "advisory": "Neutron 16.4.1, 17.2.1 and 18.1.1 include a fix for CVE-2021-40085: An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.\r\nhttps://www.openwall.com/lists/oss-security/2021/08/31/2",
+            "cve": "CVE-2021-40085",
+            "id": "pyup.io-41251",
             "specs": [
-                "<0.9.5alpha"
+                "<16.4.1",
+                ">=17.0.0.0rc1,<17.2.1",
+                ">=18.0.0.0rc1,<18.1.1"
             ],
-            "v": "<0.9.5alpha"
-        }
-    ],
-    "mei2volpiano": [
+            "v": "<16.4.1,>=17.0.0.0rc1,<17.2.1,>=18.0.0.0rc1,<18.1.1"
+        },
         {
-            "advisory": "Mei2volpiano version 0.8.0 includes the function secure_volpiano() to validate volpiano inputs.",
-            "cve": "PVE-2021-42005",
-            "id": "pyup.io-42005",
+            "advisory": "An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service. See CVE-2021-40797. \r\nhttps://launchpad.net/bugs/1942179",
+            "cve": "CVE-2021-40797",
+            "id": "pyup.io-41285",
             "specs": [
-                "<0.8.0"
+                "<16.4.1",
+                ">=17.0.0.0rc1,<17.2.1",
+                ">=18.0.0.0rc1,<18.1.1"
             ],
-            "v": "<0.8.0"
+            "v": "<16.4.1,>=17.0.0.0rc1,<17.2.1,>=18.0.0.0rc1,<18.1.1"
+        },
+        {
+            "advisory": "An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected. See: CVE-2019-10876.",
+            "cve": "CVE-2019-10876",
+            "id": "pyup.io-37022",
+            "specs": [
+                ">=11.0,<11.0.7",
+                ">=12.0,<12.0.6",
+                ">=13.0,<13.0.3"
+            ],
+            "v": ">=11.0,<11.0.7,>=12.0,<12.0.6,>=13.0,<13.0.3"
+        },
+        {
+            "advisory": "A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.",
+            "cve": "CVE-2021-20267",
+            "id": "pyup.io-40569",
+            "specs": [
+                ">=15.3.0a1,<15.3.3",
+                ">=16.3.0a1,<16.3.1",
+                ">=17.1.0a1,<17.1.1"
+            ],
+            "v": ">=15.3.0a1,<15.3.3,>=16.3.0a1,<16.3.1,>=17.1.0a1,<17.1.1"
         }
     ],
-    "meinheld": [
+    "newrelic": [
         {
-            "advisory": "Meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Content-Length and Transfer encoding header parsing. See: CVE-2020-7658.",
-            "cve": "CVE-2020-7658",
-            "id": "pyup.io-38317",
+            "advisory": "New Relic agents run explain plans for Slow Transaction Traces and Slow SQL Queries. Previous versions of the agents would run an explain plan on the SQL query by prepending the query with explain. This may cause an issue when there are multiple statements separated by semicolons in a single query. The first statement in the string returns its explain plan, but any subsequent statement after that may execute as a general SQL statement. Depending on the language, library, and database, the agent may return the results of the additional statements to New Relic. It is also possible that the additional statements could execute an additional INSERT or UPDATE command. With this security update, New Relic agents will no longer run explain plans on any query that contains a semicolon as a statement separator.",
+            "cve": "PVE-2021-35805",
+            "id": "pyup.io-35805",
             "specs": [
-                "<1.0.2"
+                ">=1.1.0.192,<=2.106.0.87"
             ],
-            "v": "<1.0.2"
+            "v": ">=1.1.0.192,<=2.106.0.87"
         }
     ],
-    "mercurial": [
+    "newsletter": [
         {
-            "advisory": "In Mercurial before 4.1.3, \"hg serve --stdio\" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.",
-            "cve": "CVE-2017-9462",
-            "id": "pyup.io-35757",
+            "advisory": "newsletter 0.1.17pre in newsletterapp is now more secure by default.  Does not setup default users for admin section.",
+            "cve": "PVE-2021-25902",
+            "id": "pyup.io-25902",
             "specs": [
-                "<4.1.3"
+                "<0.1.17pre"
             ],
-            "v": "<4.1.3"
+            "v": "<0.1.17pre"
         }
     ],
-    "metadataproxy": [
+    "nf-core": [
         {
-            "advisory": "metadataproxy before 1.1.1 has a flaw in the proxy functionality when used in passthrough mode that would expose the host's IAM role credentials when extra paths were added to the end of the security-credentials end-point. metadataproxy will now properly capture any call to iam/security-credentials/<role> and return the scoped credentials, rather than the host's credentials.",
-            "cve": "PVE-2021-25888",
-            "id": "pyup.io-25888",
+            "advisory": "Nf-core 1.7 uses yaml.safe_load() to fix a code execution vulnerability.\r\nhttps://github.com/nf-core/tools/commit/8946dc988792c844f4018c993fdef5711705b67a",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-43380",
             "specs": [
-                "<1.1.1"
+                "<1.7"
             ],
-            "v": "<1.1.1"
+            "v": "<1.7"
         }
     ],
-    "metpx-sarracenia": [
+    "ngraph-mxnet": [
         {
-            "advisory": "Metpx-sarracenia 2.20.4b2 removes recursion in the connection recovery, which was vulnerable to stack exhaustion on long failures.",
-            "cve": "PVE-2021-38182",
-            "id": "pyup.io-38182",
+            "advisory": "ngraph-mxnet 1.0.0 fixed a security bug that is causing MXNet to listen on all available interfaces when running training in distributed mode.",
+            "cve": "PVE-2021-36701",
+            "id": "pyup.io-36701",
             "specs": [
-                "<2.20.4b2"
+                "<1.0.0"
             ],
-            "v": "<2.20.4b2"
+            "v": "<1.0.0"
         }
     ],
-    "metron-tagger": [
+    "nicegui": [
         {
-            "advisory": "Metron-tagger 1.0.7 uses a more secure SSL context.",
-            "cve": "PVE-2021-38645",
-            "id": "pyup.io-38645",
+            "advisory": "Nicegui 0.7.2 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22815",
+            "id": "pyup.io-44585",
             "specs": [
-                "<1.0.7"
+                "<0.7.2"
             ],
-            "v": "<1.0.7"
-        }
-    ],
-    "mezzanine": [
+            "v": "<0.7.2"
+        },
         {
-            "advisory": "Mezzanine 0.10.5 fixes Ajax in admin not using CSRF token for forms.\r\nhttps://github.com/stephenmcd/mezzanine/commit/2cf8c388305c8121668c186b5a98aa0ec6046c3d",
-            "cve": "PVE-2021-42776",
-            "id": "pyup.io-42776",
+            "advisory": "Nicegui 0.7.2 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22817",
+            "id": "pyup.io-44596",
             "specs": [
-                "<0.10.5"
+                "<0.7.2"
             ],
-            "v": "<0.10.5"
+            "v": "<0.7.2"
         },
         {
-            "advisory": "Mezzanine 0.5.2 adds more robust CSRF protection and applies it to forms too.\r\nhttps://github.com/stephenmcd/mezzanine/commit/6e8decd877516bd18689a41786dbf0f93ca58d08",
-            "cve": "PVE-2021-42778",
-            "id": "pyup.io-42778",
+            "advisory": "Nicegui 0.7.2 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2022-44524",
+            "id": "pyup.io-44598",
             "specs": [
-                "<0.5.2"
+                "<0.7.2"
             ],
-            "v": "<0.5.2"
+            "v": "<0.7.2"
         },
         {
-            "advisory": "Mezzanine 1.4.8 fixes an issue where ACCOUNTS_VERIFICATION_REQUIRED could be bypassed.\r\nhttps://github.com/stephenmcd/mezzanine/issues/691",
-            "cve": "PVE-2021-42775",
-            "id": "pyup.io-42775",
+            "advisory": "Nicegui 0.7.2 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2021-44525",
+            "id": "pyup.io-44597",
             "specs": [
-                "<1.4.8"
+                "<0.7.2"
             ],
-            "v": "<1.4.8"
+            "v": "<0.7.2"
         },
         {
-            "advisory": "mezzanine  4.3.0 fixes a potential security vulnerability in which the password reset url is exposed to untrusted intermediary nodes in the network.",
-            "cve": "PVE-2021-36270",
-            "id": "pyup.io-36270",
+            "advisory": "Nicegui 0.7.2 updates its dependency 'pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22816",
+            "id": "pyup.io-44595",
             "specs": [
-                "<4.3.0"
+                "<0.7.2"
             ],
-            "v": "<4.3.0"
+            "v": "<0.7.2"
         }
     ],
-    "mgp2pdf": [
+    "niche-vlaanderen": [
         {
-            "advisory": "In mgp2pdf before 0.10 `%filter`` is enabled by default which is a security risk.",
-            "cve": "PVE-2021-25889",
-            "id": "pyup.io-25889",
+            "advisory": "Niche-vlaanderen version 1.1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/inbo/niche_vlaanderen/commit/cc1977d54a9267adf58bffbf0c275fb2c39bcfe8#diff-e87949fbb87229b550bad3c2ea146c46e0e1dc785be97a055eb067b3b3ec874b",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41352",
             "specs": [
-                "<0.10"
+                "<1.1"
             ],
-            "v": "<0.10"
+            "v": "<1.1"
         }
     ],
-    "mi": [
+    "nidaqmx": [
         {
-            "advisory": "Mi 0.2 adds ACL-based security.",
-            "cve": "PVE-2021-37998",
-            "id": "pyup.io-37998",
+            "advisory": "Nidaqmx 0.5.8 updates its dependency 'jinja2' to v2.11.2 to include security fixes.",
+            "cve": "CVE-2019-10906",
+            "id": "pyup.io-44662",
             "specs": [
-                "<0.2"
+                "<0.5.8"
             ],
-            "v": "<0.2"
+            "v": "<0.5.8"
         },
         {
-            "advisory": "mi 0.4.2 changes the default paster template generator to use ``Paste#http`` server rather than ``PasteScript#cherrpy`` server.  The cherrypy server has a security risk in it when ``REMOTE_USER`` is trusted by the downstream application.",
-            "cve": "PVE-2021-37993",
-            "id": "pyup.io-37993",
+            "advisory": "Nidaqmx 0.5.8 updates its dependency 'jinja2' to v2.11.2 to include security fixes.",
+            "cve": "CVE-2020-28493",
+            "id": "pyup.io-44700",
             "specs": [
-                "<0.4.2"
+                "<0.5.8"
             ],
-            "v": "<0.4.2"
+            "v": "<0.5.8"
         },
         {
-            "advisory": "In mi before 1.0a3, the pylons_* paster template used the same string (``your_app_secret_string``) for the ``session.secret`` setting in the  generated ``development.ini``.  This was a security risk if left unchanged  in a project that used one of the templates to produce production applications.  It now uses a randomly generated string.",
-            "cve": "PVE-2021-37982",
-            "id": "pyup.io-37982",
+            "advisory": "Nidaqmx 0.5.8 updates its dependency 'requests' to v2.23.0 to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-44701",
             "specs": [
-                "<1.0a3"
+                "<0.5.8"
             ],
-            "v": "<1.0a3"
+            "v": "<0.5.8"
         },
         {
-            "advisory": "The AuthTktAuthenticationPolicy before mi 1.3a1 did not use a timing-attack-aware string comparator.  See https://github.com/Pylons/pyramid/pull/320 for more info.",
-            "cve": "PVE-2021-37974",
-            "id": "pyup.io-37974",
+            "advisory": "Nidaqmx 0.5.8 updates its dependency 'urllib3' to v1.25.9 to include security fixes.",
+            "cve": "CVE-2020-26137",
+            "id": "pyup.io-44702",
             "specs": [
-                "<1.3a1"
+                "<0.5.8"
             ],
-            "v": "<1.3a1"
+            "v": "<0.5.8"
         },
         {
-            "advisory": "Mi 1.6a1 improves robustness to timing attacks in the ``AuthTktCookieHelper`` and the ``SignedCookieSessionFactory`` classes by using the stdlib's ``hmac.compare_digest`` if it is available (such as Python 2.7.7+ and 3.3+). See: <https://github.com/Pylons/pyramid/pull/1457>. Additionally, it avoids timing attacks against CSRF tokens. See: <https://github.com/Pylons/pyramid/pull/1574>.",
-            "cve": "PVE-2021-38003",
-            "id": "pyup.io-38003",
+            "advisory": "Nidaqmx 0.5.8 updates its dependency 'urllib3' to v1.25.9 to include security fixes.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-44703",
             "specs": [
-                "<1.6a1"
+                "<0.5.8"
             ],
-            "v": "<1.6a1"
+            "v": "<0.5.8"
         },
         {
-            "advisory": "mi 1.6a2 further fixes the JSONP renderer by prefixing the returned content with  a comment. This should mitigate attacks from Flash (See CVE-2014-4671). See https://github.com/Pylons/pyramid/pull/1649",
-            "cve": "CVE-2014-4671",
-            "id": "pyup.io-38002",
+            "advisory": "Nidaqmx 0.5.8 updates its dependency 'urllib3' to v1.25.9 to include security fixes.",
+            "cve": "CVE-2019-11236",
+            "id": "pyup.io-44704",
             "specs": [
-                "<1.6a2"
+                "<0.5.8"
             ],
-            "v": "<1.6a2"
-        }
-    ],
-    "mihifepe": [
+            "v": "<0.5.8"
+        },
         {
-            "advisory": "Mihifepe version 0.2.2 includes security patches for several functions. They contained OS injection vulnerabilities: subprocess call with shell=True.\r\nhttps://github.com/Craven-Biostat-Lab/mihifepe/commit/b69847025764efc5c6b134c73e18fcfb11b42e0f",
-            "cve": "PVE-2021-41348",
-            "id": "pyup.io-41348",
+            "advisory": "Nidaqmx 0.5.8 updates its dependency 'urllib3' to v1.25.9 to include security fixes.",
+            "cve": "CVE-2018-20060",
+            "id": "pyup.io-44705",
             "specs": [
-                "<0.2.2"
+                "<0.5.8"
             ],
-            "v": "<0.2.2"
+            "v": "<0.5.8"
         }
     ],
-    "mikado": [
+    "nifcloud": [
         {
-            "advisory": "Mikado 2.1.0 removes unsafe calls to 'tempfile.mktemp' and other such files, for increased security according to CodeQL.",
-            "cve": "PVE-2021-40159",
-            "id": "pyup.io-40159",
+            "advisory": "Nifcloud 0.1.7 updates dependencies to fix a vulnerability.",
+            "cve": "PVE-2021-37098",
+            "id": "pyup.io-37098",
             "specs": [
-                "<2.1.0"
+                "<0.1.7"
             ],
-            "v": "<2.1.0"
+            "v": "<0.1.7"
         }
     ],
-    "milc": [
+    "nimview": [
         {
-            "advisory": "Milc 1.4.0 includes support for securely collecting passwords.",
-            "cve": "PVE-2021-41272",
-            "id": "pyup.io-41272",
+            "advisory": "Nimview 0.1.2 adds a (weak) CSRF check.",
+            "cve": "PVE-2021-41725",
+            "id": "pyup.io-41725",
             "specs": [
-                "<1.4.0"
+                "<0.1.2"
             ],
-            "v": "<1.4.0"
+            "v": "<0.1.2"
         }
     ],
-    "mindspore": [
+    "nipyapi": [
         {
-            "advisory": "Mindspore 0.5.0-beta updates its dependency \"Sqlite\" to version 3.32.2, to handle CVE-2020-15358.",
-            "cve": "CVE-2020-15358",
-            "id": "pyup.io-40837",
+            "advisory": "Nipyapi 0.16.2 updates its dependency 'lxml' minimum version to v4.6.2 to include a security fix.",
+            "cve": "CVE-2020-27783",
+            "id": "pyup.io-42904",
             "specs": [
-                "<0.5.0-beta"
+                "<0.16.2"
             ],
-            "v": "<0.5.0-beta"
-        },
+            "v": "<0.16.2"
+        }
+    ],
+    "njmls": [
         {
-            "advisory": "Mindspore 0.5.0b includes a fix for CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.",
-            "cve": "CVE-2020-11655",
-            "id": "pyup.io-40834",
+            "advisory": "Njmls version 0.0.3 includes a security patch for the function 'parse_row' in 'njmls.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/AlJohri/njmls/commit/a1b9aeca58512a4cba4262dc0233a6c8a14e26ab#diff-cc30712c59b1650a88a14f9c620608aaac65c3b1e35f006486ca7ec146f7f826",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41353",
             "specs": [
-                "<0.5.0b"
+                "<0.0.3"
             ],
-            "v": "<0.5.0b"
-        },
+            "v": "<0.0.3"
+        }
+    ],
+    "nkocr": [
         {
-            "advisory": "Mindspore 0.5.0beta upgrades the 'SQLite' dependency to 3.32.2 to handle CVE-2020-13434.",
-            "cve": "CVE-2020-13434",
-            "id": "pyup.io-40840",
+            "advisory": "Nkocr 2.0.0 includes  a dependency security update.",
+            "cve": "PVE-2021-40152",
+            "id": "pyup.io-40152",
             "specs": [
-                "<0.5.0beta"
+                "<2.0.0"
             ],
-            "v": "<0.5.0beta"
+            "v": "<2.0.0"
         },
         {
-            "advisory": "Mindspore 0.5.0beta upgrades the 'SQLite' dependency to 3.32.2 to handle CVE-2020-13435.",
-            "cve": "CVE-2020-13435",
-            "id": "pyup.io-40841",
+            "advisory": "Nkocr 2.0.1 updates dependencies for security reasons.",
+            "cve": "PVE-2021-40151",
+            "id": "pyup.io-40151",
             "specs": [
-                "<0.5.0beta"
+                "<2.0.1"
             ],
-            "v": "<0.5.0beta"
-        },
+            "v": "<2.0.1"
+        }
+    ],
+    "nltk": [
         {
-            "advisory": "Mindspore 0.5.0beta upgrades its dependency 'SQLite' to handle CVE-2020-13871.",
-            "cve": "CVE-2020-13871",
-            "id": "pyup.io-40833",
+            "advisory": "Nltk 3.6.5 includes a fix for CVE-2021-43854: Versions prior to 3.6.5 are vulnerable to regular expression denial of service (ReDoS) attacks. The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to the ReDoS attack. In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, it's strongly recommended upgrading to a version of NLTK without the vulnerability. For users unable to upgrade the execution time can be bounded by limiting the maximum length of an input to any of the vulnerable functions.\r\nhttps://github.com/nltk/nltk/security/advisories/GHSA-f8m6-h2c7-8h9x\r\nhttps://github.com/nltk/nltk/issues/2866",
+            "cve": "CVE-2021-43854",
+            "id": "pyup.io-43622",
             "specs": [
-                "<0.5.0beta"
+                "<3.6.5"
             ],
-            "v": "<0.5.0beta"
-        },
+            "v": "<3.6.5"
+        }
+    ],
+    "nni": [
         {
-            "advisory": "Mindspore 0.5.0beta upgrades its dependency 'SQLite' to handle CVE-2020-9327.",
-            "cve": "CVE-2020-9327",
-            "id": "pyup.io-40835",
+            "advisory": "Nni 2.1 fixes an arbitrary code execution security issue related to its dependency PyYAML.\r\nhttps://github.com/microsoft/nni/pull/3311",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-40661",
             "specs": [
-                "<0.5.0beta"
+                "<2.1"
             ],
-            "v": "<0.5.0beta"
-        },
+            "v": "<2.1"
+        }
+    ],
+    "nobinobi-child": [
         {
-            "advisory": "Mindspore 0.5.0beta upgrades its dependency 'SQLite' to handle CVE-2020-13630.",
-            "cve": "CVE-2020-13630",
-            "id": "pyup.io-40836",
+            "advisory": "Nobinobi-child 0.1.3.6 updates requirements for a security fix.",
+            "cve": "PVE-2021-40196",
+            "id": "pyup.io-40196",
             "specs": [
-                "<0.5.0beta"
+                "<0.1.3.6"
             ],
-            "v": "<0.5.0beta"
+            "v": "<0.1.3.6"
         },
         {
-            "advisory": "Mindspore 0.5.0beta upgrades the 'SQLite' dependency to 3.32.2 to handle CVE-2020-13631.",
-            "cve": "CVE-2020-13631",
-            "id": "pyup.io-40838",
+            "advisory": "Nobinobi-child 0.1.3.7 updates dependency requirements for a security fix.",
+            "cve": "PVE-2021-40626",
+            "id": "pyup.io-40626",
             "specs": [
-                "<0.5.0beta"
+                "<0.1.3.7"
             ],
-            "v": "<0.5.0beta"
-        },
+            "v": "<0.1.3.7"
+        }
+    ],
+    "nobinobi-core": [
         {
-            "advisory": "Mindspore 0.5.0beta upgrades its depedency 'SQLite' to 3.32.2 to handle CVE-2020-13632.",
-            "cve": "CVE-2020-13632",
-            "id": "pyup.io-40839",
+            "advisory": "Nobinobi-core 0.1.4.3 updates underlying 'Django' dependency to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-35042",
+            "id": "pyup.io-43730",
             "specs": [
-                "<0.5.0beta"
+                "<0.1.4.3"
             ],
-            "v": "<0.5.0beta"
+            "v": "<0.1.4.3"
         },
         {
-            "advisory": "Mindspore 0.6.0b, 0.7.0b and 1.0.0 updates the underlying 'libjpeg-turbo' dependency to 2.0.4 to handle CVE-2020-13790.",
-            "cve": "CVE-2020-13790",
-            "id": "pyup.io-41016",
+            "advisory": "Nobinobi-core 0.1.4.3 updates underlying 'Django' dependency to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-33203",
+            "id": "pyup.io-43731",
             "specs": [
-                "<0.6.0b",
-                "<0.7.0b",
-                "<1.0.0"
+                "<0.1.4.3"
             ],
-            "v": "<0.6.0b,<0.7.0b,<1.0.0"
+            "v": "<0.1.4.3"
         },
         {
-            "advisory": "Mindspore 1.0.0, 0.7.0b, 0.6.0b, and 0.5.0b includes a fix for CVE-2020-11656: In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.",
-            "cve": "CVE-2020-11656",
-            "id": "pyup.io-41006",
+            "advisory": "Nobinobi-core 0.1.4.3 updates underlying 'Django' dependency to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-33571",
+            "id": "pyup.io-43732",
             "specs": [
-                "<0.6.0b",
-                "<0.7.0b",
-                "<1.0.0",
-                "<0.5.0b"
+                "<0.1.4.3"
             ],
-            "v": "<0.6.0b,<0.7.0b,<1.0.0,<0.5.0b"
-        }
-    ],
-    "mini-amf": [
+            "v": "<0.1.4.3"
+        },
         {
-            "advisory": "mini-amf before 0.8 is vulnerable to XML entity attacks.",
-            "cve": "PVE-2021-33048",
-            "id": "pyup.io-33048",
+            "advisory": "Nobinobi-core 0.1.4.3 updates its dependency 'Django' to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-31542",
+            "id": "pyup.io-40627",
             "specs": [
-                "<0.8"
+                "<0.1.4.3"
             ],
-            "v": "<0.8"
-        }
-    ],
-    "miniwdl": [
+            "v": "<0.1.4.3"
+        },
         {
-            "advisory": "Miniwdl 0.6.0 manipulates ownership/permissions to improve security and user experience:\r\n* as run completes, chown everything in run directory to invoking user and primary group\r\n* run task commands with membership in invoking user's primary group, ensuring access to working directory even if they've dropped privileges (a good docker security practice)\r\n* `--as-me` to force all task commands to run as invoking user (more secure, but blocks commands that assume root e.g. apt-get)\r\n* Revert to always running command in bash (as required by WDL spec) rather than container $SHELL",
-            "cve": "PVE-2021-37814",
-            "id": "pyup.io-37814",
+            "advisory": "Nobinobi-core 0.1.4.3 updates its dependency 'Django' to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-32052",
+            "id": "pyup.io-43733",
             "specs": [
-                "<0.6.0"
+                "<0.1.4.3"
             ],
-            "v": "<0.6.0"
+            "v": "<0.1.4.3"
         }
     ],
-    "mirahezebot-plugins": [
+    "nobinobi-daily-follow-up": [
         {
-            "advisory": "Mirahezebot-plugins 9.0.2 includes a fix for CVE-2020-15251: In the Channelmgnt plug-in for Sopel (a Python IRC bot) before version 1.0.3, malicious users are able to op/voice and take over a channel. This is an ACL bypass vulnerability. This plugin is bundled with MirahezeBot-Plugins with versions from 9.0.0 and less than 9.0.2.\r\nhttps://github.com/MirahezeBots/sopel-channelmgnt/security/advisories/GHSA-j257-jfvv-h3x5",
-            "cve": "CVE-2020-15251",
-            "id": "pyup.io-42193",
+            "advisory": "Nobinobi-daily-follow-up 0.1.1.11 updates its requirements for security reasons.",
+            "cve": "PVE-2021-40567",
+            "id": "pyup.io-40567",
             "specs": [
-                ">=9.0.0,<9.0.2"
+                "<0.1.1.11"
             ],
-            "v": ">=9.0.0,<9.0.2"
-        }
-    ],
-    "misago": [
+            "v": "<0.1.1.11"
+        },
         {
-            "advisory": "Misago 0.19.4 updates requests to 2.20.0 resolving a potential vulnerability in HTTP connections handling.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36607",
+            "advisory": "Nobinobi-daily-follow-up 0.1.1.12 updates underlying dependencies for security reason.",
+            "cve": "PVE-2021-40810",
+            "id": "pyup.io-40810",
             "specs": [
-                "<0.19.4"
+                "<0.1.1.12"
             ],
-            "v": "<0.19.4"
-        }
-    ],
-    "mishmash": [
+            "v": "<0.1.1.12"
+        },
         {
-            "advisory": "mishmash 0.3b12 - Pyaml >= 4.2b1 for security alert.",
-            "cve": "PVE-2021-36795",
-            "id": "pyup.io-36795",
+            "advisory": "Nobinobi-daily-follow-up 0.1.1.9 updates requirements for security reasons.",
+            "cve": "PVE-2021-40202",
+            "id": "pyup.io-40202",
             "specs": [
-                "<0.3b12"
+                "<0.1.1.9"
             ],
-            "v": "<0.3b12"
+            "v": "<0.1.1.9"
         }
     ],
-    "misp-maltego": [
+    "nobinobi-staff": [
         {
-            "advisory": "Misp-maltego 1.4.5 resolves an information disclosure vulnerability when using MISP-maltego as remote transform server. The transform server would cache the MISP credentials of the first user connected, and provide access to that MISP instance for any later user.  See: CVE-2020-12889.",
-            "cve": "CVE-2020-12889",
-            "id": "pyup.io-38487",
+            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-32052",
+            "id": "pyup.io-43378",
             "specs": [
-                "<1.4.5"
+                "<0.1.6.2"
             ],
-            "v": "<1.4.5"
-        }
-    ],
-    "mistral": [
+            "v": "<0.1.6.2"
+        },
         {
-            "advisory": "An information-exposure vulnerability was discovered where openstack-mistral's undercloud log files containing clear-text information were made world readable. A malicious system user could exploit this flaw to access sensitive user information. See: CVE-2019-3866 and https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3866.",
-            "cve": "CVE-2019-3866",
-            "id": "pyup.io-37774",
+            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-31542",
+            "id": "pyup.io-43387",
             "specs": [
-                "<7.1.0",
-                ">=8.0,<8.1.0",
-                ">=9.0,<9.0.1"
+                "<0.1.6.2"
             ],
-            "v": "<7.1.0,>=8.0,<8.1.0,>=9.0,<9.0.1"
+            "v": "<0.1.6.2"
         },
         {
-            "advisory": "A Denial of Service (DoS) condition is possible in OpenStack Mistral in versions up to and including 7.0.3. Submitting a specially crafted workflow definition YAML file containing nested anchors can lead to resource exhaustion culminating in a denial of service. See: CVE-2018-16848.",
-            "cve": "CVE-2018-16848",
-            "id": "pyup.io-38424",
+            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-35042",
+            "id": "pyup.io-43391",
             "specs": [
-                "<=7.0.3"
+                "<0.1.6.2"
             ],
-            "v": "<=7.0.3"
-        }
-    ],
-    "mistune": [
+            "v": "<0.1.6.2"
+        },
         {
-            "advisory": "Mistune before 0.7.2 is vulnerable to an XSS attack. It is possible to bypass the renderer's link security check.\r\nhttps://github.com/lepture/mistune/issues/87",
-            "cve": "PVE-2021-25890",
-            "id": "pyup.io-25890",
+            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-44420",
+            "id": "pyup.io-43388",
             "specs": [
-                "<0.7.2"
+                "<0.1.6.2"
             ],
-            "v": "<0.7.2"
+            "v": "<0.1.6.2"
         },
         {
-            "advisory": "mistune before 0.8.1 has a cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py which allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the \"key\" argument.",
-            "cve": "CVE-2017-16876",
-            "id": "pyup.io-36332",
+            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-33203",
+            "id": "pyup.io-43389",
             "specs": [
-                "<0.8.1"
+                "<0.1.6.2"
             ],
-            "v": "<0.8.1"
+            "v": "<0.1.6.2"
         },
         {
-            "advisory": "Mistune.py in mistune 0.7.4 allows XSS via an unexpected newline (such as in java\\nscript:) or a crafted email address, related to the escape and autolink functions. See CVE-2017-15612.\r\nhttps://github.com/lepture/mistune/pull/140",
-            "cve": "CVE-2017-15612",
-            "id": "pyup.io-35030",
+            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
+            "cve": "CVE-2021-33571",
+            "id": "pyup.io-43390",
             "specs": [
-                "==0.7.4"
+                "<0.1.6.2"
             ],
-            "v": "==0.7.4"
+            "v": "<0.1.6.2"
         }
     ],
-    "mitiq": [
+    "noiseprotocol": [
         {
-            "advisory": "Mitiq 0.4.0 updates notebook version in requirements to resolve a vulnerability. See CVE-2020-26215.\r\nhttps://github.com/unitaryfund/mitiq/pull/445",
-            "cve": "CVE-2020-26215",
-            "id": "pyup.io-39241",
+            "advisory": "noiseprotocol before 0.2.1 used an insecure transitive dependency (Cryptography<=2.1.3).",
+            "cve": "PVE-2021-35043",
+            "id": "pyup.io-35043",
             "specs": [
-                "<0.4.0"
+                "<0.2.1"
             ],
-            "v": "<0.4.0"
+            "v": "<0.2.1"
         }
     ],
-    "mitmproxy": [
-        {
-            "advisory": "Mitmproxy before 0.17 has a XSS vulnerability in HTTP errors.\r\nhttps://github.com/mitmproxy/mitmproxy/pull/1066",
-            "cve": "PVE-2021-25891",
-            "id": "pyup.io-25891",
-            "specs": [
-                "<0.17"
-            ],
-            "v": "<0.17"
-        },
-        {
-            "advisory": "Mitmproxy version 4.0.0 includes a fix to correctly block connections from remote clients with IPv4-mapped IPv6 client addresses.\r\nhttps://github.com/mitmproxy/mitmproxy/issues/3024",
-            "cve": "PVE-2021-41864",
-            "id": "pyup.io-41864",
-            "specs": [
-                "<4.0.0"
-            ],
-            "v": "<4.0.0"
-        },
+    "normcap": [
         {
-            "advisory": "mitmproxy before 4.0.3 does not protect mitmweb against DNS rebinding.",
-            "cve": "CVE-2018-14505",
-            "id": "pyup.io-36353",
+            "advisory": "Normcap 0.1.1 updates PyInstaller to avoid potential vulnerability.",
+            "cve": "PVE-2021-37722",
+            "id": "pyup.io-37722",
             "specs": [
-                "<4.0.3"
+                "<0.1.1"
             ],
-            "v": "<4.0.3"
+            "v": "<0.1.1"
         },
         {
-            "advisory": "mitmproxy before 4.0.4 does not protect mitmweb against DNS rebinding.",
-            "cve": "CVE-2018-14505",
-            "id": "pyup.io-36352",
+            "advisory": "Normcap 0.1.2 updates its dependency 'Bleach' to v3.1.1 to include a security fix.",
+            "cve": "CVE-2020-6802",
+            "id": "pyup.io-38132",
             "specs": [
-                "<4.0.4"
+                "<0.1.2"
             ],
-            "v": "<4.0.4"
-        },
+            "v": "<0.1.2"
+        }
+    ],
+    "nornir": [
         {
-            "advisory": "Mitmproxy 5.0 fixes command injection vulnerabilities when exporting flows as curl/httpie commands. It also does not echo unsanitized user input in HTTP error responses.",
-            "cve": "PVE-2021-38179",
-            "id": "pyup.io-38179",
+            "advisory": "Nornir 3.2.0 updates its dependency 'pygments' to v2.10.0 to include security fixes.",
+            "cve": "CVE-2021-20270",
+            "id": "pyup.io-42767",
             "specs": [
-                "<5.0"
+                "<3.2.0"
             ],
-            "v": "<5.0"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Mitmproxy 5.0.0 includes fixes for:\r\n- Command injection vulnerabilities when exporting flows as curl/httpie commands\r\n- Do not echo unsanitized user input in HTTP error responses",
-            "cve": "PVE-2021-41862",
-            "id": "pyup.io-41862",
+            "advisory": "Nornir 3.2.0 updates its dependency 'pygments' to v2.10.0 to include a security fix.",
+            "cve": "CVE-2021-27291",
+            "id": "pyup.io-42704",
             "specs": [
-                "<5.0.0"
+                "<3.2.0"
             ],
-            "v": "<5.0.0"
+            "v": "<3.2.0"
         },
         {
-            "advisory": "Mitmproxy version 7.0.3 includes a fix for CVE-2021-39214: In mitmproxy 7.0.2 and below, a malicious client or server is able to perform HTTP request smuggling attacks through mitmproxy. This means that a malicious client/server could smuggle a request/response through mitmproxy as part of another request/response's HTTP message body. While a smuggled request is still captured as part of another request's body, it does not appear in the request list and does not go through the usual mitmproxy event hooks, where users may have implemented custom access control checks or input sanitization. Unless one uses mitmproxy to protect an HTTP/1 service, no action is required.",
-            "cve": "CVE-2021-39214",
-            "id": "pyup.io-41855",
-            "specs": [
-                "<7.0.3"
-            ],
-            "v": "<7.0.3"
-        }
-    ],
-    "mitogen": [
-        {
-            "advisory": "Before mitogen version 0.2.8, unidirectional routing, where contexts may optionally only communicate with parents and never siblings (so that air-gapped networks cannot be unintentionally bridged) was not inherited when a child was initiated directly from another child. This did not effect Ansible, since the controller initiates any new child used for routing, only forked tasks are initiated by children [gh:commit:`5924af15`].",
-            "cve": "PVE-2021-37381",
-            "id": "pyup.io-37381",
+            "advisory": "Nornir 3.2.0 updates its dependency 'pygments' to v2.10.0 to include security fixes.",
+            "cve": "CVE-2021-27291",
+            "id": "pyup.io-43357",
             "specs": [
-                "<0.2.8"
+                "<3.2.0"
             ],
-            "v": "<0.2.8"
+            "v": "<3.2.0"
         }
     ],
-    "mixminion": [
+    "notable": [
         {
-            "advisory": "mixminion before 0.0.2 is vulnerable to certain trivial DoS attacks. In particular, it's possible to send zlib bombs or flood a server with open connections.",
-            "cve": "PVE-2021-25892",
-            "id": "pyup.io-25892",
+            "advisory": "notable 0.0.6 fixes a security regression in the new BoltDB backend.",
+            "cve": "PVE-2021-34447",
+            "id": "pyup.io-34447",
             "specs": [
-                "<0.0.2"
+                "<0.0.6"
             ],
-            "v": "<0.0.2"
+            "v": "<0.0.6"
         }
     ],
-    "mkdocs-material": [
+    "notebook": [
         {
-            "advisory": "mkdocs-material before 1.0.0 uses _blank targets on links which make it vulnerable to Cross Site Scripting attacks.",
-            "cve": "PVE-2021-32121",
-            "id": "pyup.io-32121",
+            "advisory": "The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.",
+            "cve": "CVE-2015-7337",
+            "id": "pyup.io-25903",
             "specs": [
-                "<1.0.0"
+                "<4.0.5"
             ],
-            "v": "<1.0.0"
+            "v": "<4.0.5"
         },
         {
-            "advisory": "Mkdocs-material 7.0.6 improves the security of the Docker image.",
-            "cve": "PVE-2021-39706",
-            "id": "pyup.io-39706",
+            "advisory": "Notebook 4.0.5 includes security fixes for maliciously crafted files (CVE-2015-6938).",
+            "cve": "CVE-2015-6938",
+            "id": "pyup.io-40389",
             "specs": [
-                "<7.0.6"
+                "<4.0.5"
             ],
-            "v": "<7.0.6"
-        }
-    ],
-    "ml-versioning-tools": [
+            "v": "<4.0.5"
+        },
         {
-            "advisory": "Ml-versioning-tools version 2.0.1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/peopledoc/mlvtools/commit/8a18faaea26c0fc93dad15f03b8e9b81473a4120",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41350",
+            "advisory": "Notebook 4.0.5 includes security fixes for maliciously crafted files (CVE-2015-7337).",
+            "cve": "CVE-2015-7337",
+            "id": "pyup.io-40398",
             "specs": [
-                "<2.0.1"
+                "<4.0.5"
             ],
-            "v": "<2.0.1"
-        }
-    ],
-    "mlalchemy": [
+            "v": "<4.0.5"
+        },
         {
-            "advisory": "An exploitable vulnerability exists in the YAML parsing functionality in the parse_yaml_query method in parser.py in MLAlchemy before 0.2.2. When processing YAML-Based queries for data, a YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.",
-            "cve": "CVE-2017-16615",
-            "id": "pyup.io-35718",
+            "advisory": "Notebook 5.4.1 adds a security release fix (CVE-2018-8768).",
+            "cve": "CVE-2018-8768",
+            "id": "pyup.io-40386",
             "specs": [
-                "<0.2.2"
+                "<5.4.1"
             ],
-            "v": "<0.2.2"
-        }
-    ],
-    "mlconjug3": [
+            "v": "<5.4.1"
+        },
         {
-            "advisory": "Mlconjug3 3.7.16 updates its dependency 'cryptography' to include a security fix.",
-            "cve": "CVE-2020-36242",
-            "id": "pyup.io-42361",
+            "advisory": "Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.",
+            "cve": "CVE-2018-19351",
+            "id": "pyup.io-42253",
             "specs": [
-                "<3.7.16"
+                "<5.7.1"
             ],
-            "v": "<3.7.16"
+            "v": "<5.7.1"
         },
         {
-            "advisory": "Mlconjug3 3.7.16 updates its dependency \"pyyaml\" to include a security fix.",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-42366",
+            "advisory": "Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.",
+            "cve": "CVE-2018-19352",
+            "id": "pyup.io-42254",
             "specs": [
-                "<3.7.16"
+                "<5.7.2"
             ],
-            "v": "<3.7.16"
-        }
-    ],
-    "mlf-core": [
+            "v": "<5.7.2"
+        },
         {
-            "advisory": "Mlf-core 1.10.0 includes a fix for insecure MD5 (from Bandit report).",
-            "cve": "PVE-2021-39705",
-            "id": "pyup.io-39705",
+            "advisory": "Kiwi TCMS 6.4 updates Patternfly to version 3.59.0, which deals with an XSS issue in bootstrap (CVE-2018-14041). By default session cookies will expire after 24 hours. This can now be controlled via the ``SESSION_COOKIE_AGE`` setting. See https://github.com/kiwitcms/Kiwi/issues/556.",
+            "cve": "CVE-2018-14041",
+            "id": "pyup.io-40385",
             "specs": [
-                "<1.10.0"
+                "<5.7.3"
             ],
-            "v": "<1.10.0"
-        }
-    ],
-    "mlrun": [
+            "v": "<5.7.3"
+        },
         {
-            "advisory": "Mlrun 0.9.0rc7 fixes the encoding of project secrets.\r\nhttps://github.com/mlrun/mlrun/pull/1536",
-            "cve": "PVE-2021-42973",
-            "id": "pyup.io-42973",
+            "advisory": "Notebook 5.7.6 includes a fix for vulnerability (CVE-2019-9644).",
+            "cve": "CVE-2019-9644",
+            "id": "pyup.io-40384",
             "specs": [
-                "<0.9.0rc7"
+                "<5.7.6"
             ],
-            "v": "<0.9.0rc7"
-        }
-    ],
-    "mockintosh": [
+            "v": "<5.7.6"
+        },
         {
-            "advisory": "Mockintosh 0.4 adds the ability to refer to external files (containing request and response bodies) and makes it secure by disallowing files outside the mock config hierarchy.",
-            "cve": "PVE-2021-39463",
-            "id": "pyup.io-39463",
+            "advisory": "Notebook 5.7.8 fixes the 'Open Redirect' vulnerability (CVE-2019-10255).",
+            "cve": "CVE-2019-10255",
+            "id": "pyup.io-40383",
             "specs": [
-                "<0.4"
+                "<5.7.8"
             ],
-            "v": "<0.4"
-        }
-    ],
-    "mockup": [
+            "v": "<5.7.8"
+        },
         {
-            "advisory": "Mockup before 2.1.3 has a XSS vulnerability in structure and relateditem patterns.\r\nhttps://github.com/plone/mockup/pull/629\r\nhttps://github.com/plone/mockup/pull/627",
-            "cve": "PVE-2021-25893",
-            "id": "pyup.io-25893",
+            "advisory": "Notebook 6.0 improves SSL/TLS security by using PROTOCOL_TLS which selects the highest SSL/TLS protocol version available that both the client and server support. When PROTOCOL_TLS is not available use PROTOCOL_SSLv23.",
+            "cve": "PVE-2021-40382",
+            "id": "pyup.io-40382",
             "specs": [
-                "<2.1.3"
+                "<6.0"
             ],
-            "v": "<2.1.3"
-        }
-    ],
-    "moin": [
+            "v": "<6.0"
+        },
         {
-            "advisory": "Moin 1.1 removes two cross-site scripting vulnerabilities reported by \"office\".",
-            "cve": "PVE-2021-36475",
-            "id": "pyup.io-36475",
+            "advisory": "Notebook 6.0.2 updates its dependency 'JQuery' to v3.5.0 to include a security fix.",
+            "cve": "CVE-2019-11358",
+            "id": "pyup.io-40381",
             "specs": [
-                "<1.1"
+                "<6.0.2"
             ],
-            "v": "<1.1"
+            "v": "<6.0.2"
         },
         {
-            "advisory": "The password_checker function in config/multiconfig.py in MoinMoin 1.6.1 uses the cracklib and python-crack features even though they are not thread-safe, which allows remote attackers to cause a denial of service (segmentation fault and crash) via unknown vectors.",
-            "cve": "CVE-2008-6549",
-            "id": "pyup.io-25894",
+            "advisory": "Notebook 6.1.5 fixes open redirect vulnerability 'GHSA-c7vm-f5p4-8fqh'. See: CVE-2020-26215.",
+            "cve": "CVE-2020-26215",
+            "id": "pyup.io-40380",
             "specs": [
-                "<1.6.1"
+                "<6.1.5"
             ],
-            "v": "<1.6.1"
+            "v": "<6.1.5"
         },
         {
-            "advisory": "Moin versions 1.8.7 and 1.9.2 include a fix for CVE-2010-0669: MoinMoin before 1.8.7 and 1.9.x before 1.9.2 does not properly sanitize user profiles, which has unspecified impact and attack vectors.",
-            "cve": "CVE-2010-0669",
-            "id": "pyup.io-36453",
+            "advisory": "Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.",
+            "cve": "CVE-2015-6938",
+            "id": "pyup.io-25904",
             "specs": [
-                "<1.8.7",
-                ">1.8.7,<1.9.2"
+                ">=4.0,<4.0.5"
             ],
-            "v": "<1.8.7,>1.8.7,<1.9.2"
+            "v": ">=4.0,<4.0.5"
         },
         {
-            "advisory": "Moin 1.9.10 includes a security fix for CVE-2016-7146.",
-            "cve": "CVE-2016-7146",
-            "id": "pyup.io-39588",
+            "advisory": "Notebook 4.2.2 includes an important security fix (CVE-2016-6524).",
+            "cve": "CVE-2016-6524",
+            "id": "pyup.io-40388",
             "specs": [
-                "<1.9.10"
+                ">=4.0.0a1,<4.2.2"
             ],
-            "v": "<1.9.10"
+            "v": ">=4.0.0a1,<4.2.2"
+        }
+    ],
+    "notifications-python-client": [
+        {
+            "advisory": "notifications-python-client before 4.7.1 is vulnerable to a not further described security issue in PyJWT.",
+            "cve": "PVE-2021-35116",
+            "id": "pyup.io-35116",
+            "specs": [
+                "<4.7.1"
+            ],
+            "v": "<4.7.1"
+        }
+    ],
+    "nova": [
+        {
+            "advisory": "An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py. See: CVE-2015-9543.",
+            "cve": "CVE-2015-9543",
+            "id": "pyup.io-37903",
+            "specs": [
+                "<18.2.4",
+                ">=20.0.0.0rc1,<20.1.0",
+                ">=19.0.0.0rc1,<19.1.0"
+            ],
+            "v": "<18.2.4,>=20.0.0.0rc1,<20.1.0,>=19.0.0.0rc1,<19.1.0"
         },
         {
-            "advisory": "Moin 1.9.10 includes a security fix for CVE-2017-5934, XSS in GUI editor related code.",
-            "cve": "CVE-2017-5934",
-            "id": "pyup.io-36447",
+            "advisory": "An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected. See: CVE-2020-17376.",
+            "cve": "CVE-2020-17376",
+            "id": "pyup.io-38722",
             "specs": [
-                "<1.9.10"
+                "<19.3.1",
+                ">=20.0.0.0rc1,<20.3.1",
+                "==21.0.0"
             ],
-            "v": "<1.9.10"
+            "v": "<19.3.1,>=20.0.0.0rc1,<20.3.1,==21.0.0"
         },
         {
-            "advisory": "Moin 1.9.10 includes a security fix for CVE-2016-9119.",
-            "cve": "CVE-2016-9119",
-            "id": "pyup.io-39587",
+            "advisory": "OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY. See CVE-2011-4076.",
+            "cve": "CVE-2011-4076",
+            "id": "pyup.io-37736",
             "specs": [
-                "<1.9.10"
+                "<2012.1"
             ],
-            "v": "<1.9.10"
+            "v": "<2012.1"
         },
         {
-            "advisory": "Moin 1.9.3 includes a fix for CVE-2011-1058: A cross-site scripting (XSS) vulnerability in the reStructuredText (rst) parser in parser/text_rst.py in MoinMoin before 1.9.3, when docutils is installed or when \"format rst\" is set, allows remote attackers to inject arbitrary web script or HTML via javascript: URL in the refuri attribute.",
-            "cve": "CVE-2011-1058",
-            "id": "pyup.io-36452",
+            "advisory": "Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem. See: CVE-2011-3147.",
+            "cve": "CVE-2011-3147",
+            "id": "pyup.io-37087",
             "specs": [
-                "<1.9.3"
+                "<2012.1"
             ],
-            "v": "<1.9.3"
+            "v": "<2012.1"
         },
         {
-            "advisory": "Moin 1.9.9 includes a fix for CVE-2016-7148: MoinMoin 1.9.8 allows remote attackers to conduct \"JavaScript injection\" attacks by using the \"page creation\" approach, related to a \"Cross Site Scripting (XSS)\" issue affecting the action=AttachFile (via page name) component.",
-            "cve": "CVE-2016-7148",
-            "id": "pyup.io-36448",
+            "advisory": "The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.",
+            "cve": "CVE-2013-1068",
+            "id": "pyup.io-25905",
             "specs": [
-                "==1.9.8"
+                "<2013.2.3"
             ],
-            "v": "==1.9.8"
+            "v": "<2013.2.3"
         },
         {
-            "advisory": "Moin version 1.9.1 includes a fix for CVE-2010-0667: MoinMoin 1.9 before 1.9.1 does not perform the expected clearing of the sys.argv array in situations where the GATEWAY_INTERFACE environment variable is set, which allows remote attackers to obtain sensitive information via unspecified vectors.",
-            "cve": "CVE-2010-0667",
-            "id": "pyup.io-36454",
+            "advisory": "OpenStack nova base images permissions are world readable. No fixes or affected versions are known. See: CVE-2013-0326.",
+            "cve": "CVE-2013-0326",
+            "id": "pyup.io-37745",
             "specs": [
-                ">=1.9.0,<1.9.1"
+                ">0"
             ],
-            "v": ">=1.9.0,<1.9.1"
+            "v": ">0"
         }
     ],
-    "mollie-api-python": [
+    "nox-poetry": [
         {
-            "advisory": "Mollie-api-python 2.0.4 updates requests to v2.20.0 because of a vulnerability in previous versions.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36650",
+            "advisory": "Nox-poetry 0.8.2 updates vulnerable sub-dependencies.",
+            "cve": "PVE-2021-39702",
+            "id": "pyup.io-39702",
             "specs": [
-                "<2.0.4"
+                "<0.8.2"
             ],
-            "v": "<2.0.4"
+            "v": "<0.8.2"
         }
     ],
-    "money-to-prisoners-common": [
+    "nphase": [
         {
-            "advisory": "Money-to-prisoners-common version 12.0.1 updates its dependency \"cryptography\" to  include security fixes.",
-            "cve": "PVE-2021-41827",
-            "id": "pyup.io-41827",
+            "advisory": "Nphase 1.1.3 and prior include a version of 'Gatk' (4.0) affected by critical vulnerabilities.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44465",
             "specs": [
-                "<12.0.1"
+                "<=1.1.3"
             ],
-            "v": "<12.0.1"
-        }
-    ],
-    "monoshape": [
+            "v": "<=1.1.3"
+        },
         {
-            "advisory": "Monoshape 1.2 includes a vulnerable version of Pillow (6.2).",
-            "cve": "CVE-2020-5311",
-            "id": "pyup.io-37605",
+            "advisory": "Nphase 1.1.3 and prior include a version of 'Gatk' (4.0) affected by critical vulnerabilities.",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-43605",
             "specs": [
-                "<1.2"
+                "<=1.1.3"
             ],
-            "v": "<1.2"
+            "v": "<=1.1.3"
         },
         {
-            "advisory": "Monoshape 1.2 includes a vulnerable version of Pillow (6.2).",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-43459",
+            "advisory": "Nphase 1.1.3 and prior include a version of 'Gatk' (4.0) affected by critical vulnerabilities.",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43604",
             "specs": [
-                "<1.2"
+                "<=1.1.3"
             ],
-            "v": "<1.2"
+            "v": "<=1.1.3"
         },
         {
-            "advisory": "Monoshape 1.2 includes a vulnerable version of Pillow (6.2).",
-            "cve": "CVE-2021-25288",
-            "id": "pyup.io-43460",
+            "advisory": "Nphase 1.1.3 and prior include a version of 'Gatk' (4.0) affected by critical vulnerabilities.",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43603",
             "specs": [
-                "<1.2"
+                "<=1.1.3"
             ],
-            "v": "<1.2"
+            "v": "<=1.1.3"
         }
     ],
-    "mopidy-jellyfin": [
+    "nsupdate": [
         {
-            "advisory": "Mopidy-jellyfin 0.3.1 addresses a security vulnerability in one of its dependencies.",
-            "cve": "PVE-2021-37281",
-            "id": "pyup.io-37281",
+            "advisory": "nsupdate before 0.3.0 is vulnerable to a undisclosed security issue.",
+            "cve": "PVE-2021-25906",
+            "id": "pyup.io-25906",
             "specs": [
-                "<0.3.1"
+                "<0.3.0"
             ],
-            "v": "<0.3.1"
-        }
-    ],
-    "morepath": [
+            "v": "<0.3.0"
+        },
         {
-            "advisory": "morepath before 0.14 has no host header validation to protect against header poisoning attacks.",
-            "cve": "PVE-2021-25895",
-            "id": "pyup.io-25895",
+            "advisory": "nsupdate 0.8.0 fixes a security issue: abuse_blocked flag could be worked around by abuser.",
+            "cve": "PVE-2021-25907",
+            "id": "pyup.io-25907",
             "specs": [
-                "<0.14"
+                "<0.8.0"
             ],
-            "v": "<0.14"
-        }
-    ],
-    "mortimer": [
+            "v": "<0.8.0"
+        },
         {
-            "advisory": "Mortimer 0.4.5 further increases the data protection and data security through an improved handling of access to the alfred database from inside experiments.",
-            "cve": "PVE-2021-38277",
-            "id": "pyup.io-38277",
+            "advisory": "nsupdate 0.9.1 fixes a security issue with \"related hosts\" / \"service updaters\".",
+            "cve": "PVE-2021-25908",
+            "id": "pyup.io-25908",
             "specs": [
-                "<0.4.5"
+                "<0.9.1"
             ],
-            "v": "<0.4.5"
+            "v": "<0.9.1"
         }
     ],
-    "mosql": [
+    "nuitka": [
         {
-            "advisory": "mosql 0.10 includes several security related changes.",
-            "cve": "PVE-2021-25896",
-            "id": "pyup.io-25896",
+            "advisory": "Nuitka 0.6.12 uses https URLs for downloading dependency walker, for it to be more secure.",
+            "cve": "PVE-2021-39648",
+            "id": "pyup.io-39648",
             "specs": [
-                "<0.10"
+                "<0.6.12"
             ],
-            "v": "<0.10"
+            "v": "<0.6.12"
         }
     ],
-    "motionblinds": [
+    "nukikata": [
         {
-            "advisory": "Motionblinds 0.5.7 hides sensitive information from logs.\r\nhttps://github.com/starkillerOG/motion-blinds/commit/716af4bbfcbf8001b30629427e37d02c37e40233",
-            "cve": "PVE-2021-42718",
-            "id": "pyup.io-42718",
+            "advisory": "Nukikata 1.4.0 raises an error if Cookiecutter tries to render a template that contains an undefined variable. Makes generation more robust and secure.",
+            "cve": "PVE-2021-38418",
+            "id": "pyup.io-38418",
             "specs": [
-                "<0.5.7"
+                "<1.4.0"
             ],
-            "v": "<0.5.7"
+            "v": "<1.4.0"
         }
     ],
-    "moto": [
+    "numba": [
         {
-            "advisory": "Moto 1.3.7 updates a dependency (cryptography) with a known security vulnerability (CVE-2018-10903).\r\nhttps://github.com/spulec/moto/issues/1839",
-            "cve": "CVE-2018-10903",
-            "id": "pyup.io-41706",
+            "advisory": "Numba 0.49.0 includes an attempt at fixing frame injection in the dispatcher tracing path.",
+            "cve": "PVE-2021-38983",
+            "id": "pyup.io-38983",
             "specs": [
-                "<1.3.7"
+                "<0.49.0"
             ],
-            "v": "<1.3.7"
+            "v": "<0.49.0"
         }
     ],
-    "mpxj": [
+    "numpy": [
         {
-            "advisory": "Mpxj 5.0.0 fixes a XXE security vulnerability. See also <https://sourceforge.net/p/mpxj/bugs/267>.",
-            "cve": "PVE-2021-39675",
-            "id": "pyup.io-39675",
+            "advisory": "Numpy 1.13.2 includes a fix for CVE-2017-12852: The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause a DoS attack.\r\nhttps://github.com/numpy/numpy/issues/9560#issuecomment-322395292",
+            "cve": "CVE-2017-12852",
+            "id": "pyup.io-44720",
             "specs": [
-                "<5.0.0"
+                "<1.13.2"
             ],
-            "v": "<5.0.0"
+            "v": "<1.13.2"
         },
         {
-            "advisory": "Mpxj 8.1.4 addresses the CVE-2020-25020 XXE vulnerability.",
-            "cve": "CVE-2020-25020",
-            "id": "pyup.io-39674",
+            "advisory": "Numpy 1.16.3 includes a fix for CVE-2019-6446: It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.\r\nhttps://github.com/numpy/numpy/commit/89b688732b37616c9d26623f81aaee1703c30ffb",
+            "cve": "CVE-2019-6446",
+            "id": "pyup.io-36810",
             "specs": [
-                "<8.1.4"
+                "<1.16.3"
             ],
-            "v": "<8.1.4"
+            "v": "<1.16.3"
         },
         {
-            "advisory": "common/InputStreamHelper.java in Packwood MPXJ before 8.3.5 allows directory traversal in the zip stream handler flow, leading to the writing of files to arbitrary locations.",
-            "cve": "CVE-2020-35460",
-            "id": "pyup.io-42293",
+            "advisory": "Numpy 1.21.0 includes a fix for CVE-2021-33430: A Buffer Overflow vulnerability exists in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service.\r\nhttps://github.com/numpy/numpy/commit/ae317fd9ff3e79c0eac357d723bfc29cbd625f2e",
+            "cve": "CVE-2021-33430",
+            "id": "pyup.io-43453",
             "specs": [
-                "<8.3.5"
+                "<1.21.0"
             ],
-            "v": "<8.3.5"
+            "v": "<1.21.0"
         },
         {
-            "advisory": "Mpxj 8.3.5 addresses the CVE-2020-35460 zip slip vulnerability.",
-            "cve": "PVE-2021-39673",
-            "id": "pyup.io-39673",
-            "specs": [
-                "<8.3.5"
-            ],
-            "v": "<8.3.5"
-        }
-    ],
-    "mpymodcore": [
-        {
-            "advisory": "Mpymodcore 0.0.12 hardens the WindUp security (user module), and secures router with a redirect/bad request response.",
-            "cve": "PVE-2021-38431",
-            "id": "pyup.io-38431",
+            "advisory": "Numpy 1.22.0 includes a fix for CVE-2021-41496: A buffer overflow in the array_from_pyobj function of fortranobject.c, which allows attackers to conduct a Denial of Service attacks by carefully constructing an array with negative values.\r\nhttps://github.com/numpy/numpy/issues/19000",
+            "cve": "CVE-2021-41496",
+            "id": "pyup.io-44716",
             "specs": [
-                "<0.0.12"
+                "<1.22.0"
             ],
-            "v": "<0.0.12"
+            "v": "<1.22.0"
         },
         {
-            "advisory": "Mpymodcore 0.0.9 includes a WindUp security hardening, an user module, and a secure router with redirect/bad request response.",
-            "cve": "PVE-2021-41234",
-            "id": "pyup.io-41234",
+            "advisory": "Numpy 1.22.0 includes a fix for CVE-2021-34141: An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is \"completely harmless.\"\r\nhttps://github.com/numpy/numpy/issues/18993",
+            "cve": "CVE-2021-34141",
+            "id": "pyup.io-44717",
             "specs": [
-                "<0.0.9"
+                "<1.22.0"
             ],
-            "v": "<0.0.9"
+            "v": "<1.22.0"
         },
         {
-            "advisory": "Mpymodcore 0.0.9 includes hardening of WindUp security and it also secures router with a redirect/bad request response.",
-            "cve": "PVE-2021-38218",
-            "id": "pyup.io-38218",
+            "advisory": "Numpy 1.8.1 includes a fix for CVE-2014-1859: (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary files via a symlink attack on a temporary file.\r\nhttps://github.com/numpy/numpy/pull/4262",
+            "cve": "CVE-2014-1859",
+            "id": "pyup.io-34726",
             "specs": [
-                "<0.0.9"
+                "<1.8.1"
             ],
-            "v": "<0.0.9"
+            "v": "<1.8.1"
         },
         {
-            "advisory": "The changelog of mpymodcore 0.0.14 mentions some backlogged tasks, among which: \"WindUp security hardening, user module, secure router with redirect/bad request response\"",
-            "cve": "PVE-2021-38795",
-            "id": "pyup.io-38795",
+            "advisory": "Numpy 1.8.1 includes a fix for CVE-2014-1858: __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file.\r\nhttps://github.com/numpy/numpy/commit/0bb46c1448b0d3f5453d5182a17ea7ac5854ee15",
+            "cve": "CVE-2014-1858",
+            "id": "pyup.io-44719",
             "specs": [
-                "<=0.0.14"
+                "<1.8.1"
             ],
-            "v": "<=0.0.14"
+            "v": "<1.8.1"
         },
         {
-            "advisory": "Mpymodcore version 0.0.15 and below (and possibly later version, too) are in need of WindUp security hardening. This is listed in the backlog.",
-            "cve": "PVE-2021-38872",
-            "id": "pyup.io-38872",
+            "advisory": "All versions of Numpy are affected by CVE-2021-41495: A null Pointer Dereference vulnerability exists in numpy.sort, in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to conduct DoS attacks by repetitively creating sort arrays.\r\nhttps://github.com/numpy/numpy/issues/19038",
+            "cve": "CVE-2021-41495",
+            "id": "pyup.io-44715",
             "specs": [
-                "<=0.0.15"
+                ">0"
             ],
-            "v": "<=0.0.15"
-        },
+            "v": ">0"
+        }
+    ],
+    "nvidia-tensorflow": [
         {
-            "advisory": "Mpymodcore 0.0.17 mentions in its changelog that WindUp security hardening is a backlogged task.",
-            "cve": "PVE-2021-38980",
-            "id": "pyup.io-38980",
+            "advisory": "Nvidia-tensorflow 1.10.0 builds & links in secure gRPC components (switch from the insecure grpc dependency to secure grpc dependency)",
+            "cve": "PVE-2021-38457",
+            "id": "pyup.io-38457",
             "specs": [
-                "<=0.0.17"
+                "<1.10.0"
             ],
-            "v": "<=0.0.17"
+            "v": "<1.10.0"
         },
         {
-            "advisory": "Mpymodcore 0.0.18 includes a note in its list of backlogged tasks to harden the security of WindUp, securing the router with a redirect/bad request response.",
-            "cve": "PVE-2021-39161",
-            "id": "pyup.io-39161",
+            "advisory": "Nvidia-tensorflow 1.12.2 fixes a potential security vulnerability where carefully crafted GIF images can produce a null pointer dereference during decoding.",
+            "cve": "PVE-2021-38456",
+            "id": "pyup.io-38456",
             "specs": [
-                "<=0.0.18"
+                "<1.12.2"
             ],
-            "v": "<=0.0.18"
+            "v": "<1.12.2"
         },
         {
-            "advisory": "Mpymodcore 0.0.19 was released with the acknowledgement that WindUp requires security hardening.",
-            "cve": "PVE-2021-39273",
-            "id": "pyup.io-39273",
+            "advisory": "Nvidia-tensorflow 1.15.3 includes a fix for CVE-2019-19645: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
+            "cve": "CVE-2019-19645",
+            "id": "pyup.io-39711",
             "specs": [
-                "<=0.0.19"
+                "<1.15.3"
             ],
-            "v": "<=0.0.19"
-        }
-    ],
-    "mqtt-io": [
+            "v": "<1.15.3"
+        },
         {
-            "advisory": "Mqtt-io 0.5.2 updates PyYAML to a version that doesn't suffer from CVE-2020-1747 vulnerability.",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-40018",
+            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
+            "cve": "CVE-2019-15601",
+            "id": "pyup.io-39713",
             "specs": [
-                "<0.5.2"
+                "<1.15.3"
             ],
-            "v": "<0.5.2"
-        }
-    ],
-    "mr.migrator": [
+            "v": "<1.15.3"
+        },
         {
-            "advisory": "Mr.migrator 1.2 fixes a form problem with security hotfix from its dependency package 'Plone'.\r\nhttps://plone.org/security/hotfix/20160830",
-            "cve": "CVE-2016-7136",
-            "id": "pyup.io-25897",
+            "advisory": "Nvidia-tensorflow 1.15.3 includes a fix for CVE-2019-10099: Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.",
+            "cve": "CVE-2019-10099",
+            "id": "pyup.io-39715",
             "specs": [
-                "<1.2"
+                "<1.15.3"
             ],
-            "v": "<1.2"
-        }
-    ],
-    "msgpack": [
+            "v": "<1.15.3"
+        },
         {
-            "advisory": "msgpack 0.6.0 contains some backward incompatible changes for security reason (DoS).",
-            "cve": "PVE-2021-36700",
-            "id": "pyup.io-36700",
+            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
+            "cve": "CVE-2018-11770",
+            "id": "pyup.io-38797",
             "specs": [
-                "<0.6.0"
+                "<1.15.3"
             ],
-            "v": "<0.6.0"
-        }
-    ],
-    "mss": [
+            "v": "<1.15.3"
+        },
         {
-            "advisory": "mss before 2.0.18 has a undisclosed security issue.",
-            "cve": "PVE-2021-25898",
-            "id": "pyup.io-25898",
+            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
+            "cve": "CVE-2019-19880",
+            "id": "pyup.io-39710",
             "specs": [
-                "<2.0.18"
+                "<1.15.3"
             ],
-            "v": "<2.0.18"
-        }
-    ],
-    "msticpy": [
+            "v": "<1.15.3"
+        },
         {
-            "advisory": "Msticpy 1.1.0 updates its dependency 'lxml' to v4.6.3 to include security fixes.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-40859",
+            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
+            "cve": "CVE-2019-19244",
+            "id": "pyup.io-39712",
             "specs": [
-                "<1.1.0"
+                "<1.15.3"
             ],
-            "v": "<1.1.0"
+            "v": "<1.15.3"
         },
         {
-            "advisory": "Msticpy 1.1.0 updates its dependency 'lxml' to v4.6.3 to include security fixes.",
-            "cve": "PVE-2021-39195",
-            "id": "pyup.io-43645",
+            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
+            "cve": "CVE-2019-13960",
+            "id": "pyup.io-39714",
             "specs": [
-                "<1.1.0"
+                "<1.15.3"
             ],
-            "v": "<1.1.0"
+            "v": "<1.15.3"
         },
         {
-            "advisory": "Msticpy 1.1.0 updates its dependency 'lxml' to v4.6.3 to include security fixes.",
-            "cve": "CVE-2020-27783",
-            "id": "pyup.io-43646",
+            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
+            "cve": "CVE-2018-17190",
+            "id": "pyup.io-39718",
             "specs": [
-                "<1.1.0"
+                "<1.15.3"
             ],
-            "v": "<1.1.0"
+            "v": "<1.15.3"
         },
         {
-            "advisory": "Msticpy 1.1.0 updates its dependency 'lxml' to v4.6.3 to include security fixes.",
-            "cve": "CVE-2014-3146",
-            "id": "pyup.io-43647",
+            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
+            "cve": "CVE-2018-20330",
+            "id": "pyup.io-39716",
             "specs": [
-                "<1.1.0"
+                "<1.15.3"
             ],
-            "v": "<1.1.0"
+            "v": "<1.15.3"
         },
         {
-            "advisory": "Msticpy 1.1.0 updates its dependency 'aiohttp' to v3.7.4 to include a security fix.",
-            "cve": "CVE-2021-21330",
-            "id": "pyup.io-43648",
+            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
+            "cve": "CVE-2018-19664",
+            "id": "pyup.io-39717",
             "specs": [
-                "<1.1.0"
+                "<1.15.3"
             ],
-            "v": "<1.1.0"
-        }
-    ],
-    "mstr-rest-requests": [
+            "v": "<1.15.3"
+        },
         {
-            "advisory": "Mstr-rest-requests 0.12.4 fixes some security issues related to dependencies.",
-            "cve": "PVE-2021-42214",
-            "id": "pyup.io-42214",
+            "advisory": "Nvidia-tensorflow 1.15.2\r\n* Fixes a security vulnerability where converting a Python string to a `tf.float16` value produces a segmentation fault (CVE-2020-5215)",
+            "cve": "CVE-2020-5215",
+            "id": "pyup.io-38455",
             "specs": [
-                "<0.12.4"
+                ">=1.0.0,<1.15.2"
             ],
-            "v": "<0.12.4"
-        }
-    ],
-    "mtga": [
+            "v": ">=1.0.0,<1.15.2"
+        },
         {
-            "advisory": "mtga 2.0.0beta includes API security improvements & fixes.",
-            "cve": "PVE-2021-36317",
-            "id": "pyup.io-36317",
+            "advisory": "Nvidia-tensorflow 1.15.2 updates 'sqlite3' dependency to 3.30.01 to handle CVE-2019-16168: In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"",
+            "cve": "CVE-2019-16168",
+            "id": "pyup.io-39582",
             "specs": [
-                "<2.0.0beta"
+                ">=1.0.0,<1.15.2"
             ],
-            "v": "<2.0.0beta"
-        }
-    ],
-    "mtprotoproxy": [
+            "v": ">=1.0.0,<1.15.2"
+        },
         {
-            "advisory": "mtprotoproxy before 1.0.0 has the potential to allow for passive detection given known string lengths.\r\nV1.0.0 now adds random paddings to prevent this.",
-            "cve": "PVE-2021-36301",
-            "id": "pyup.io-36301",
+            "advisory": "Nvidia-tensorflow 1.15.2 updates 'sqlite3' dependency to 3.30.01 to handle CVE-2019-19645: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
+            "cve": "CVE-2019-19645",
+            "id": "pyup.io-39583",
             "specs": [
-                "<1.0.0"
+                ">=1.0.0,<1.15.2"
             ],
-            "v": "<1.0.0"
+            "v": ">=1.0.0,<1.15.2"
         },
         {
-            "advisory": "Mtprotoproxy 1.0.6 adds more protections from replay attacks.",
-            "cve": "PVE-2021-37407",
-            "id": "pyup.io-37407",
+            "advisory": "Nvidia-tensorflow 1.15.2 updates 'sqlite3' dependency to 3.30.01 to handle CVE-2019-19646: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.",
+            "cve": "CVE-2019-19646",
+            "id": "pyup.io-39584",
             "specs": [
-                "<1.0.6"
+                ">=1.0.0,<1.15.2"
             ],
-            "v": "<1.0.6"
-        }
-    ],
-    "muffnn": [
+            "v": ">=1.0.0,<1.15.2"
+        },
         {
-            "advisory": "Muffnn 2.3.1 increases the minimum version of tensorflow to v1.15.2 to fix a security vulnerability.",
-            "cve": "PVE-2021-38154",
-            "id": "pyup.io-38154",
+            "advisory": "Nvidia-tensorflow 1.15.2 updates `curl` to `7.66.0` to handle CVE-2019-5481.",
+            "cve": "CVE-2019-5481",
+            "id": "pyup.io-39585",
             "specs": [
-                "<2.3.1"
+                ">=1.0.0,<1.15.2"
             ],
-            "v": "<2.3.1"
-        },
+            "v": ">=1.0.0,<1.15.2"
+        }
+    ],
+    "oauth-pyzure": [
         {
-            "advisory": "Muffnn 2.3.2 increases the minimum version of 'tensorflow' to version 1.15.4 to fix the security vulnerability reported in <https://github.com/advisories/GHSA-4g9f-63rx-5cw4>.",
-            "cve": "PVE-2021-39222",
-            "id": "pyup.io-39222",
+            "advisory": "Oauth-pyzure 0.1.4 is based on OSS vulnerability reports.",
+            "cve": "PVE-2021-39077",
+            "id": "pyup.io-39077",
             "specs": [
-                "<2.3.2"
+                "<0.1.4"
             ],
-            "v": "<2.3.2"
+            "v": "<0.1.4"
         }
     ],
-    "multi-model-server": [
+    "oauth2": [
         {
-            "advisory": "Multi-model-server 1.1.5 updates its dependency 'log4j' to v2.16.0 to fix critical vulnerabilities.\r\nhttps://github.com/awslabs/multi-model-server/commit/664b188156ef2c7312cc6be39230e8f6667593ac",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43405",
+            "advisory": "The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.",
+            "cve": "CVE-2013-4346",
+            "id": "pyup.io-35462",
             "specs": [
-                "<1.1.5"
+                "<1.9"
             ],
-            "v": "<1.1.5"
+            "v": "<1.9"
         },
         {
-            "advisory": "Multi-model-server 1.1.5 updates its dependency 'log4j' to v2.16.0 to fix critical vulnerabilities.\r\nhttps://github.com/awslabs/multi-model-server/commit/664b188156ef2c7312cc6be39230e8f6667593ac",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43404",
+            "advisory": "The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.",
+            "cve": "CVE-2013-4347",
+            "id": "pyup.io-35463",
             "specs": [
-                "<1.1.5"
+                "<1.9"
             ],
-            "v": "<1.1.5"
-        },
+            "v": "<1.9"
+        }
+    ],
+    "oauthlib": [
         {
-            "advisory": "Multi-model-server 1.1.7 updates its dependency 'log4j' to v2.17.0 to fix a severe vulnerability.\r\nhttps://github.com/awslabs/multi-model-server/commit/2499f5e7a60b998eb6de74c6a932571ef25bf7e7",
-            "cve": "CVE-2021-45105",
-            "id": "pyup.io-43438",
+            "advisory": "oauthlib before 0.7.0 is not stripping client provided passwords from OAuth2 logs.",
+            "cve": "PVE-2021-25909",
+            "id": "pyup.io-25909",
             "specs": [
-                "<1.1.7"
+                "<0.7.0"
             ],
-            "v": "<1.1.7"
+            "v": "<0.7.0"
         }
     ],
-    "murano-dashboard": [
+    "obasparql": [
         {
-            "advisory": "OpenStack Murano before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), Murano-dashboard before 1.0.3 (liberty) and 2.x before 2.0.1 (mitaka), and python-muranoclient before 0.7.3 (liberty) and 0.8.x before 0.8.5 (mitaka) improperly use loaders inherited from yaml.Loader when parsing MuranoPL and UI files, which allows remote attackers to create arbitrary Python objects and execute arbitrary code via crafted extended YAML tags in UI definitions in packages.",
-            "cve": "CVE-2016-4972",
-            "id": "pyup.io-25899",
+            "advisory": "Obasparql 2.0.1 bumps werkzeug to >= 0.15.3 to address CVE-2019-14806.",
+            "cve": "CVE-2019-14806",
+            "id": "pyup.io-38322",
             "specs": [
-                ">=2.0,<2.0.1",
-                "<1.0.3"
+                "<2.0.1"
             ],
-            "v": ">=2.0,<2.0.1,<1.0.3"
+            "v": "<2.0.1"
         }
     ],
-    "music21": [
+    "obsplus": [
         {
-            "advisory": "Music21 6.1.0 is no longer packaged with external modules; these will be installed when installing music21 via pip (otherwise run `pip install -r requirements.txt`).  Speed and security improvements come with this.",
-            "cve": "PVE-2021-38746",
-            "id": "pyup.io-38746",
+            "advisory": "Obsplus 0.0.6 switched from MD5 hashing to SHA256 as the latter is more secure and the computational differences were negligible.",
+            "cve": "PVE-2021-38088",
+            "id": "pyup.io-38088",
             "specs": [
-                "<6.1.0"
+                "<0.0.6"
             ],
-            "v": "<6.1.0"
+            "v": "<0.0.6"
         }
     ],
-    "mxnet": [
+    "oci": [
         {
-            "advisory": "In mxnet before 1.0.0, mxnet listens on all available interfaces when running training in distributed mode.",
-            "cve": "PVE-2021-35115",
-            "id": "pyup.io-35115",
+            "advisory": "Oci version 2.0.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.",
+            "cve": "CVE-2018-10903",
+            "id": "pyup.io-37415",
             "specs": [
-                "<1.0.0"
+                "<2.0.2"
             ],
-            "v": "<1.0.0"
+            "v": "<2.0.2"
         },
         {
-            "advisory": "Mxnet between versions 1.4.0 and 1.6.0 (included) use a version of 'log4j' affected by critical and severe vulnerabilities.",
-            "cve": "CVE-2021-45105",
-            "id": "pyup.io-43449",
+            "advisory": "Oci 2.1.3 includes a fix for CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
+            "cve": "CVE-2018-1000808",
+            "id": "pyup.io-36786",
             "specs": [
-                ">=1.4.0,<=1.6.0"
+                "<2.1.3"
             ],
-            "v": ">=1.4.0,<=1.6.0"
+            "v": "<2.1.3"
         },
         {
-            "advisory": "Mxnet between versions 1.4.0 and 1.6.0 (included) use a version of 'log4j' affected by critical and severe vulnerabilities.",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43448",
+            "advisory": "Oci version 2.1.3 includes a fix for CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
+            "cve": "CVE-2018-1000808",
+            "id": "pyup.io-37831",
             "specs": [
-                ">=1.4.0,<=1.6.0"
+                "<2.1.3"
             ],
-            "v": ">=1.4.0,<=1.6.0"
+            "v": "<2.1.3"
         },
         {
-            "advisory": "Mxnet between versions 1.4.0 and 1.6.0 (included) use a version of 'log4j' affected by critical and severe vulnerabilities.",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43442",
+            "advisory": "Oci version 2.10.0 includes a fix for CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
+            "cve": "CVE-2018-1000808",
+            "id": "pyup.io-37830",
             "specs": [
-                ">=1.4.0,<=1.6.0"
+                "<2.10.0"
             ],
-            "v": ">=1.4.0,<=1.6.0"
-        }
-    ],
-    "mypwd": [
+            "v": "<2.10.0"
+        },
         {
-            "advisory": "Mypwd 0.4.0 includes security improvements related to data validation.",
-            "cve": "PVE-2021-41990",
-            "id": "pyup.io-41990",
+            "advisory": "Oci 2.24.1 pins cryptography to version 3.2.1 to address a vulnerability. See: <https://github.com/oracle/oci-python-sdk/pull/299>.",
+            "cve": "PVE-2021-39212",
+            "id": "pyup.io-39212",
             "specs": [
-                "<0.4.0"
+                "<2.24.1"
             ],
-            "v": "<0.4.0"
-        }
-    ],
-    "mysql-connector": [
+            "v": "<2.24.1"
+        },
         {
-            "advisory": "Unspecified vulnerability in the MySQL Connector component 2.1.3 and earlier and 2.0.4 and earlier in Oracle MySQL allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Connector/Python.",
-            "cve": "CVE-2016-5598",
-            "id": "pyup.io-25900",
+            "advisory": "Oci 2.37.0 updates the 'cryptography' dependency version to 3.3.2 to address a security vulnerability.",
+            "cve": "PVE-2021-40377",
+            "id": "pyup.io-40377",
             "specs": [
-                "<2.1.3"
+                "<2.37.0"
             ],
-            "v": "<2.1.3"
+            "v": "<2.37.0"
         }
     ],
-    "mysql-connector-python": [
+    "oci-cli": [
         {
-            "advisory": "Unspecified vulnerability in the MySQL Connector component 2.1.3 and earlier and 2.0.4 and earlier in Oracle MySQL allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Connector/Python.",
-            "cve": "CVE-2016-5598",
-            "id": "pyup.io-25901",
+            "advisory": "Oci-cli 2.22.1 adds support for the 'Vulnerability Scanning' service (as 'oci vulnerability-scanning' command).",
+            "cve": "PVE-2021-40200",
+            "id": "pyup.io-40200",
             "specs": [
-                "<2.0.4"
+                "<2.22.1"
             ],
-            "v": "<2.0.4"
+            "v": "<2.22.1"
         },
         {
-            "advisory": "Vulnerability in the MySQL Connectors component of Oracle MySQL (subcomponent: Connector/Python). Supported versions that are affected are 8.0.13 and prior and 2.1.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network access via TLS to compromise MySQL Connectors. Successful attacks require human interaction from a person other than the attacker. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all MySQL Connectors accessible data as well as unauthorized access to critical data or complete access to all MySQL Connectors accessible data.",
-            "cve": "CVE-2019-2435",
-            "id": "pyup.io-36816",
+            "advisory": "Oci-cli 2.24.0 drops support for Python 3.5. Due to a possible security issue in the version of the dependent cryptography package, its version has been bumped to 3.3.2. This version does not support Python 3.5.",
+            "cve": "PVE-2021-40255",
+            "id": "pyup.io-40255",
             "specs": [
-                "<=8.0.13"
+                "<2.24.0"
             ],
-            "v": "<=8.0.13"
-        }
-    ],
-    "naas": [
+            "v": "<2.24.0"
+        },
         {
-            "advisory": "Naas 1.17.15 updates its dependency naas-drivers to version 0.66.7. That version of naas-drivers includes a security fix: adds sensitive for randint.",
-            "cve": "PVE-2021-41245",
-            "id": "pyup.io-41245",
+            "advisory": "Oci-cli 2.24.4 upgrades the 'Py' dependency to version 1.10.0 to address a vulnerability (CVE-2020-29651).",
+            "cve": "CVE-2020-29651",
+            "id": "pyup.io-40831",
             "specs": [
-                "<1.17.15"
+                "<2.24.4"
             ],
-            "v": "<1.17.15"
+            "v": "<2.24.4"
         },
         {
-            "advisory": "Naas 1.5.22 includes a security issue fix.",
-            "cve": "PVE-2021-40076",
-            "id": "pyup.io-40076",
+            "advisory": "Versions of oci-cli prior to 2.4.10 are affected by a security vulnerability. Versions 2.4.11 and later will automatically detect vulnerable installations, and if issues are detected, a warning will be displayed to the user. These issues can be remediated automatically by running the ``oci setup repair-file-permissions`` command.",
+            "cve": "PVE-2021-36148",
+            "id": "pyup.io-36148",
             "specs": [
-                "<1.5.22"
+                "<2.4.10"
             ],
-            "v": "<1.5.22"
-        }
-    ],
-    "naas-drivers": [
+            "v": "<2.4.10"
+        },
         {
-            "advisory": "Naas-drivers 0.66.7 adds sensitive for randint. This is a security measure.",
-            "cve": "PVE-2021-40871",
-            "id": "pyup.io-40871",
+            "advisory": "Oci-cli 2.4.40 includes a fix for CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
+            "cve": "CVE-2018-1000808",
+            "id": "pyup.io-36804",
             "specs": [
-                "<0.66.7"
+                "<2.4.40"
             ],
-            "v": "<0.66.7"
-        }
-    ],
-    "nanopb": [
+            "v": "<2.4.40"
+        },
         {
-            "advisory": "Nanopb 0.2.8 fixes a security issue with PB_ENABLE_MALLOC.",
-            "cve": "PVE-2021-37705",
-            "id": "pyup.io-37705",
+            "advisory": "Oci-cli 2.5.9 upgrades Jinja2 to version 2.10.1 to address a vulnerability identified on GitHub as CVE-2019-10906. Jinga isn't used in Oci-cli's run-time system but as part of its documentation build process.",
+            "cve": "CVE-2019-10906",
+            "id": "pyup.io-37139",
             "specs": [
-                "<0.2.8"
+                "<2.5.9"
             ],
-            "v": "<0.2.8"
+            "v": "<2.5.9"
         },
         {
-            "advisory": "Nanopb 0.2.9.1 fixes a security issue due to size_t overflows.",
-            "cve": "PVE-2021-37808",
-            "id": "pyup.io-37808",
+            "advisory": "Oci-cli 2.6.3 fixes CVE-2017-18342. In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-37417",
             "specs": [
-                "<0.2.9.1"
+                "<2.6.3"
             ],
-            "v": "<0.2.9.1"
-        },
+            "v": "<2.6.3"
+        }
+    ],
+    "octavia": [
         {
-            "advisory": "Nanopb before 0.3.1 fixes a security issue due to size_t overflows.",
-            "cve": "PVE-2021-37704",
-            "id": "pyup.io-37704",
+            "advisory": "An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image. See: CVE-2019-3895.",
+            "cve": "CVE-2019-3895",
+            "id": "pyup.io-37192",
             "specs": [
-                "<0.3.1"
+                "<0.9.0"
             ],
-            "v": "<0.3.1"
+            "v": "<0.9.0"
         },
         {
-            "advisory": "Nanopb 0.2.9.1 and 0.3.1 fix a security issue due to size_t overflows (issue 132).",
-            "cve": "PVE-2021-37706",
-            "id": "pyup.io-37706",
+            "advisory": "Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.",
+            "cve": "CVE-2019-17134",
+            "id": "pyup.io-37547",
             "specs": [
-                ">=0.3.0,<0.3.1",
-                ">=0.2.0,<0.2.9.1"
+                ">=0.10.0,<2.1.2",
+                ">=3.0.0,<3.2.0",
+                ">=4.0.0,<4.1.0"
             ],
-            "v": ">=0.3.0,<0.3.1,>=0.2.0,<0.2.9.1"
+            "v": ">=0.10.0,<2.1.2,>=3.0.0,<3.2.0,>=4.0.0,<4.1.0"
         }
     ],
-    "natcap.invest": [
+    "oe-geoutils": [
         {
-            "advisory": "Natcap.invest 3.8.1 bumps the psutil dependency requirement to psutil>=5.6.6 to address a double-free vulnerability documented in CVE-2019-18874.",
-            "cve": "CVE-2019-18874",
-            "id": "pyup.io-38271",
+            "advisory": "Oe-geoutils 1.5.2 solves security vulnerabilities from external packages 101.",
+            "cve": "PVE-2021-37666",
+            "id": "pyup.io-37666",
             "specs": [
-                "<3.8.1"
+                "<1.5.2"
             ],
-            "v": "<3.8.1"
+            "v": "<1.5.2"
         }
     ],
-    "nba-scraper": [
+    "oem": [
         {
-            "advisory": "Nba-scraper 0.2.7 removes a security flaw where it wasn't verifying SSL certificates during testing.",
-            "cve": "PVE-2021-37142",
-            "id": "pyup.io-37142",
+            "advisory": "Oem 0.3.0 uses 'defusedxml' to handle XML-related vulnerabilities.\r\nhttps://github.com/bradsease/oem/issues/9",
+            "cve": "PVE-2021-43087",
+            "id": "pyup.io-43087",
             "specs": [
-                "<0.2.7"
+                "<0.3.0"
             ],
-            "v": "<0.2.7"
+            "v": "<0.3.0"
         }
     ],
-    "nbgitpuller": [
+    "oic": [
         {
-            "advisory": "Nbgitpuller version 0.10.2 includes a fix for CVE-2021-39160:\r\nDue to unsanitized input, visiting maliciously crafted links could result in arbitrary code execution in the user environment. No workaround exists for users who can not upgrade.",
-            "cve": "CVE-2021-39160",
-            "id": "pyup.io-41221",
+            "advisory": "In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. \r\n\r\nThe issues are: \r\n1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. \r\n2) JWA `none` algorithm was allowed in all flows. \r\n3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. \r\n4) iat claim was not checked for sanity (i.e. it could be in the future). \r\n\r\nSee CVE-2020-26244.",
+            "cve": "CVE-2020-26244",
+            "id": "pyup.io-39221",
             "specs": [
-                "<0.10.2"
+                "<1.2.1"
             ],
-            "v": "<0.10.2"
+            "v": "<1.2.1"
         }
     ],
-    "nbgrader": [
+    "okdata-cli": [
         {
-            "advisory": "Nbgrader 0.6.0 includes instructions for how to do grading inside a Docker container, for increased protection against malicious code submitted by students.",
-            "cve": "PVE-2021-40419",
-            "id": "pyup.io-40419",
+            "advisory": "Okdata-cli version 0.12.1 updates its dependency \"urlib3\" to include a security fix.",
+            "cve": "PVE-2021-41852",
+            "id": "pyup.io-41852",
             "specs": [
-                "<0.6.0"
+                "<0.12.1"
             ],
-            "v": "<0.6.0"
+            "v": "<0.12.1"
         }
     ],
-    "nbsafety": [
+    "omero-figure": [
         {
-            "advisory": "Nbsafety 0.0.69 includes minor security fixes in underlying NPM packages.",
-            "cve": "PVE-2021-40540",
-            "id": "pyup.io-40540",
+            "advisory": "Omero-figure 4.4.1 includes a fix for CVE-2021-41132, which also affects the related package 'OMERO.web'.\r\nhttps://www.openmicroscopy.org/security/advisories/2021-SV3",
+            "cve": "CVE-2021-41132",
+            "id": "pyup.io-42156",
             "specs": [
-                "<0.0.69"
+                "<4.4.1"
             ],
-            "v": "<0.0.69"
-        },
+            "v": "<4.4.1"
+        }
+    ],
+    "omero-web": [
         {
-            "advisory": "Nbsafety version 0.0.75 updates its frontend dependencies to more secure versions.",
-            "cve": "PVE-2021-41796",
-            "id": "pyup.io-41796",
+            "advisory": "Omero-web 5.11.0 includes a fix for CVE-2021-41132: In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of 'jQuery.html()', there are a whole of cross-site scripting possibilities with specially crafted input to a variety of fields.\r\nhttps://www.openmicroscopy.org/security/advisories/2021-SV3",
+            "cve": "CVE-2021-41132",
+            "id": "pyup.io-42157",
             "specs": [
-                "<0.0.75"
+                "<5.11.0"
             ],
-            "v": "<0.0.75"
-        }
-    ],
-    "ncbimeta": [
+            "v": "<5.11.0"
+        },
         {
-            "advisory": "Ncbimeta 0.8.0 updates the 'lxml' dependency to v4.6.2 due to a security vulnerability.",
-            "cve": "CVE-2020-27783",
-            "id": "pyup.io-40508",
+            "advisory": "OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting. See CVE-2021-21377.",
+            "cve": "CVE-2021-21377",
+            "id": "pyup.io-40089",
             "specs": [
-                "<0.8.0"
+                "<5.9.0"
             ],
-            "v": "<0.8.0"
-        }
-    ],
-    "nearbeach": [
+            "v": "<5.9.0"
+        },
         {
-            "advisory": "Nearbeach 0.22.1 fixes several security issues in relation to Bandit, identified by Nearbeach as BUG491, BUG492, BUG493, BUG494, BUG495, BUG496, BUG497, and BUG498.",
-            "cve": "PVE-2021-37602",
-            "id": "pyup.io-37602",
+            "advisory": "OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information exposure vulnerability. Some additional information being loaded is not used by the webclient and is being removed in this release. This is fixed in version 5.9.0. See CVE-2021-21376.",
+            "cve": "CVE-2021-21376",
+            "id": "pyup.io-40088",
             "specs": [
-                "<0.22.1"
+                "<5.9.0"
             ],
-            "v": "<0.22.1"
-        }
-    ],
-    "nemo": [
+            "v": "<5.9.0"
+        },
         {
-            "advisory": "Nemo 2.3.3 updates the 'Django' dependency to v2.2.13 to include security fixes.",
-            "cve": "CVE-2020-9402",
-            "id": "pyup.io-40131",
+            "advisory": "Omero-web 5.9.0 includes few security vulnerability fixes.",
+            "cve": "PVE-2021-40578",
+            "id": "pyup.io-40578",
             "specs": [
-                "<2.3.3"
+                "<5.9.0"
             ],
-            "v": "<2.3.3"
-        },
+            "v": "<5.9.0"
+        }
+    ],
+    "omnikdatalogger": [
         {
-            "advisory": "Nemo 2.3.3 updates the 'Django' dependency to v2.2.13 to include security fixes.",
-            "cve": "CVE-2020-13254",
-            "id": "pyup.io-43666",
+            "advisory": "Omnikdatalogger 1.10.4 uses secure connection (HTTPS) to interact with PVOutput website.\r\nhttps://github.com/jbouwh/omnikdatalogger/pull/56/commits/85eb0af91b5912295745a2ec074e71354374b8b6",
+            "cve": "PVE-2021-43353",
+            "id": "pyup.io-43353",
             "specs": [
-                "<2.3.3"
+                "<1.10.4"
             ],
-            "v": "<2.3.3"
-        },
+            "v": "<1.10.4"
+        }
+    ],
+    "omnizart": [
         {
-            "advisory": "Nemo 2.3.3 updates the 'Django' dependency to v2.2.13 to include security fixes.",
-            "cve": "CVE-2020-13596",
-            "id": "pyup.io-43665",
+            "advisory": "Omnizart 0.3.3 updates its dependencies to address a security issue.",
+            "cve": "PVE-2021-40422",
+            "id": "pyup.io-40422",
             "specs": [
-                "<2.3.3"
+                "<0.3.3"
             ],
-            "v": "<2.3.3"
-        },
+            "v": "<0.3.3"
+        }
+    ],
+    "onefuzz": [
         {
-            "advisory": "Nemo 3.6.0 updates the 'cryptography' dependency due to vulnerability in the previous version.",
-            "cve": "PVE-2021-40130",
-            "id": "pyup.io-40130",
+            "advisory": "Onefuzz 2.5.0 updates multiple third-party Rust libraries.  Addresses potential security issue [RUSTSEC-2021-0023].",
+            "cve": "PVE-2021-39624",
+            "id": "pyup.io-39624",
             "specs": [
-                "<3.6.0"
+                "<2.5.0"
             ],
-            "v": "<3.6.0"
+            "v": "<2.5.0"
         },
         {
-            "advisory": "Nemo 3.8.0 updates the 'cryptography' dependency due to vulnerability in the previous version.",
-            "cve": "PVE-2021-40129",
-            "id": "pyup.io-40129",
+            "advisory": "Onefuzz 2.7.0 includes a fix for CVE-2020-28493: This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.",
+            "cve": "CVE-2020-28493",
+            "id": "pyup.io-39676",
             "specs": [
-                "<3.8.0"
+                "<2.7.0"
             ],
-            "v": "<3.8.0"
+            "v": "<2.7.0"
         },
         {
-            "advisory": "Nemo 3.9.2 updates its dependency 'Django' to v2.2.20 to include a security fix.",
-            "cve": "CVE-2021-28658",
-            "id": "pyup.io-40184",
+            "advisory": "OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default --multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information, security testing tools and proprietary code and symbols. Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.",
+            "cve": "CVE-2021-37705",
+            "id": "pyup.io-42319",
             "specs": [
-                "<3.9.2"
+                ">=2.12.0,<2.31.0"
             ],
-            "v": "<3.9.2"
+            "v": ">=2.12.0,<2.31.0"
         }
     ],
-    "neo-python": [
+    "onegov.form": [
         {
-            "advisory": "neo-python 0.7.8 fixes vulnerability to RPC invoke functionality that can send node into unclosed loop during 'test' invokes.",
-            "cve": "PVE-2021-36441",
-            "id": "pyup.io-36441",
+            "advisory": "onegov.form before 0.16.1 is not escaping HTML labels in the dynamic formbuilder.\nhttps://github.com/OneGov/onegov.form/commit/abce4e1ca620de244460f005f9d2412683552f30",
+            "cve": "PVE-2021-25911",
+            "id": "pyup.io-25911",
             "specs": [
-                "<0.7.8"
+                "<0.16.1"
             ],
-            "v": "<0.7.8"
+            "v": "<0.16.1"
         }
     ],
-    "neomodel": [
+    "onelogin-aws-assume-role": [
         {
-            "advisory": "Neomodel 4.0.5 fixes issue with enforcing secure URI scheme (+s).",
-            "cve": "PVE-2021-41773",
-            "id": "pyup.io-41773",
+            "advisory": "For security reasons, onelogin-aws-assume-role 1.3.0 removes the ability to provide the IP using a command line parameter and is instead able to provide the IP address at the onelogin.sdk.json file.",
+            "cve": "PVE-2021-37158",
+            "id": "pyup.io-37158",
             "specs": [
-                "<4.0.5"
+                "<1.3.0"
             ],
-            "v": "<4.0.5"
+            "v": "<1.3.0"
         }
     ],
-    "nepse-api": [
+    "onixcheck": [
         {
-            "advisory": "Nepse-api 0.3 discontinues the use of a non-maintainable 'converter.py' in 'nepse/security', the response data is now directly kept in a dataclass using 'DataClassXyz(**data)'.",
-            "cve": "PVE-2021-40589",
-            "id": "pyup.io-40589",
+            "advisory": "onixcheck 0.8.0 adds secured XML-Parsing via defusedxml.",
+            "cve": "PVE-2021-25912",
+            "id": "pyup.io-25912",
             "specs": [
-                "<0.3"
+                "<0.8.0"
             ],
-            "v": "<0.3"
+            "v": "<0.8.0"
         }
     ],
-    "netdumplings": [
+    "online-judge-tools": [
         {
-            "advisory": "Netdumplings 0.4.0 updates the websockets dependency to v7 to fix security warnings.",
-            "cve": "PVE-2021-37208",
-            "id": "pyup.io-37208",
+            "advisory": "Online-judge-tools 0.1.53 fixes a Regular Expression Injection issue and a Glob Injection issue.",
+            "cve": "PVE-2021-38902",
+            "id": "pyup.io-38902",
             "specs": [
-                "<0.4.0"
+                "<0.1.53"
             ],
-            "v": "<0.4.0"
+            "v": "<0.1.53"
         }
     ],
-    "netfoundry": [
+    "oodt": [
         {
-            "advisory": "Netfoundry 4.19.0 fixes a rake vulnerability in the `.gemspec` file.",
-            "cve": "PVE-2021-39082",
-            "id": "pyup.io-39082",
+            "advisory": "Oodt before 0.4 is vulnerable to XSS attacks via malformed query strings.\r\nhttps://issues.apache.org/jira/browse/OODT-364\r\nhttps://github.com/apache/oodt/commit/cf6ff6b5437cee01792269cc16010e595547a64d",
+            "cve": "PVE-2021-25913",
+            "id": "pyup.io-25913",
             "specs": [
-                "<4.19.0"
+                "<0.4"
             ],
-            "v": "<4.19.0"
+            "v": "<0.4"
         }
     ],
-    "netius": [
+    "ooniprobe": [
         {
-            "advisory": "netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling. HTTP pipelining issues and request smuggling attacks might be possible due to incorrect Transfer encoding header parsing which could allow for CL:TE or TE:TE attacks. See: CVE-2020-7655.",
-            "cve": "CVE-2020-7655",
-            "id": "pyup.io-38316",
+            "advisory": "ooniprobe before 1.0.2 is vulnerable to several undisclosed security issues.",
+            "cve": "PVE-2021-25914",
+            "id": "pyup.io-25914",
             "specs": [
-                "<1.17.58"
+                "<1.0.2"
             ],
-            "v": "<1.17.58"
+            "v": "<1.0.2"
         }
     ],
-    "netviel": [
+    "opacus": [
         {
-            "advisory": "Netviel 0.2 fixes security vulnerabilities. No details were provided.",
-            "cve": "PVE-2021-38366",
-            "id": "pyup.io-38366",
+            "advisory": "Opacus 0.12.0 updates its dependency 'immer' to v8.0.1 to include a security fix.\r\nhttps://github.com/pytorch/opacus/commit/4e8c77f1fd909fcc97b752ac955f450a1e6d2f71",
+            "cve": "CVE-2020-28477",
+            "id": "pyup.io-42822",
             "specs": [
-                "<0.2"
+                "<0.12.0"
             ],
-            "v": "<0.2"
+            "v": "<0.12.0"
         }
     ],
-    "neuromynerva": [
+    "openapi-core": [
         {
-            "advisory": "Neuromynerva version 0.2.12 updates its dependencies to include security fixes.",
-            "cve": "PVE-2021-41797",
-            "id": "pyup.io-41797",
+            "advisory": "Openapi-core 0.13.0 includes a fix for CVE-2019-19844. It also introduces security validation with an API Key and support for HTTP security types.",
+            "cve": "CVE-2019-19844",
+            "id": "pyup.io-37894",
             "specs": [
-                "<0.2.12"
+                "<0.13.0"
             ],
-            "v": "<0.2.12"
+            "v": "<0.13.0"
         }
     ],
-    "neutron": [
+    "openapi-python-client": [
         {
-            "advisory": "OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtables-nft is used on a Netfilter-based platform. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the hardware addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. See CVE-2021-38598.\r\nhttps://launchpad.net/bugs/1938670",
-            "cve": "CVE-2021-38598",
-            "id": "pyup.io-41207",
+            "advisory": "Openapi-python-client 0.5.3 sanitizes all values that become file/directory names to address path traversal vulnerabilities (CVE-2020-15141). Additionally, due to security concerns/implementation complexities, default values are temporarily unsupported for any `RefProperty` that doesn't refer to an enum.",
+            "cve": "CVE-2020-15141",
+            "id": "pyup.io-38685",
             "specs": [
-                "<16.4.1",
-                ">=17.0.0.0rc1,<17.1.3",
-                "==18.0.0"
+                "<0.5.3"
             ],
-            "v": "<16.4.1,>=17.0.0.0rc1,<17.1.3,==18.0.0"
+            "v": "<0.5.3"
         },
         {
-            "advisory": "An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involving nonexistent controllers, an authenticated user may cause the API worker to consume increasing amounts of memory, resulting in API performance degradation or denial of service. See CVE-2021-40797. \r\nhttps://launchpad.net/bugs/1942179",
-            "cve": "CVE-2021-40797",
-            "id": "pyup.io-41285",
+            "advisory": "In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. See: CVE-2020-15142.",
+            "cve": "CVE-2020-15142",
+            "id": "pyup.io-38691",
             "specs": [
-                "<16.4.1",
-                ">=17.0.0.0rc1,<17.2.1",
-                ">=18.0.0.0rc1,<18.1.1"
+                "<0.5.3"
             ],
-            "v": "<16.4.1,>=17.0.0.0rc1,<17.2.1,>=18.0.0.0rc1,<18.1.1"
+            "v": "<0.5.3"
         },
         {
-            "advisory": "An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. Authenticated attackers can reconfigure dnsmasq via a crafted extra_dhcp_opts value.",
-            "cve": "CVE-2021-40085",
-            "id": "pyup.io-41251",
+            "advisory": "In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk. See: CVE-2020-15141.",
+            "cve": "CVE-2020-15141",
+            "id": "pyup.io-38690",
             "specs": [
-                "<16.4.1",
-                ">=17.0.0.0rc1,<17.2.1",
-                ">=18.0.0.0rc1,<18.1.1"
+                "<0.5.3"
             ],
-            "v": "<16.4.1,>=17.0.0.0rc1,<17.2.1,>=18.0.0.0rc1,<18.1.1"
+            "v": "<0.5.3"
         },
         {
-            "advisory": "An issue was discovered in OpenStack Neutron 11.x before 11.0.7, 12.x before 12.0.6, and 13.x before 13.0.3. By creating two security groups with separate/overlapping port ranges, an authenticated user may prevent Neutron from being able to configure networks on any compute nodes where those security groups are present, because of an Open vSwitch (OVS) firewall KeyError. All Neutron deployments utilizing neutron-openvswitch-agent are affected. See: CVE-2019-10876.",
-            "cve": "CVE-2019-10876",
-            "id": "pyup.io-37022",
+            "advisory": "In openapi-python-client 0.5.3, all values that get placed into python files (everything from enum names, to endpoint descriptions, to default values) are validated and/or sanitized to address arbitrary code execution vulnerabilities (CVE-2020-15142). Also, due to security concerns/implementation complexities, default values are temporarily unsupported for any `RefProperty` that doesn't refer to an enum.",
+            "cve": "CVE-2020-15142",
+            "id": "pyup.io-39581",
             "specs": [
-                ">=11.0,<11.0.7",
-                ">=12.0,<12.0.6",
-                ">=13.0,<13.0.3"
+                "<0.5.3"
             ],
-            "v": ">=11.0,<11.0.7,>=12.0,<12.0.6,>=13.0,<13.0.3"
-        },
+            "v": "<0.5.3"
+        }
+    ],
+    "opendp-smartnoise-core": [
         {
-            "advisory": "A flaw was found in openstack-neutron's default Open vSwitch firewall rules. By sending carefully crafted packets, anyone in control of a server instance connected to the virtual switch can impersonate the IPv6 addresses of other systems on the network, resulting in denial of service or in some cases possibly interception of traffic intended for other destinations. Only deployments using the Open vSwitch driver are affected. Source: OpenStack project. Versions before openstack-neutron 15.3.3, openstack-neutron 16.3.1 and openstack-neutron 17.1.1 are affected.",
-            "cve": "CVE-2021-20267",
-            "id": "pyup.io-40569",
+            "advisory": "Opendp-smartnoise-core 0.1.1 enables 'protect_floating_point' by default, to protect better real-valued queries.",
+            "cve": "PVE-2022-44443",
+            "id": "pyup.io-44443",
             "specs": [
-                ">=15.3.0a1,<15.3.3",
-                ">=16.3.0a1,<16.3.1",
-                ">=17.1.0a1,<17.1.1"
+                "<0.1.1"
             ],
-            "v": ">=15.3.0a1,<15.3.3,>=16.3.0a1,<16.3.1,>=17.1.0a1,<17.1.1"
+            "v": "<0.1.1"
         }
     ],
-    "newrelic": [
+    "openslides": [
         {
-            "advisory": "New Relic agents run explain plans for Slow Transaction Traces and Slow SQL Queries. Previous versions of the agents would run an explain plan on the SQL query by prepending the query with explain. This may cause an issue when there are multiple statements separated by semicolons in a single query. The first statement in the string returns its explain plan, but any subsequent statement after that may execute as a general SQL statement. Depending on the language, library, and database, the agent may return the results of the additional statements to New Relic. It is also possible that the additional statements could execute an additional INSERT or UPDATE command. With this security update, New Relic agents will no longer run explain plans on any query that contains a semicolon as a statement separator.",
-            "cve": "PVE-2021-35805",
-            "id": "pyup.io-35805",
+            "advisory": "Openslides 2.1 validates HTML strings from CKEditor against XSS attacks.\r\nhttps://github.com/OpenSlides/OpenSlides/pull/2896",
+            "cve": "PVE-2021-34681",
+            "id": "pyup.io-34681",
             "specs": [
-                ">=1.1.0.192,<=2.106.0.87"
+                "<2.1"
             ],
-            "v": ">=1.1.0.192,<=2.106.0.87"
-        }
-    ],
-    "newsletter": [
+            "v": "<2.1"
+        },
         {
-            "advisory": "newsletter 0.1.17pre in newsletterapp is now more secure by default.  Does not setup default users for admin section.",
-            "cve": "PVE-2021-25902",
-            "id": "pyup.io-25902",
+            "advisory": "Openslides 2.1 fixes an issue in which comments were shown for unprivileged users.\r\nhttps://github.com/OpenSlides/OpenSlides/pull/2872",
+            "cve": "PVE-2021-42733",
+            "id": "pyup.io-42733",
             "specs": [
-                "<0.1.17pre"
+                "<2.1"
             ],
-            "v": "<0.1.17pre"
+            "v": "<2.1"
         }
     ],
-    "nf-core": [
+    "openstack-keystone": [
         {
-            "advisory": "Nf-core 1.7 uses yaml.safe_load() to fix a code execution vulnerability.\r\nhttps://github.com/nf-core/tools/commit/8946dc988792c844f4018c993fdef5711705b67a",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-43380",
+            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times. See: CVE-2020-12692.",
+            "cve": "CVE-2020-12692",
+            "id": "pyup.io-38260",
             "specs": [
-                "<1.7"
+                "<15.0.1",
+                "==16.0.0"
             ],
-            "v": "<1.7"
-        }
-    ],
-    "nfw": [
+            "v": "<15.0.1,==16.0.0"
+        },
         {
-            "advisory": "nfw before 0.0.7 is vulnerable to SQL-injection attacks.",
-            "cve": "PVE-2021-32994",
-            "id": "pyup.io-32994",
+            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access. See: CVE-2020-12690.",
+            "cve": "CVE-2020-12690",
+            "id": "pyup.io-38258",
             "specs": [
-                "<0.0.7"
+                "<15.0.1",
+                "==16.0.0"
             ],
-            "v": "<0.0.7"
-        }
-    ],
-    "ngraph-mxnet": [
+            "v": "<15.0.1,==16.0.0"
+        },
         {
-            "advisory": "ngraph-mxnet 1.0.0 fixed a security bug that is causing MXNet to listen on all available interfaces when running training in distributed mode.",
-            "cve": "PVE-2021-36701",
-            "id": "pyup.io-36701",
+            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. See: CVE-2020-12691.",
+            "cve": "CVE-2020-12691",
+            "id": "pyup.io-38259",
             "specs": [
-                "<1.0.0"
+                "<15.0.1",
+                "==16.0.0"
             ],
-            "v": "<1.0.0"
-        }
-    ],
-    "niche-vlaanderen": [
+            "v": "<15.0.1,==16.0.0"
+        },
         {
-            "advisory": "Niche-vlaanderen version 1.1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/inbo/niche_vlaanderen/commit/cc1977d54a9267adf58bffbf0c275fb2c39bcfe8#diff-e87949fbb87229b550bad3c2ea146c46e0e1dc785be97a055eb067b3b3ec874b",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41352",
+            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. See: CVE-2020-12689.",
+            "cve": "CVE-2020-12689",
+            "id": "pyup.io-38257",
             "specs": [
-                "<1.1"
+                "<15.0.1",
+                "==16.0.0"
             ],
-            "v": "<1.1"
-        }
-    ],
-    "nifcloud": [
+            "v": "<15.0.1,==16.0.0"
+        },
         {
-            "advisory": "Nifcloud 0.1.7 updates dependencies to fix a vulnerability.",
-            "cve": "PVE-2021-37098",
-            "id": "pyup.io-37098",
+            "advisory": "OpenStack Keystone 15.0.0 and 16.0.0 are affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.) See: CVE-2019-19687.",
+            "cve": "CVE-2019-19687",
+            "id": "pyup.io-38588",
             "specs": [
-                "<0.1.7"
+                "==15.0.0",
+                "==16.0.0"
             ],
-            "v": "<0.1.7"
-        }
-    ],
-    "nimview": [
+            "v": "==15.0.0,==16.0.0"
+        },
         {
-            "advisory": "Nimview 0.1.2 adds a (weak) CSRF check.",
-            "cve": "PVE-2021-41725",
-            "id": "pyup.io-41725",
+            "advisory": "HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. See: CVE-2013-2255.",
+            "cve": "CVE-2013-2255",
+            "id": "pyup.io-37620",
             "specs": [
-                "<0.1.2"
+                "==2013"
             ],
-            "v": "<0.1.2"
+            "v": "==2013"
+        },
+        {
+            "advisory": "It is possible to remotely trigger a crash in Keystone by sending an extremely long password. When Keystone is validating the password, glibc allocates space on the stack for the entire password. If the password is long enough, stack space can be exhausted, resulting in a crash. This vulnerability is mitigated by a patch to impose a reasonable limit on password length (4 kB). Reportedly, all versions are affected. See also: CVE-2012-1572 and https://security.openstack.org/ossa/OSSA-2012-002.html.",
+            "cve": "CVE-2012-1572",
+            "id": "pyup.io-37740",
+            "specs": [
+                ">0"
+            ],
+            "v": ">0"
+        },
+        {
+            "advisory": "Openstack-keystone 16.0.2, 17.0.1, 18.0.1 and 19.0.1 includes a fix for CVE-2021-38155: OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.",
+            "cve": "CVE-2021-38155",
+            "id": "pyup.io-41083",
+            "specs": [
+                ">=10.0.0, <16.0.2",
+                ">=17.0.0, <17.0.1",
+                ">=18.0.0, <18.0.1",
+                ">=19.0.0, <19.0.1"
+            ],
+            "v": ">=10.0.0, <16.0.2,>=17.0.0, <17.0.1,>=18.0.0, <18.0.1,>=19.0.0, <19.0.1"
         }
     ],
-    "nipyapi": [
+    "opentaxii": [
         {
-            "advisory": "Nipyapi 0.16.2 updates its dependency 'lxml' minimum version to v4.6.2 to include a security fix.",
-            "cve": "CVE-2020-27783",
-            "id": "pyup.io-42904",
+            "advisory": "opentaxii 0.1.11 requires recent version of `lxml` for security reasons.",
+            "cve": "PVE-2021-36897",
+            "id": "pyup.io-36897",
             "specs": [
-                "<0.16.2"
+                "<0.1.11"
             ],
-            "v": "<0.16.2"
+            "v": "<0.1.11"
         }
     ],
-    "njmls": [
+    "opentera": [
         {
-            "advisory": "Njmls version 0.0.3 includes a security patch for the function 'parse_row' in 'njmls.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/AlJohri/njmls/commit/a1b9aeca58512a4cba4262dc0233a6c8a14e26ab#diff-cc30712c59b1650a88a14f9c620608aaac65c3b1e35f006486ca7ec146f7f826",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41353",
+            "advisory": "Opentera 1.0.9 adds missing service access checks to the Service API.\r\nhttps://github.com/introlab/opentera/commit/4aa0361f6cd3faa395df6a43755fd197677c5528",
+            "cve": "PVE-2021-42960",
+            "id": "pyup.io-42960",
             "specs": [
-                "<0.0.3"
+                "<1.0.9"
             ],
-            "v": "<0.0.3"
+            "v": "<1.0.9"
         }
     ],
-    "nkocr": [
+    "openvino": [
         {
-            "advisory": "Nkocr 2.0.0 includes  a dependency security update.",
-            "cve": "PVE-2021-40152",
-            "id": "pyup.io-40152",
+            "advisory": "Openvino 2020.3.1 includes security and functionality bug fixes, and minor capability changes.",
+            "cve": "PVE-2021-40082",
+            "id": "pyup.io-40082",
             "specs": [
-                "<2.0.0"
+                "<2020.3.1"
             ],
-            "v": "<2.0.0"
+            "v": "<2020.3.1"
         },
         {
-            "advisory": "Nkocr 2.0.1 updates dependencies for security reasons.",
-            "cve": "PVE-2021-40151",
-            "id": "pyup.io-40151",
+            "advisory": "Openvino 2021.2 includes GNA related security fixes.\r\nhttps://github.com/openvinotoolkit/openvino/pull/3167",
+            "cve": "PVE-2021-42847",
+            "id": "pyup.io-42847",
             "specs": [
-                "<2.0.1"
+                "<2021.2"
             ],
-            "v": "<2.0.1"
-        }
-    ],
-    "nltk": [
+            "v": "<2021.2"
+        },
         {
-            "advisory": "Nltk 3.6.5 includes a fix for CVE-2021-43854: Versions prior to 3.6.5 are vulnerable to regular expression denial of service (ReDoS) attacks. The vulnerability is present in PunktSentenceTokenizer, sent_tokenize and word_tokenize. Any users of this class, or these two functions, are vulnerable to the ReDoS attack. In short, a specifically crafted long input to any of these vulnerable functions will cause them to take a significant amount of execution time. If your program relies on any of the vulnerable functions for tokenizing unpredictable user input, it's strongly recommended upgrading to a version of NLTK without the vulnerability. For users unable to upgrade the execution time can be bounded by limiting the maximum length of an input to any of the vulnerable functions.\r\nhttps://github.com/nltk/nltk/security/advisories/GHSA-f8m6-h2c7-8h9x",
-            "cve": "CVE-2021-43854",
-            "id": "pyup.io-43622",
+            "advisory": "Openvino 2021.3 includes GNA related security fixes.\r\nhttps://github.com/openvinotoolkit/openvino/pull/4538",
+            "cve": "PVE-2021-42845",
+            "id": "pyup.io-42845",
             "specs": [
-                "<3.6.5"
+                "<2021.3"
             ],
-            "v": "<3.6.5"
-        }
-    ],
-    "nni": [
+            "v": "<2021.3"
+        },
         {
-            "advisory": "Nni 2.1 fixes an arbitrary code execution security issue related to its dependency PyYAML.\r\nhttps://github.com/microsoft/nni/pull/3311",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-40661",
+            "advisory": "Openvino 2021.3 updates its dependency 'urllib3' minimum version to v1.25.9 to include a security fix.",
+            "cve": "CVE-2020-26137",
+            "id": "pyup.io-42846",
             "specs": [
-                "<2.1"
+                "<2021.3"
             ],
-            "v": "<2.1"
-        }
-    ],
-    "nobinobi-child": [
+            "v": "<2021.3"
+        },
         {
-            "advisory": "Nobinobi-child 0.1.3.6 updates requirements for a security fix.",
-            "cve": "PVE-2021-40196",
-            "id": "pyup.io-40196",
+            "advisory": "Openvino 2021.4.0 fixes a security issue with XML parsing.\r\nhttps://github.com/openvinotoolkit/openvino/pull/5686",
+            "cve": "PVE-2021-42844",
+            "id": "pyup.io-42844",
             "specs": [
-                "<0.1.3.6"
+                "<2021.4.0"
             ],
-            "v": "<0.1.3.6"
+            "v": "<2021.4.0"
         },
         {
-            "advisory": "Nobinobi-child 0.1.3.7 updates dependency requirements for a security fix.",
-            "cve": "PVE-2021-40626",
-            "id": "pyup.io-40626",
+            "advisory": "Openvino 2022.1 includes LP transformations related security fixes.\r\nhttps://github.com/openvinotoolkit/openvino/pull/8357",
+            "cve": "PVE-2021-42843",
+            "id": "pyup.io-42843",
             "specs": [
-                "<0.1.3.7"
+                "<2022.1"
             ],
-            "v": "<0.1.3.7"
+            "v": "<2022.1"
+        },
+        {
+            "advisory": "Openvino 2022.1 includes CPU related security fixes.\r\nhttps://github.com/openvinotoolkit/openvino/pull/8456",
+            "cve": "PVE-2021-42842",
+            "id": "pyup.io-42842",
+            "specs": [
+                "<2022.1"
+            ],
+            "v": "<2022.1"
         }
     ],
-    "nobinobi-core": [
+    "openvino-tensorflow": [
         {
-            "advisory": "Nobinobi-core 0.1.4.3 updates underlying 'Django' dependency to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-32052",
-            "id": "pyup.io-43733",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29544",
+            "id": "pyup.io-43107",
             "specs": [
-                "<0.1.4.3"
+                "<1.0.0"
             ],
-            "v": "<0.1.4.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-core 0.1.4.3 updates underlying 'Django' dependency to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-35042",
-            "id": "pyup.io-43730",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29534",
+            "id": "pyup.io-43108",
             "specs": [
-                "<0.1.4.3"
+                "<1.0.0"
             ],
-            "v": "<0.1.4.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-core 0.1.4.3 updates underlying 'Django' dependency to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-33203",
-            "id": "pyup.io-43731",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29610",
+            "id": "pyup.io-43109",
             "specs": [
-                "<0.1.4.3"
+                "<1.0.0"
             ],
-            "v": "<0.1.4.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-core 0.1.4.3 updates underlying 'Django' dependency to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-33571",
-            "id": "pyup.io-43732",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-22898",
+            "id": "pyup.io-43252",
             "specs": [
-                "<0.1.4.3"
+                "<1.0.0"
             ],
-            "v": "<0.1.4.3"
+            "v": "<1.0.0"
+        },
+        {
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29566",
+            "id": "pyup.io-43112",
+            "specs": [
+                "<1.0.0"
+            ],
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-core 0.1.4.3 updates underlying 'Django' dependency to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-31542",
-            "id": "pyup.io-40627",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29550",
+            "id": "pyup.io-43114",
             "specs": [
-                "<0.1.4.3"
+                "<1.0.0"
             ],
-            "v": "<0.1.4.3"
-        }
-    ],
-    "nobinobi-daily-follow-up": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Nobinobi-daily-follow-up 0.1.1.11 updates its requirements for security reasons.",
-            "cve": "PVE-2021-40567",
-            "id": "pyup.io-40567",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37658",
+            "id": "pyup.io-43244",
             "specs": [
-                "<0.1.1.11"
+                "<1.0.0"
             ],
-            "v": "<0.1.1.11"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-daily-follow-up 0.1.1.12 updates underlying dependencies for security reason.",
-            "cve": "PVE-2021-40810",
-            "id": "pyup.io-40810",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29560",
+            "id": "pyup.io-43092",
             "specs": [
-                "<0.1.1.12"
+                "<1.0.0"
             ],
-            "v": "<0.1.1.12"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-daily-follow-up 0.1.1.9 updates requirements for security reasons.",
-            "cve": "PVE-2021-40202",
-            "id": "pyup.io-40202",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29523",
+            "id": "pyup.io-43094",
             "specs": [
-                "<0.1.1.9"
+                "<1.0.0"
             ],
-            "v": "<0.1.1.9"
-        }
-    ],
-    "nobinobi-staff": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-32052",
-            "id": "pyup.io-43378",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29525",
+            "id": "pyup.io-43095",
             "specs": [
-                "<0.1.6.2"
+                "<1.0.0"
             ],
-            "v": "<0.1.6.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-31542",
-            "id": "pyup.io-43387",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29519",
+            "id": "pyup.io-43096",
             "specs": [
-                "<0.1.6.2"
+                "<1.0.0"
             ],
-            "v": "<0.1.6.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-44420",
-            "id": "pyup.io-43388",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29522",
+            "id": "pyup.io-43097",
             "specs": [
-                "<0.1.6.2"
+                "<1.0.0"
             ],
-            "v": "<0.1.6.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-33203",
-            "id": "pyup.io-43389",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29521",
+            "id": "pyup.io-43101",
             "specs": [
-                "<0.1.6.2"
+                "<1.0.0"
             ],
-            "v": "<0.1.6.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-33571",
-            "id": "pyup.io-43390",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2020-8169",
+            "id": "pyup.io-43102",
             "specs": [
-                "<0.1.6.2"
+                "<1.0.0"
             ],
-            "v": "<0.1.6.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nobinobi-staff 0.1.6.2 updates its dependency 'Django' to v3.2.7 to include security fixes.",
-            "cve": "CVE-2021-35042",
-            "id": "pyup.io-43391",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29532",
+            "id": "pyup.io-43103",
             "specs": [
-                "<0.1.6.2"
+                "<1.0.0"
             ],
-            "v": "<0.1.6.2"
-        }
-    ],
-    "noiseprotocol": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "noiseprotocol before 0.2.1 used an insecure transitive dependency (Cryptography<=2.1.3).",
-            "cve": "PVE-2021-35043",
-            "id": "pyup.io-35043",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29616",
+            "id": "pyup.io-43104",
             "specs": [
-                "<0.2.1"
+                "<1.0.0"
             ],
-            "v": "<0.2.1"
-        }
-    ],
-    "normcap": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Normcap 0.1.1 updates PyInstaller to avoid potential vulnerability.",
-            "cve": "PVE-2021-37722",
-            "id": "pyup.io-37722",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29543",
+            "id": "pyup.io-43105",
             "specs": [
-                "<0.1.1"
+                "<1.0.0"
             ],
-            "v": "<0.1.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Normcap 0.1.2 updates the Bleach Package to avoid a potential vulnerability.",
-            "cve": "PVE-2021-38132",
-            "id": "pyup.io-38132",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29547",
+            "id": "pyup.io-43106",
             "specs": [
-                "<0.1.2"
+                "<1.0.0"
             ],
-            "v": "<0.1.2"
-        }
-    ],
-    "nornir": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Nornir 3.2.0 updates its dependency 'pygments' to v2.10.0 to include security fixes.",
-            "cve": "CVE-2021-27291",
-            "id": "pyup.io-43357",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29587",
+            "id": "pyup.io-43110",
             "specs": [
-                "<3.2.0"
+                "<1.0.0"
             ],
-            "v": "<3.2.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nornir 3.2.0 updates its dependency 'pygments' to v2.10.0 to include a security fix.",
-            "cve": "CVE-2021-27291",
-            "id": "pyup.io-42704",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29568",
+            "id": "pyup.io-43111",
             "specs": [
-                "<3.2.0"
+                "<1.0.0"
             ],
-            "v": "<3.2.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nornir 3.2.0 updates its dependency 'pygments' to v2.10.0 to include security fixes.",
-            "cve": "CVE-2021-20270",
-            "id": "pyup.io-42767",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29563",
+            "id": "pyup.io-43113",
             "specs": [
-                "<3.2.0"
+                "<1.0.0"
             ],
-            "v": "<3.2.0"
-        }
-    ],
-    "notable": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "notable 0.0.6 fixes a security regression in the new BoltDB backend.",
-            "cve": "PVE-2021-34447",
-            "id": "pyup.io-34447",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29545",
+            "id": "pyup.io-43115",
             "specs": [
-                "<0.0.6"
+                "<1.0.0"
             ],
-            "v": "<0.0.6"
-        }
-    ],
-    "notebook": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "The editor in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to execute arbitrary JavaScript code via a crafted file, which triggers a redirect to files/, related to MIME types.",
-            "cve": "CVE-2015-7337",
-            "id": "pyup.io-25903",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29537",
+            "id": "pyup.io-43116",
             "specs": [
-                "<4.0.5"
+                "<1.0.0"
             ],
-            "v": "<4.0.5"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 4.0.5 includes security fixes for maliciously crafted files (CVE-2015-6938).",
-            "cve": "CVE-2015-6938",
-            "id": "pyup.io-40389",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29514",
+            "id": "pyup.io-43117",
             "specs": [
-                "<4.0.5"
+                "<1.0.0"
             ],
-            "v": "<4.0.5"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 4.0.5 includes security fixes for maliciously crafted files (CVE-2015-7337).",
-            "cve": "CVE-2015-7337",
-            "id": "pyup.io-40398",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29567",
+            "id": "pyup.io-43118",
             "specs": [
-                "<4.0.5"
+                "<1.0.0"
             ],
-            "v": "<4.0.5"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 5.4.1 adds a security release fix (CVE-2018-8768).",
-            "cve": "CVE-2018-8768",
-            "id": "pyup.io-40386",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29589",
+            "id": "pyup.io-43119",
             "specs": [
-                "<5.4.1"
+                "<1.0.0"
             ],
-            "v": "<5.4.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Jupyter Notebook before 5.7.1 allows XSS via an untrusted notebook because nbconvert responses are considered to have the same origin as the notebook server. In other words, nbconvert endpoints can execute JavaScript with access to the server API. In notebook/nbconvert/handlers.py, NbconvertFileHandler and NbconvertPostHandler do not set a Content Security Policy to prevent this.",
-            "cve": "CVE-2018-19351",
-            "id": "pyup.io-42253",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29512",
+            "id": "pyup.io-43120",
             "specs": [
-                "<5.7.1"
+                "<1.0.0"
             ],
-            "v": "<5.7.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Jupyter Notebook before 5.7.2 allows XSS via a crafted directory name because notebook/static/tree/js/notebooklist.js handles certain URLs unsafely.",
-            "cve": "CVE-2018-19352",
-            "id": "pyup.io-42254",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29533",
+            "id": "pyup.io-43121",
             "specs": [
-                "<5.7.2"
+                "<1.0.0"
             ],
-            "v": "<5.7.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Kiwi TCMS 6.4 updates Patternfly to version 3.59.0, which deals with an XSS issue in bootstrap (CVE-2018-14041). By default session cookies will expire after 24 hours. This can now be controlled via the ``SESSION_COOKIE_AGE`` setting. See https://github.com/kiwitcms/Kiwi/issues/556.",
-            "cve": "CVE-2018-14041",
-            "id": "pyup.io-40385",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29535",
+            "id": "pyup.io-43122",
             "specs": [
-                "<5.7.3"
+                "<1.0.0"
             ],
-            "v": "<5.7.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 5.7.6 includes a fix for vulnerability (CVE-2019-9644).",
-            "cve": "CVE-2019-9644",
-            "id": "pyup.io-40384",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29548",
+            "id": "pyup.io-43123",
             "specs": [
-                "<5.7.6"
+                "<1.0.0"
             ],
-            "v": "<5.7.6"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 5.7.8 fixes the 'Open Redirect' vulnerability (CVE-2019-10255).",
-            "cve": "CVE-2019-10255",
-            "id": "pyup.io-40383",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29536",
+            "id": "pyup.io-43124",
             "specs": [
-                "<5.7.8"
+                "<1.0.0"
             ],
-            "v": "<5.7.8"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 6.0 improves SSL/TLS security by using PROTOCOL_TLS which selects the highest SSL/TLS protocol version available that both the client and server support. When PROTOCOL_TLS is not available use PROTOCOL_SSLv23.",
-            "cve": "PVE-2021-40382",
-            "id": "pyup.io-40382",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29538",
+            "id": "pyup.io-43125",
             "specs": [
-                "<6.0"
+                "<1.0.0"
             ],
-            "v": "<6.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 6.0.2 updates its dependency 'JQuery' to v3.5.0 to include a security fix.",
-            "cve": "CVE-2019-11358",
-            "id": "pyup.io-40381",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29540",
+            "id": "pyup.io-43126",
             "specs": [
-                "<6.0.2"
+                "<1.0.0"
             ],
-            "v": "<6.0.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 6.1.5 fixes open redirect vulnerability 'GHSA-c7vm-f5p4-8fqh'. See: CVE-2020-26215.",
-            "cve": "CVE-2020-26215",
-            "id": "pyup.io-40380",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29608",
+            "id": "pyup.io-43127",
             "specs": [
-                "<6.1.5"
+                "<1.0.0"
             ],
-            "v": "<6.1.5"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in the file browser in notebook/notebookapp.py in IPython Notebook before 3.2.2 and Jupyter Notebook 4.0.x before 4.0.5 allows remote attackers to inject arbitrary web script or HTML via a folder name.  NOTE: this was originally reported as a cross-site request forgery (CSRF) vulnerability, but this may be inaccurate.",
-            "cve": "CVE-2015-6938",
-            "id": "pyup.io-25904",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29551",
+            "id": "pyup.io-43128",
             "specs": [
-                ">=4.0,<4.0.5"
+                "<1.0.0"
             ],
-            "v": ">=4.0,<4.0.5"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Notebook 4.2.2 includes an important security fix (CVE-2016-6524).",
-            "cve": "CVE-2016-6524",
-            "id": "pyup.io-40388",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29513",
+            "id": "pyup.io-43129",
             "specs": [
-                ">=4.0.0a1,<4.2.2"
+                "<1.0.0"
             ],
-            "v": ">=4.0.0a1,<4.2.2"
-        }
-    ],
-    "notifications-python-client": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "notifications-python-client before 4.7.1 is vulnerable to a not further described security issue in PyJWT.",
-            "cve": "PVE-2021-35116",
-            "id": "pyup.io-35116",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29572",
+            "id": "pyup.io-43130",
             "specs": [
-                "<4.7.1"
+                "<1.0.0"
             ],
-            "v": "<4.7.1"
-        }
-    ],
-    "nova": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "An issue was discovered in OpenStack Nova before 18.2.4, 19.x before 19.1.0, and 20.x before 20.1.0. It can leak consoleauth tokens into log files. An attacker with read access to the service's logs may obtain tokens used for console access. All Nova setups using novncproxy are affected. This is related to NovaProxyRequestHandlerBase.new_websocket_client in console/websocketproxy.py. See: CVE-2015-9543.",
-            "cve": "CVE-2015-9543",
-            "id": "pyup.io-37903",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29580",
+            "id": "pyup.io-43131",
             "specs": [
-                "<18.2.4",
-                ">=20.0.0.0rc1,<20.1.0",
-                ">=19.0.0.0rc1,<19.1.0"
+                "<1.0.0"
             ],
-            "v": "<18.2.4,>=20.0.0.0rc1,<20.1.0,>=19.0.0.0rc1,<19.1.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0. By performing a soft reboot of an instance that has previously undergone live migration, a user may gain access to destination host devices that share the same paths as host devices previously referenced by the virtual machine on the source host. This can include block devices that map to different Cinder volumes at the destination than at the source. Only deployments allowing host-based connections (for instance, root and ephemeral devices) are affected. See: CVE-2020-17376.",
-            "cve": "CVE-2020-17376",
-            "id": "pyup.io-38722",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29578",
+            "id": "pyup.io-43132",
             "specs": [
-                "<19.3.1",
-                ">=20.0.0.0rc1,<20.3.1",
-                "==21.0.0"
+                "<1.0.0"
             ],
-            "v": "<19.3.1,>=20.0.0.0rc1,<20.3.1,==21.0.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "OpenStack Nova before 2012.1 allows someone with access to an EC2_ACCESS_KEY (equivalent to a username) to obtain the EC2_SECRET_KEY (equivalent to a password). Exposing the EC2_ACCESS_KEY via http or tools that allow man-in-the-middle over https could allow an attacker to easily obtain the EC2_SECRET_KEY. An attacker could also presumably brute force values for EC2_ACCESS_KEY. See CVE-2011-4076.",
-            "cve": "CVE-2011-4076",
-            "id": "pyup.io-37736",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29579",
+            "id": "pyup.io-43133",
             "specs": [
-                "<2012.1"
+                "<1.0.0"
             ],
-            "v": "<2012.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Versions of nova before 2012.1 could expose hypervisor host files to a guest operating system when processing a maliciously constructed qcow filesystem. See: CVE-2011-3147.",
-            "cve": "CVE-2011-3147",
-            "id": "pyup.io-37087",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29581",
+            "id": "pyup.io-43134",
             "specs": [
-                "<2012.1"
+                "<1.0.0"
             ],
-            "v": "<2012.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "The OpenStack Nova (python-nova) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.2 and 1:2014.1-0 before 1:2014.1-0ubuntu1.2 and Openstack Cinder (python-cinder) package 1:2013.2.3-0 before 1:2013.2.3-0ubuntu1.1 and 1:2014.1-0 before 1:2014.1-0ubuntu1.1 for Ubuntu 13.10 and 14.04 LTS does not properly set the sudo configuration, which makes it easier for attackers to gain privileges by leveraging another vulnerability.",
-            "cve": "CVE-2013-1068",
-            "id": "pyup.io-25905",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29582",
+            "id": "pyup.io-43135",
             "specs": [
-                "<2013.2.3"
+                "<1.0.0"
             ],
-            "v": "<2013.2.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "OpenStack nova base images permissions are world readable. No fixes or affected versions are known. See: CVE-2013-0326.",
-            "cve": "CVE-2013-0326",
-            "id": "pyup.io-37745",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29584",
+            "id": "pyup.io-43136",
             "specs": [
-                ">0"
+                "<1.0.0"
             ],
-            "v": ">0"
-        }
-    ],
-    "nox-poetry": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Nox-poetry 0.8.2 updates vulnerable sub-dependencies.",
-            "cve": "PVE-2021-39702",
-            "id": "pyup.io-39702",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29583",
+            "id": "pyup.io-43137",
             "specs": [
-                "<0.8.2"
+                "<1.0.0"
             ],
-            "v": "<0.8.2"
-        }
-    ],
-    "nphase": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Nphase 1.1.3 and prior include a version of 'Gatk' (4.0) affected by critical vulnerabilities.",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43604",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29585",
+            "id": "pyup.io-43138",
             "specs": [
-                "<=1.1.3"
+                "<1.0.0"
             ],
-            "v": "<=1.1.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nphase 1.1.3 and prior include a version of 'Gatk' (4.0) affected by critical vulnerabilities.",
-            "cve": "CVE-2021-45105",
-            "id": "pyup.io-43605",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29586",
+            "id": "pyup.io-43139",
             "specs": [
-                "<=1.1.3"
+                "<1.0.0"
             ],
-            "v": "<=1.1.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nphase 1.1.3 and prior include a version of 'Gatk' (4.0) affected by critical vulnerabilities.",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43603",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29588",
+            "id": "pyup.io-43140",
             "specs": [
-                "<=1.1.3"
+                "<1.0.0"
             ],
-            "v": "<=1.1.3"
-        }
-    ],
-    "nsupdate": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "nsupdate before 0.3.0 is vulnerable to a undisclosed security issue.",
-            "cve": "PVE-2021-25906",
-            "id": "pyup.io-25906",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29590",
+            "id": "pyup.io-43141",
             "specs": [
-                "<0.3.0"
+                "<1.0.0"
             ],
-            "v": "<0.3.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "nsupdate 0.8.0 fixes a security issue: abuse_blocked flag could be worked around by abuser.",
-            "cve": "PVE-2021-25907",
-            "id": "pyup.io-25907",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29592",
+            "id": "pyup.io-43142",
             "specs": [
-                "<0.8.0"
+                "<1.0.0"
             ],
-            "v": "<0.8.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "nsupdate 0.9.1 fixes a security issue with \"related hosts\" / \"service updaters\".",
-            "cve": "PVE-2021-25908",
-            "id": "pyup.io-25908",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29591",
+            "id": "pyup.io-43143",
             "specs": [
-                "<0.9.1"
+                "<1.0.0"
             ],
-            "v": "<0.9.1"
-        }
-    ],
-    "nuitka": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Nuitka 0.6.12 uses https URLs for downloading dependency walker, for it to be more secure.",
-            "cve": "PVE-2021-39648",
-            "id": "pyup.io-39648",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29595",
+            "id": "pyup.io-43144",
             "specs": [
-                "<0.6.12"
+                "<1.0.0"
             ],
-            "v": "<0.6.12"
-        }
-    ],
-    "nukikata": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Nukikata 1.4.0 raises an error if Cookiecutter tries to render a template that contains an undefined variable. Makes generation more robust and secure.",
-            "cve": "PVE-2021-38418",
-            "id": "pyup.io-38418",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29594",
+            "id": "pyup.io-43145",
             "specs": [
-                "<1.4.0"
+                "<1.0.0"
             ],
-            "v": "<1.4.0"
-        }
-    ],
-    "numba": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Numba 0.49.0 includes an attempt at fixing frame injection in the dispatcher tracing path.",
-            "cve": "PVE-2021-38983",
-            "id": "pyup.io-38983",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29527",
+            "id": "pyup.io-43146",
             "specs": [
-                "<0.49.0"
+                "<1.0.0"
             ],
-            "v": "<0.49.0"
-        }
-    ],
-    "numpy": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.",
-            "cve": "CVE-2019-6446",
-            "id": "pyup.io-36810",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29596",
+            "id": "pyup.io-43147",
             "specs": [
-                "<=1.16.0"
+                "<1.0.0"
             ],
-            "v": "<=1.16.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, which could let a malicious user cause a Denial of Service. See CVE-2021-33430.",
-            "cve": "CVE-2021-33430",
-            "id": "pyup.io-43453",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29528",
+            "id": "pyup.io-43148",
             "specs": [
-                ">=1.9.0,<=1.9.3"
+                "<1.0.0"
             ],
-            "v": ">=1.9.0,<=1.9.3"
-        }
-    ],
-    "nvidia-tensorflow": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Nvidia-tensorflow 1.10.0 builds & links in secure gRPC components (switch from the insecure grpc dependency to secure grpc dependency)",
-            "cve": "PVE-2021-38457",
-            "id": "pyup.io-38457",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29593",
+            "id": "pyup.io-43149",
             "specs": [
-                "<1.10.0"
+                "<1.0.0"
             ],
-            "v": "<1.10.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.12.2 fixes a potential security vulnerability where carefully crafted GIF images can produce a null pointer dereference during decoding.",
-            "cve": "PVE-2021-38456",
-            "id": "pyup.io-38456",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29597",
+            "id": "pyup.io-43150",
             "specs": [
-                "<1.12.2"
+                "<1.0.0"
             ],
-            "v": "<1.12.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3 includes a fix for CVE-2019-19645: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
-            "cve": "CVE-2019-19645",
-            "id": "pyup.io-39711",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29530",
+            "id": "pyup.io-43151",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
-            "cve": "CVE-2019-15601",
-            "id": "pyup.io-39713",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29529",
+            "id": "pyup.io-43152",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3 includes a fix for CVE-2019-10099: Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.",
-            "cve": "CVE-2019-10099",
-            "id": "pyup.io-39715",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29598",
+            "id": "pyup.io-43153",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
-            "cve": "CVE-2018-11770",
-            "id": "pyup.io-38797",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29531",
+            "id": "pyup.io-43154",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
-            "cve": "CVE-2019-19244",
-            "id": "pyup.io-39712",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29599",
+            "id": "pyup.io-43155",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
-            "cve": "CVE-2019-13960",
-            "id": "pyup.io-39714",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29600",
+            "id": "pyup.io-43156",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
-            "cve": "CVE-2018-20330",
-            "id": "pyup.io-39716",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29602",
+            "id": "pyup.io-43157",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
-            "cve": "CVE-2018-19664",
-            "id": "pyup.io-39717",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29604",
+            "id": "pyup.io-43158",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
-            "cve": "CVE-2018-17190",
-            "id": "pyup.io-39718",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29601",
+            "id": "pyup.io-43159",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.3:\r\n* Updates sqlite3 to 3.31.01 to handle CVE-2019-19880, CVE-2019-19244 and CVE-2019-19645\r\n* Updates curl to 7.69.1 to handle CVE-2019-15601\r\n* Updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960\r\n* Updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770",
-            "cve": "CVE-2019-19880",
-            "id": "pyup.io-39710",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29605",
+            "id": "pyup.io-43160",
             "specs": [
-                "<1.15.3"
+                "<1.0.0"
             ],
-            "v": "<1.15.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.2 updates `curl` to `7.66.0` to handle CVE-2019-5481.",
-            "cve": "CVE-2019-5481",
-            "id": "pyup.io-39585",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29524",
+            "id": "pyup.io-43098",
             "specs": [
-                ">=1.0.0,<1.15.2"
+                "<1.0.0"
             ],
-            "v": ">=1.0.0,<1.15.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.2 updates 'sqlite3' dependency to 3.30.01 to handle CVE-2019-19645: alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.",
-            "cve": "CVE-2019-19645",
-            "id": "pyup.io-39583",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29520",
+            "id": "pyup.io-43099",
             "specs": [
-                ">=1.0.0,<1.15.2"
+                "<1.0.0"
             ],
-            "v": ">=1.0.0,<1.15.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.2 updates 'sqlite3' dependency to 3.30.01 to handle CVE-2019-19646: pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.",
-            "cve": "CVE-2019-19646",
-            "id": "pyup.io-39584",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29564",
+            "id": "pyup.io-43100",
             "specs": [
-                ">=1.0.0,<1.15.2"
+                "<1.0.0"
             ],
-            "v": ">=1.0.0,<1.15.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.2\r\n* Fixes a security vulnerability where converting a Python string to a `tf.float16` value produces a segmentation fault (CVE-2020-5215)",
-            "cve": "CVE-2020-5215",
-            "id": "pyup.io-38455",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29606",
+            "id": "pyup.io-43162",
             "specs": [
-                ">=1.0.0,<1.15.2"
+                "<1.0.0"
             ],
-            "v": ">=1.0.0,<1.15.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Nvidia-tensorflow 1.15.2 updates 'sqlite3' dependency to 3.30.01 to handle CVE-2019-16168: In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"",
-            "cve": "CVE-2019-16168",
-            "id": "pyup.io-39582",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29542",
+            "id": "pyup.io-43163",
             "specs": [
-                ">=1.0.0,<1.15.2"
+                "<1.0.0"
             ],
-            "v": ">=1.0.0,<1.15.2"
-        }
-    ],
-    "oauth-pyzure": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Oauth-pyzure 0.1.4 is based on OSS vulnerability reports.",
-            "cve": "PVE-2021-39077",
-            "id": "pyup.io-39077",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29609",
+            "id": "pyup.io-43164",
             "specs": [
-                "<0.1.4"
+                "<1.0.0"
             ],
-            "v": "<0.1.4"
-        }
-    ],
-    "oauth2": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "The Server.verify_request function in SimpleGeo python-oauth2 does not check the nonce, which allows remote attackers to perform replay attacks via a signed URL.",
-            "cve": "CVE-2013-4346",
-            "id": "pyup.io-35462",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29541",
+            "id": "pyup.io-43165",
             "specs": [
-                "<1.9"
+                "<1.0.0"
             ],
-            "v": "<1.9"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "The (1) make_nonce, (2) generate_nonce, and (3) generate_verifier functions in SimpleGeo python-oauth2 uses weak random numbers to generate nonces, which makes it easier for remote attackers to guess the nonce via a brute force attack.",
-            "cve": "CVE-2013-4347",
-            "id": "pyup.io-35463",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29607",
+            "id": "pyup.io-43166",
             "specs": [
-                "<1.9"
+                "<1.0.0"
             ],
-            "v": "<1.9"
-        }
-    ],
-    "oauthlib": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "oauthlib before 0.7.0 is not stripping client provided passwords from OAuth2 logs.",
-            "cve": "PVE-2021-25909",
-            "id": "pyup.io-25909",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29611",
+            "id": "pyup.io-43167",
             "specs": [
-                "<0.7.0"
+                "<1.0.0"
             ],
-            "v": "<0.7.0"
-        }
-    ],
-    "obasparql": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Obasparql 2.0.1 bumps werkzeug to >= 0.15.3 to address CVE-2019-14806.",
-            "cve": "CVE-2019-14806",
-            "id": "pyup.io-38322",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29612",
+            "id": "pyup.io-43168",
             "specs": [
-                "<2.0.1"
+                "<1.0.0"
             ],
-            "v": "<2.0.1"
-        }
-    ],
-    "obsplus": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Obsplus 0.0.6 switched from MD5 hashing to SHA256 as the latter is more secure and the computational differences were negligible.",
-            "cve": "PVE-2021-38088",
-            "id": "pyup.io-38088",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29546",
+            "id": "pyup.io-43169",
             "specs": [
-                "<0.0.6"
+                "<1.0.0"
             ],
-            "v": "<0.0.6"
-        }
-    ],
-    "oci": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Oci version 2.0.2 includes a fix for CVE-2018-10903: A flaw was found in python-cryptography versions between >=1.9.0 and <2.3. The finalize_with_tag API did not enforce a minimum tag length. If a user did not validate the input length prior to passing it to finalize_with_tag an attacker could craft an invalid payload with a shortened tag (e.g. 1 byte) such that they would have a 1 in 256 chance of passing the MAC check. GCM tag forgeries can cause key leakage.",
-            "cve": "CVE-2018-10903",
-            "id": "pyup.io-37415",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29613",
+            "id": "pyup.io-43170",
             "specs": [
-                "<2.0.2"
+                "<1.0.0"
             ],
-            "v": "<2.0.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci 2.1.3 includes a fix for CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
-            "cve": "CVE-2018-1000808",
-            "id": "pyup.io-36786",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29615",
+            "id": "pyup.io-43171",
             "specs": [
-                "<2.1.3"
+                "<1.0.0"
             ],
-            "v": "<2.1.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci version 2.1.3 includes a fix for CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
-            "cve": "CVE-2018-1000808",
-            "id": "pyup.io-37831",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29549",
+            "id": "pyup.io-43172",
             "specs": [
-                "<2.1.3"
+                "<1.0.0"
             ],
-            "v": "<2.1.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci version 2.10.0 includes a fix for CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
-            "cve": "CVE-2018-1000808",
-            "id": "pyup.io-37830",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29618",
+            "id": "pyup.io-43173",
             "specs": [
-                "<2.10.0"
+                "<1.0.0"
             ],
-            "v": "<2.10.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci 2.24.1 pins cryptography to version 3.2.1 to address a vulnerability. See: <https://github.com/oracle/oci-python-sdk/pull/299>.",
-            "cve": "PVE-2021-39212",
-            "id": "pyup.io-39212",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29617",
+            "id": "pyup.io-43174",
             "specs": [
-                "<2.24.1"
+                "<1.0.0"
             ],
-            "v": "<2.24.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci 2.37.0 updates the 'cryptography' dependency version to 3.3.2 to address a security vulnerability.",
-            "cve": "PVE-2021-40377",
-            "id": "pyup.io-40377",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29553",
+            "id": "pyup.io-43175",
             "specs": [
-                "<2.37.0"
+                "<1.0.0"
             ],
-            "v": "<2.37.0"
-        }
-    ],
-    "oci-cli": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Oci-cli 2.22.1 adds support for the 'Vulnerability Scanning' service (as 'oci vulnerability-scanning' command).",
-            "cve": "PVE-2021-40200",
-            "id": "pyup.io-40200",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29619",
+            "id": "pyup.io-43176",
             "specs": [
-                "<2.22.1"
+                "<1.0.0"
             ],
-            "v": "<2.22.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci-cli 2.24.0 drops support for Python 3.5. Due to a possible security issue in the version of the dependent cryptography package, its version has been bumped to 3.3.2. This version does not support Python 3.5.",
-            "cve": "PVE-2021-40255",
-            "id": "pyup.io-40255",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29552",
+            "id": "pyup.io-43177",
             "specs": [
-                "<2.24.0"
+                "<1.0.0"
             ],
-            "v": "<2.24.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci-cli 2.24.4 upgrades the 'Py' dependency to version 1.10.0 to address a vulnerability (CVE-2020-29651).",
-            "cve": "CVE-2020-29651",
-            "id": "pyup.io-40831",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29554",
+            "id": "pyup.io-43178",
             "specs": [
-                "<2.24.4"
+                "<1.0.0"
             ],
-            "v": "<2.24.4"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Versions of oci-cli prior to 2.4.10 are affected by a security vulnerability. Versions 2.4.11 and later will automatically detect vulnerable installations, and if issues are detected, a warning will be displayed to the user. These issues can be remediated automatically by running the ``oci setup repair-file-permissions`` command.",
-            "cve": "PVE-2021-36148",
-            "id": "pyup.io-36148",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2020-8177",
+            "id": "pyup.io-43179",
             "specs": [
-                "<2.4.10"
+                "<1.0.0"
             ],
-            "v": "<2.4.10"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci-cli 2.4.40 includes a fix for CVE-2018-1000808: Python Cryptographic Authority pyopenssl version Before 17.5.0 contains a CWE - 401 : Failure to Release Memory Before Removing Last Reference vulnerability in PKCS #12 Store that can result in Denial of service if memory runs low or is exhausted. This attack appear to be exploitable via Depends upon calling application, however it could be as simple as initiating a TLS connection. Anything that would cause the calling application to reload certificates from a PKCS #12 store.. This vulnerability appears to have been fixed in 17.5.0.",
-            "cve": "CVE-2018-1000808",
-            "id": "pyup.io-36804",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29555",
+            "id": "pyup.io-43180",
             "specs": [
-                "<2.4.40"
+                "<1.0.0"
             ],
-            "v": "<2.4.40"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci-cli 2.5.9 upgrades Jinja2 to version 2.10.1 to address a vulnerability identified on GitHub as CVE-2019-10906. Jinga isn't used in Oci-cli's run-time system but as part of its documentation build process.",
-            "cve": "CVE-2019-10906",
-            "id": "pyup.io-37139",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2020-8231",
+            "id": "pyup.io-43181",
             "specs": [
-                "<2.5.9"
+                "<1.0.0"
             ],
-            "v": "<2.5.9"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Oci-cli 2.6.3 fixes CVE-2017-18342. In PyYAML before 4.1, the yaml.load() API could execute arbitrary code. In other words, yaml.safe_load is not used.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-37417",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29557",
+            "id": "pyup.io-43182",
             "specs": [
-                "<2.6.3"
+                "<1.0.0"
             ],
-            "v": "<2.6.3"
-        }
-    ],
-    "octavia": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause new amphorae to run based on any arbitrary image. This meant that a remote attacker could upload a new amphorae image and, if requested to spawn new amphorae, Octavia would then pick up the compromised image. See: CVE-2019-3895.",
-            "cve": "CVE-2019-3895",
-            "id": "pyup.io-37192",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2020-8284",
+            "id": "pyup.io-43183",
             "specs": [
-                "<0.9.0"
+                "<1.0.0"
             ],
-            "v": "<0.9.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Amphora Images in OpenStack Octavia >=0.10.0 <2.1.2, >=3.0.0 <3.2.0, >=4.0.0 <4.1.0 allows anyone with access to the management network to bypass client-certificate based authentication and retrieve information or issue configuration commands via simple HTTP requests to the Agent on port https/9443, because the cmd/agent.py gunicorn cert_reqs option is True but is supposed to be ssl.CERT_REQUIRED.",
-            "cve": "CVE-2019-17134",
-            "id": "pyup.io-37547",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29556",
+            "id": "pyup.io-43184",
             "specs": [
-                ">=0.10.0,<2.1.2",
-                ">=3.0.0,<3.2.0",
-                ">=4.0.0,<4.1.0"
+                "<1.0.0"
             ],
-            "v": ">=0.10.0,<2.1.2,>=3.0.0,<3.2.0,>=4.0.0,<4.1.0"
-        }
-    ],
-    "oe-geoutils": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Oe-geoutils 1.5.2 solves security vulnerabilities from external packages 101.",
-            "cve": "PVE-2021-37666",
-            "id": "pyup.io-37666",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29558",
+            "id": "pyup.io-43185",
             "specs": [
-                "<1.5.2"
+                "<1.0.0"
             ],
-            "v": "<1.5.2"
-        }
-    ],
-    "oem": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Oem 0.3.0 uses 'defusedxml' to handle XML-related vulnerabilities.\r\nhttps://github.com/bradsease/oem/issues/9",
-            "cve": "PVE-2021-43087",
-            "id": "pyup.io-43087",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2020-8286",
+            "id": "pyup.io-43186",
             "specs": [
-                "<0.3.0"
+                "<1.0.0"
             ],
-            "v": "<0.3.0"
-        }
-    ],
-    "oic": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "In Python oic before version 1.2.1, there are several related cryptographic issues affecting client implementations that use the library. \r\n\r\nThe issues are: \r\n1) The IdToken signature algorithm was not checked automatically, but only if the expected algorithm was passed in as a kwarg. \r\n2) JWA `none` algorithm was allowed in all flows. \r\n3) oic.consumer.Consumer.parse_authz returns an unverified IdToken. The verification of the token was left to the discretion of the implementator. \r\n4) iat claim was not checked for sanity (i.e. it could be in the future). \r\n\r\nSee CVE-2020-26244.",
-            "cve": "CVE-2020-26244",
-            "id": "pyup.io-39221",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29559",
+            "id": "pyup.io-43187",
             "specs": [
-                "<1.2.1"
+                "<1.0.0"
             ],
-            "v": "<1.2.1"
-        }
-    ],
-    "okdata-cli": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Okdata-cli version 0.12.1 updates its dependency \"urlib3\" to include a security fix.",
-            "cve": "PVE-2021-41852",
-            "id": "pyup.io-41852",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29565",
+            "id": "pyup.io-43188",
             "specs": [
-                "<0.12.1"
+                "<1.0.0"
             ],
-            "v": "<0.12.1"
-        }
-    ],
-    "omero-figure": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Omero-figure 4.4.1 includes a fix for CVE-2021-41132, which also affects the related package 'OMERO.web'.\r\nhttps://www.openmicroscopy.org/security/advisories/2021-SV3",
-            "cve": "CVE-2021-41132",
-            "id": "pyup.io-42156",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29518",
+            "id": "pyup.io-43189",
             "specs": [
-                "<4.4.1"
+                "<1.0.0"
             ],
-            "v": "<4.4.1"
-        }
-    ],
-    "omero-web": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Omero-web 5.11.0 includes a fix for CVE-2021-41132: In versions prior to 5.11.0, a variety of templates do not perform proper sanitization through HTML escaping. Due to the lack of sanitization and use of 'jQuery.html()', there are a whole of cross-site scripting possibilities with specially crafted input to a variety of fields.\r\nhttps://www.openmicroscopy.org/security/advisories/2021-SV3",
-            "cve": "CVE-2021-41132",
-            "id": "pyup.io-42157",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29526",
+            "id": "pyup.io-43190",
             "specs": [
-                "<5.11.0"
+                "<1.0.0"
             ],
-            "v": "<5.11.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 supports redirection to a given URL after performing login or switching the group context. These URLs are not validated, allowing redirection to untrusted sites. OMERO.web 5.9.0 adds URL validation before redirecting. External URLs are not considered valid, unless specified in the omero.web.redirect_allowed_hosts setting. See CVE-2021-21377.",
-            "cve": "CVE-2021-21377",
-            "id": "pyup.io-40089",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29516",
+            "id": "pyup.io-43191",
             "specs": [
-                "<5.9.0"
+                "<1.0.0"
             ],
-            "v": "<5.9.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "OMERO.web is open source Django-based software for managing microscopy imaging. OMERO.web before version 5.9.0 loads various information about the current user such as their id, name and the groups they are in, and these are available on the main webclient pages. This represents an information exposure vulnerability. Some additional information being loaded is not used by the webclient and is being removed in this release. This is fixed in version 5.9.0. See CVE-2021-21376.",
-            "cve": "CVE-2021-21376",
-            "id": "pyup.io-40088",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29517",
+            "id": "pyup.io-43192",
             "specs": [
-                "<5.9.0"
+                "<1.0.0"
             ],
-            "v": "<5.9.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Omero-web 5.9.0 includes few security vulnerability fixes.",
-            "cve": "PVE-2021-40578",
-            "id": "pyup.io-40578",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29569",
+            "id": "pyup.io-43193",
             "specs": [
-                "<5.9.0"
+                "<1.0.0"
             ],
-            "v": "<5.9.0"
-        }
-    ],
-    "omnikdatalogger": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Omnikdatalogger 1.10.4 uses secure connection (HTTPS) to interact with PVOutput website.\r\nhttps://github.com/jbouwh/omnikdatalogger/pull/56/commits/85eb0af91b5912295745a2ec074e71354374b8b6",
-            "cve": "PVE-2021-43353",
-            "id": "pyup.io-43353",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29562",
+            "id": "pyup.io-43194",
             "specs": [
-                "<1.10.4"
+                "<1.0.0"
             ],
-            "v": "<1.10.4"
-        }
-    ],
-    "omnizart": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Omnizart 0.3.3 updates its dependencies to address a security issue.",
-            "cve": "PVE-2021-40422",
-            "id": "pyup.io-40422",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29561",
+            "id": "pyup.io-43195",
             "specs": [
-                "<0.3.3"
+                "<1.0.0"
             ],
-            "v": "<0.3.3"
-        }
-    ],
-    "onefuzz": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Onefuzz 2.5.0 updates multiple third-party Rust libraries.  Addresses potential security issue [RUSTSEC-2021-0023].",
-            "cve": "PVE-2021-39624",
-            "id": "pyup.io-39624",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29570",
+            "id": "pyup.io-43196",
             "specs": [
-                "<2.5.0"
+                "<1.0.0"
             ],
-            "v": "<2.5.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Onefuzz 2.7.0 includes a fix for CVE-2020-28493: This affects the package jinja2 from 0.0.0 and before 2.11.3. The ReDoS vulnerability is mainly due to the `_punctuation_re regex` operator and its use of multiple wildcards. The last wildcard is the most exploitable as it searches for trailing punctuation. This issue can be mitigated by Markdown to format user content instead of the urlize filter, or by implementing request timeouts and limiting process memory.",
-            "cve": "CVE-2020-28493",
-            "id": "pyup.io-39676",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29575",
+            "id": "pyup.io-43197",
             "specs": [
-                "<2.7.0"
+                "<1.0.0"
             ],
-            "v": "<2.7.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "OneFuzz is an open source self-hosted Fuzzing-As-A-Service platform. Starting with OneFuzz 2.12.0 or greater, an incomplete authorization check allows an authenticated user from any Azure Active Directory tenant to make authorized API calls to a vulnerable OneFuzz instance. To be vulnerable, a OneFuzz deployment must be both version 2.12.0 or greater and deployed with the non-default --multi_tenant_domain option. This can result in read/write access to private data such as software vulnerability and crash information, security testing tools and proprietary code and symbols. Via authorized API calls, this also enables tampering with existing data and unauthorized code execution on Azure compute resources. This issue is resolved starting in release 2.31.0, via the addition of application-level check of the bearer token's `issuer` against an administrator-configured allowlist. As a workaround users can restrict access to the tenant of a deployed OneFuzz instance < 2.31.0 by redeploying in the default configuration, which omits the `--multi_tenant_domain` option.",
-            "cve": "CVE-2021-37705",
-            "id": "pyup.io-42319",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29573",
+            "id": "pyup.io-43198",
             "specs": [
-                ">=2.12.0,<2.31.0"
+                "<1.0.0"
             ],
-            "v": ">=2.12.0,<2.31.0"
-        }
-    ],
-    "onegov.form": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "onegov.form before 0.16.1 is not escaping HTML labels in the dynamic formbuilder.",
-            "cve": "PVE-2021-25911",
-            "id": "pyup.io-25911",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29515",
+            "id": "pyup.io-43199",
             "specs": [
-                "<0.16.1"
+                "<1.0.0"
             ],
-            "v": "<0.16.1"
-        }
-    ],
-    "onelogin-aws-assume-role": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "For security reasons, onelogin-aws-assume-role 1.3.0 removes the ability to provide the IP using a command line parameter and is instead able to provide the IP address at the onelogin.sdk.json file.",
-            "cve": "PVE-2021-37158",
-            "id": "pyup.io-37158",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29574",
+            "id": "pyup.io-43200",
             "specs": [
-                "<1.3.0"
+                "<1.0.0"
             ],
-            "v": "<1.3.0"
-        }
-    ],
-    "onixcheck": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "onixcheck 0.8.0 adds secured XML-Parsing via defusedxml.",
-            "cve": "PVE-2021-25912",
-            "id": "pyup.io-25912",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29576",
+            "id": "pyup.io-43201",
             "specs": [
-                "<0.8.0"
+                "<1.0.0"
             ],
-            "v": "<0.8.0"
-        }
-    ],
-    "online-judge-tools": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Online-judge-tools 0.1.53 fixes a Regular Expression Injection issue and a Glob Injection issue.",
-            "cve": "PVE-2021-38902",
-            "id": "pyup.io-38902",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29603",
+            "id": "pyup.io-43161",
             "specs": [
-                "<0.1.53"
+                "<1.0.0"
             ],
-            "v": "<0.1.53"
-        }
-    ],
-    "oodt": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Oodt before 0.4 is vulnerable to XSS attacks via malformed query strings.\r\nhttps://issues.apache.org/jira/browse/OODT-364\r\nhttps://github.com/apache/oodt/commit/cf6ff6b5437cee01792269cc16010e595547a64d",
-            "cve": "PVE-2021-25913",
-            "id": "pyup.io-25913",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29571",
+            "id": "pyup.io-43202",
             "specs": [
-                "<0.4"
+                "<1.0.0"
             ],
-            "v": "<0.4"
-        }
-    ],
-    "ooniprobe": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "ooniprobe before 1.0.2 is vulnerable to several undisclosed security issues.",
-            "cve": "PVE-2021-25914",
-            "id": "pyup.io-25914",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29577",
+            "id": "pyup.io-43203",
             "specs": [
-                "<1.0.2"
+                "<1.0.0"
             ],
-            "v": "<1.0.2"
-        }
-    ],
-    "opacus": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Opacus 0.12.0 updates its dependency 'immer' to v8.0.1 to include a security fix.\r\nhttps://github.com/pytorch/opacus/commit/4e8c77f1fd909fcc97b752ac955f450a1e6d2f71",
-            "cve": "CVE-2020-28477",
-            "id": "pyup.io-42822",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-29614",
+            "id": "pyup.io-43204",
             "specs": [
-                "<0.12.0"
+                "<1.0.0"
             ],
-            "v": "<0.12.0"
-        }
-    ],
-    "openapi-core": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Openapi-core 0.13.0 includes a fix for CVE-2019-19844. It also introduces security validation with an API Key and support for HTTP security types.",
-            "cve": "CVE-2019-19844",
-            "id": "pyup.io-37894",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-22901",
+            "id": "pyup.io-43205",
             "specs": [
-                "<0.13.0"
+                "<1.0.0"
             ],
-            "v": "<0.13.0"
-        }
-    ],
-    "openapi-python-client": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Openapi-python-client 0.5.3 sanitizes all values that become file/directory names to address path traversal vulnerabilities (CVE-2020-15141). Additionally, due to security concerns/implementation complexities, default values are temporarily unsupported for any `RefProperty` that doesn't refer to an enum.",
-            "cve": "CVE-2020-15141",
-            "id": "pyup.io-38685",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-22897",
+            "id": "pyup.io-43206",
             "specs": [
-                "<0.5.3"
+                "<1.0.0"
             ],
-            "v": "<0.5.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "In openapi-python-client before version 0.5.3, clients generated with a maliciously crafted OpenAPI Document can generate arbitrary Python code. Subsequent execution of this malicious client is arbitrary code execution. See: CVE-2020-15142.",
-            "cve": "CVE-2020-15142",
-            "id": "pyup.io-38691",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-22876",
+            "id": "pyup.io-43207",
             "specs": [
-                "<0.5.3"
+                "<1.0.0"
             ],
-            "v": "<0.5.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "In openapi-python-client before version 0.5.3, there is a path traversal vulnerability. If a user generated a client using a maliciously crafted OpenAPI document, it is possible for generated files to be placed in arbitrary locations on disk. See: CVE-2020-15141.",
-            "cve": "CVE-2020-15141",
-            "id": "pyup.io-38690",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37645",
+            "id": "pyup.io-43208",
             "specs": [
-                "<0.5.3"
+                "<1.0.0"
             ],
-            "v": "<0.5.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "In openapi-python-client 0.5.3, all values that get placed into python files (everything from enum names, to endpoint descriptions, to default values) are validated and/or sanitized to address arbitrary code execution vulnerabilities (CVE-2020-15142). Also, due to security concerns/implementation complexities, default values are temporarily unsupported for any `RefProperty` that doesn't refer to an enum.",
-            "cve": "CVE-2020-15142",
-            "id": "pyup.io-39581",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37687",
+            "id": "pyup.io-43209",
             "specs": [
-                "<0.5.3"
+                "<1.0.0"
             ],
-            "v": "<0.5.3"
-        }
-    ],
-    "openslides": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Openslides 2.1 validates HTML strings from CKEditor against XSS attacks.\r\nhttps://github.com/OpenSlides/OpenSlides/pull/2896",
-            "cve": "PVE-2021-34681",
-            "id": "pyup.io-34681",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37685",
+            "id": "pyup.io-43210",
             "specs": [
-                "<2.1"
+                "<1.0.0"
             ],
-            "v": "<2.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Openslides 2.1 fixes an issue in which comments were shown for unprivileged users.\r\nhttps://github.com/OpenSlides/OpenSlides/pull/2872",
-            "cve": "PVE-2021-42733",
-            "id": "pyup.io-42733",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37644",
+            "id": "pyup.io-43211",
             "specs": [
-                "<2.1"
+                "<1.0.0"
             ],
-            "v": "<2.1"
-        }
-    ],
-    "openstack-keystone": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The EC2 API doesn't have a signature TTL check for AWS Signature V4. An attacker can sniff the Authorization header, and then use it to reissue an OpenStack token an unlimited number of times. See: CVE-2020-12692.",
-            "cve": "CVE-2020-12692",
-            "id": "pyup.io-38260",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37669",
+            "id": "pyup.io-43212",
             "specs": [
-                "<15.0.1",
-                "==16.0.0"
+                "<1.0.0"
             ],
-            "v": "<15.0.1,==16.0.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. The list of roles provided for an OAuth1 access token is silently ignored. Thus, when an access token is used to request a keystone token, the keystone token contains every role assignment the creator had for the project. This results in the provided keystone token having more role assignments than the creator intended, possibly giving unintended escalated access. See: CVE-2020-12690.",
-            "cve": "CVE-2020-12690",
-            "id": "pyup.io-38258",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37672",
+            "id": "pyup.io-43213",
             "specs": [
-                "<15.0.1",
-                "==16.0.0"
+                "<1.0.0"
             ],
-            "v": "<15.0.1,==16.0.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any authenticated user can create an EC2 credential for themselves for a project that they have a specified role on, and then perform an update to the credential user and project, allowing them to masquerade as another user. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. See: CVE-2020-12691.",
-            "cve": "CVE-2020-12691",
-            "id": "pyup.io-38259",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37670",
+            "id": "pyup.io-43214",
             "specs": [
-                "<15.0.1",
-                "==16.0.0"
+                "<1.0.0"
             ],
-            "v": "<15.0.1,==16.0.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0. Any user authenticated within a limited scope (trust/oauth/application credential) can create an EC2 credential with an escalated permission, such as obtaining admin while the user is on a limited viewer role. This potentially allows a malicious user to act as the admin on a project another user has the admin role on, which can effectively grant that user global admin privileges. See: CVE-2020-12689.",
-            "cve": "CVE-2020-12689",
-            "id": "pyup.io-38257",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37668",
+            "id": "pyup.io-43215",
             "specs": [
-                "<15.0.1",
-                "==16.0.0"
+                "<1.0.0"
             ],
-            "v": "<15.0.1,==16.0.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "OpenStack Keystone 15.0.0 and 16.0.0 are affected by Data Leakage in the list credentials API. Any user with a role on a project is able to list any credentials with the /v3/credentials API when enforce_scope is false. Users with a role on a project are able to view any other users' credentials, which could (for example) leak sign-on information for Time-based One Time Passwords (TOTP). Deployments with enforce_scope set to false are affected. (There will be a slight performance impact for the list credentials API once this issue is fixed.) See: CVE-2019-19687.",
-            "cve": "CVE-2019-19687",
-            "id": "pyup.io-38588",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37677",
+            "id": "pyup.io-43216",
             "specs": [
-                "==15.0.0",
-                "==16.0.0"
+                "<1.0.0"
             ],
-            "v": "==15.0.0,==16.0.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "HTTPSConnections in OpenStack Keystone 2013, OpenStack Compute 2013.1, and possibly other OpenStack components, fail to validate server-side SSL certificates. See: CVE-2013-2255.",
-            "cve": "CVE-2013-2255",
-            "id": "pyup.io-37620",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37679",
+            "id": "pyup.io-43217",
             "specs": [
-                "==2013"
+                "<1.0.0"
             ],
-            "v": "==2013"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "It is possible to remotely trigger a crash in Keystone by sending an extremely long password. When Keystone is validating the password, glibc allocates space on the stack for the entire password. If the password is long enough, stack space can be exhausted, resulting in a crash. This vulnerability is mitigated by a patch to impose a reasonable limit on password length (4 kB). Reportedly, all versions are affected. See also: CVE-2012-1572 and https://security.openstack.org/ossa/OSSA-2012-002.html.",
-            "cve": "CVE-2012-1572",
-            "id": "pyup.io-37740",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37673",
+            "id": "pyup.io-43218",
             "specs": [
-                ">0"
+                "<1.0.0"
             ],
-            "v": ">0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Openstack-keystone 16.0.2, 17.0.1, 18.0.1 and 19.0.1 includes a fix for CVE-2021-38155: OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information disclosure during account locking (related to PCI DSS features). By guessing the name of an account and failing to authenticate multiple times, any unauthenticated actor could both confirm the account exists and obtain that account's corresponding UUID, which might be leveraged for other unrelated attacks. All deployments enabling security_compliance.lockout_failure_attempts are affected.",
-            "cve": "CVE-2021-38155",
-            "id": "pyup.io-41083",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37665",
+            "id": "pyup.io-43219",
             "specs": [
-                ">=10.0.0, <16.0.2",
-                ">=17.0.0, <17.0.1",
-                ">=18.0.0, <18.0.1",
-                ">=19.0.0, <19.0.1"
+                "<1.0.0"
             ],
-            "v": ">=10.0.0, <16.0.2,>=17.0.0, <17.0.1,>=18.0.0, <18.0.1,>=19.0.0, <19.0.1"
-        }
-    ],
-    "opentaxii": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "opentaxii 0.1.11 requires recent version of `lxml` for security reasons.",
-            "cve": "PVE-2021-36897",
-            "id": "pyup.io-36897",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37674",
+            "id": "pyup.io-43220",
             "specs": [
-                "<0.1.11"
+                "<1.0.0"
             ],
-            "v": "<0.1.11"
-        }
-    ],
-    "opentera": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Opentera 1.0.9 adds missing service access checks to the Service API.\r\nhttps://github.com/introlab/opentera/commit/4aa0361f6cd3faa395df6a43755fd197677c5528",
-            "cve": "PVE-2021-42960",
-            "id": "pyup.io-42960",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37663",
+            "id": "pyup.io-43221",
             "specs": [
-                "<1.0.9"
+                "<1.0.0"
             ],
-            "v": "<1.0.9"
-        }
-    ],
-    "openvino": [
+            "v": "<1.0.0"
+        },
         {
-            "advisory": "Openvino 2020.3.1 includes security and functionality bug fixes, and minor capability changes.",
-            "cve": "PVE-2021-40082",
-            "id": "pyup.io-40082",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37690",
+            "id": "pyup.io-43222",
             "specs": [
-                "<2020.3.1"
+                "<1.0.0"
             ],
-            "v": "<2020.3.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Openvino 2021.2 includes GNA related security fixes.\r\nhttps://github.com/openvinotoolkit/openvino/pull/3167",
-            "cve": "PVE-2021-42847",
-            "id": "pyup.io-42847",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37681",
+            "id": "pyup.io-43223",
             "specs": [
-                "<2021.2"
+                "<1.0.0"
             ],
-            "v": "<2021.2"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Openvino 2021.3 includes GNA related security fixes.\r\nhttps://github.com/openvinotoolkit/openvino/pull/4538",
-            "cve": "PVE-2021-42845",
-            "id": "pyup.io-42845",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37691",
+            "id": "pyup.io-43224",
             "specs": [
-                "<2021.3"
+                "<1.0.0"
             ],
-            "v": "<2021.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Openvino 2021.3 updates its dependency 'urllib3' minimum version to v1.25.9 to include a security fix.",
-            "cve": "CVE-2020-26137",
-            "id": "pyup.io-42846",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37637",
+            "id": "pyup.io-43225",
             "specs": [
-                "<2021.3"
+                "<1.0.0"
             ],
-            "v": "<2021.3"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Openvino 2021.4.0 fixes a security issue with XML parsing.\r\nhttps://github.com/openvinotoolkit/openvino/pull/5686",
-            "cve": "PVE-2021-42844",
-            "id": "pyup.io-42844",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37661",
+            "id": "pyup.io-43226",
             "specs": [
-                "<2021.4.0"
+                "<1.0.0"
             ],
-            "v": "<2021.4.0"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Openvino 2022.1 includes LP transformations related security fixes.\r\nhttps://github.com/openvinotoolkit/openvino/pull/8357",
-            "cve": "PVE-2021-42843",
-            "id": "pyup.io-42843",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37660",
+            "id": "pyup.io-43227",
             "specs": [
-                "<2022.1"
+                "<1.0.0"
             ],
-            "v": "<2022.1"
+            "v": "<1.0.0"
         },
         {
-            "advisory": "Openvino 2022.1 includes CPU related security fixes.\r\nhttps://github.com/openvinotoolkit/openvino/pull/8456",
-            "cve": "PVE-2021-42842",
-            "id": "pyup.io-42842",
+            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
+            "cve": "CVE-2021-37657",
+            "id": "pyup.io-43228",
             "specs": [
-                "<2022.1"
+                "<1.0.0"
             ],
-            "v": "<2022.1"
-        }
-    ],
-    "openvino-tensorflow": [
+            "v": "<1.0.0"
+        },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29576",
-            "id": "pyup.io-43201",
+            "cve": "CVE-2021-37653",
+            "id": "pyup.io-43229",
             "specs": [
                 "<1.0.0"
             ],
@@ -21493,8 +26994,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37644",
-            "id": "pyup.io-43211",
+            "cve": "CVE-2021-37682",
+            "id": "pyup.io-43230",
             "specs": [
                 "<1.0.0"
             ],
@@ -21502,8 +27003,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29618",
-            "id": "pyup.io-43173",
+            "cve": "CVE-2021-37646",
+            "id": "pyup.io-43231",
             "specs": [
                 "<1.0.0"
             ],
@@ -21511,8 +27012,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37651",
-            "id": "pyup.io-43241",
+            "cve": "CVE-2021-37641",
+            "id": "pyup.io-43232",
             "specs": [
                 "<1.0.0"
             ],
@@ -21520,8 +27021,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29520",
-            "id": "pyup.io-43099",
+            "cve": "CVE-2021-37652",
+            "id": "pyup.io-43233",
             "specs": [
                 "<1.0.0"
             ],
@@ -21529,8 +27030,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29521",
-            "id": "pyup.io-43101",
+            "cve": "CVE-2021-37666",
+            "id": "pyup.io-43234",
             "specs": [
                 "<1.0.0"
             ],
@@ -21538,8 +27039,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29544",
-            "id": "pyup.io-43107",
+            "cve": "CVE-2021-37659",
+            "id": "pyup.io-43235",
             "specs": [
                 "<1.0.0"
             ],
@@ -21547,8 +27048,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29534",
-            "id": "pyup.io-43108",
+            "cve": "CVE-2021-37650",
+            "id": "pyup.io-43236",
             "specs": [
                 "<1.0.0"
             ],
@@ -21556,8 +27057,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29610",
-            "id": "pyup.io-43109",
+            "cve": "CVE-2021-37688",
+            "id": "pyup.io-43237",
             "specs": [
                 "<1.0.0"
             ],
@@ -21565,8 +27066,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-22898",
-            "id": "pyup.io-43252",
+            "cve": "CVE-2021-37676",
+            "id": "pyup.io-43238",
             "specs": [
                 "<1.0.0"
             ],
@@ -21574,8 +27075,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29566",
-            "id": "pyup.io-43112",
+            "cve": "CVE-2021-37675",
+            "id": "pyup.io-43239",
             "specs": [
                 "<1.0.0"
             ],
@@ -21583,8 +27084,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29563",
-            "id": "pyup.io-43113",
+            "cve": "CVE-2021-37643",
+            "id": "pyup.io-43240",
             "specs": [
                 "<1.0.0"
             ],
@@ -21592,8 +27093,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29560",
-            "id": "pyup.io-43092",
+            "cve": "CVE-2021-37651",
+            "id": "pyup.io-43241",
             "specs": [
                 "<1.0.0"
             ],
@@ -21601,8 +27102,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29550",
-            "id": "pyup.io-43114",
+            "cve": "CVE-2021-37684",
+            "id": "pyup.io-43242",
             "specs": [
                 "<1.0.0"
             ],
@@ -21610,8 +27111,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29545",
-            "id": "pyup.io-43115",
+            "cve": "CVE-2021-37667",
+            "id": "pyup.io-43243",
             "specs": [
                 "<1.0.0"
             ],
@@ -21619,8 +27120,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29567",
-            "id": "pyup.io-43118",
+            "cve": "CVE-2021-37647",
+            "id": "pyup.io-43245",
             "specs": [
                 "<1.0.0"
             ],
@@ -21628,8 +27129,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29535",
-            "id": "pyup.io-43122",
+            "cve": "CVE-2021-37664",
+            "id": "pyup.io-43246",
             "specs": [
                 "<1.0.0"
             ],
@@ -21637,8 +27138,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37686",
-            "id": "pyup.io-43263",
+            "cve": "CVE-2021-37649",
+            "id": "pyup.io-43247",
             "specs": [
                 "<1.0.0"
             ],
@@ -21646,8 +27147,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29617",
-            "id": "pyup.io-43174",
+            "cve": "CVE-2021-37635",
+            "id": "pyup.io-43248",
             "specs": [
                 "<1.0.0"
             ],
@@ -21655,8 +27156,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29548",
-            "id": "pyup.io-43123",
+            "cve": "CVE-2021-37656",
+            "id": "pyup.io-43249",
             "specs": [
                 "<1.0.0"
             ],
@@ -21664,8 +27165,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29575",
-            "id": "pyup.io-43197",
+            "cve": "CVE-2021-37654",
+            "id": "pyup.io-43250",
             "specs": [
                 "<1.0.0"
             ],
@@ -21673,8 +27174,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29536",
-            "id": "pyup.io-43124",
+            "cve": "CVE-2021-37683",
+            "id": "pyup.io-43256",
             "specs": [
                 "<1.0.0"
             ],
@@ -21682,8 +27183,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29573",
-            "id": "pyup.io-43198",
+            "cve": "CVE-2021-37639",
+            "id": "pyup.io-43251",
             "specs": [
                 "<1.0.0"
             ],
@@ -21691,8 +27192,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29515",
-            "id": "pyup.io-43199",
+            "cve": "CVE-2021-37638",
+            "id": "pyup.io-43253",
             "specs": [
                 "<1.0.0"
             ],
@@ -21700,8 +27201,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29574",
-            "id": "pyup.io-43200",
+            "cve": "CVE-2021-37636",
+            "id": "pyup.io-43254",
             "specs": [
                 "<1.0.0"
             ],
@@ -21709,8 +27210,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29540",
-            "id": "pyup.io-43126",
+            "cve": "CVE-2021-37642",
+            "id": "pyup.io-43255",
             "specs": [
                 "<1.0.0"
             ],
@@ -21718,8 +27219,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29571",
-            "id": "pyup.io-43202",
+            "cve": "CVE-2021-37671",
+            "id": "pyup.io-43260",
             "specs": [
                 "<1.0.0"
             ],
@@ -21727,8 +27228,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29608",
-            "id": "pyup.io-43127",
+            "cve": "CVE-2021-37678",
+            "id": "pyup.io-43261",
             "specs": [
                 "<1.0.0"
             ],
@@ -21736,8 +27237,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29577",
-            "id": "pyup.io-43203",
+            "cve": "CVE-2021-37662",
+            "id": "pyup.io-43262",
             "specs": [
                 "<1.0.0"
             ],
@@ -21745,8 +27246,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29614",
-            "id": "pyup.io-43204",
+            "cve": "CVE-2021-37686",
+            "id": "pyup.io-43263",
             "specs": [
                 "<1.0.0"
             ],
@@ -21754,8 +27255,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-22901",
-            "id": "pyup.io-43205",
+            "cve": "CVE-2021-37689",
+            "id": "pyup.io-43257",
             "specs": [
                 "<1.0.0"
             ],
@@ -21763,8 +27264,8 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-22897",
-            "id": "pyup.io-43206",
+            "cve": "CVE-2021-37648",
+            "id": "pyup.io-43258",
             "specs": [
                 "<1.0.0"
             ],
@@ -21772,5417 +27273,5620 @@
         },
         {
             "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29580",
-            "id": "pyup.io-43131",
+            "cve": "CVE-2021-37680",
+            "id": "pyup.io-43259",
             "specs": [
                 "<1.0.0"
             ],
             "v": "<1.0.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-22876",
-            "id": "pyup.io-43207",
+            "advisory": "Openvino-tensorflow 1.0.1 adds extra checks to fix vulnerabilities.\r\nhttps://github.com/openvinotoolkit/openvino_tensorflow/pull/199/files",
+            "cve": "PVE-2021-43091",
+            "id": "pyup.io-43091",
             "specs": [
-                "<1.0.0"
+                "<1.0.1"
             ],
-            "v": "<1.0.0"
+            "v": "<1.0.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29579",
-            "id": "pyup.io-43133",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41214",
+            "id": "pyup.io-43282",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37645",
-            "id": "pyup.io-43208",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41209",
+            "id": "pyup.io-43289",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29581",
-            "id": "pyup.io-43134",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41224",
+            "id": "pyup.io-43294",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37687",
-            "id": "pyup.io-43209",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41195",
+            "id": "pyup.io-43090",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29582",
-            "id": "pyup.io-43135",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41199",
+            "id": "pyup.io-43276",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37685",
-            "id": "pyup.io-43210",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41196",
+            "id": "pyup.io-43277",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37669",
-            "id": "pyup.io-43212",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41203",
+            "id": "pyup.io-43278",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29583",
-            "id": "pyup.io-43137",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41200",
+            "id": "pyup.io-43280",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37672",
-            "id": "pyup.io-43213",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41219",
+            "id": "pyup.io-43283",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37670",
-            "id": "pyup.io-43214",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41226",
+            "id": "pyup.io-43285",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29588",
-            "id": "pyup.io-43140",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41227",
+            "id": "pyup.io-43286",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37668",
-            "id": "pyup.io-43215",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41225",
+            "id": "pyup.io-43287",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29590",
-            "id": "pyup.io-43141",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41221",
+            "id": "pyup.io-43288",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37677",
-            "id": "pyup.io-43216",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41213",
+            "id": "pyup.io-43290",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29592",
-            "id": "pyup.io-43142",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41204",
+            "id": "pyup.io-43291",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37679",
-            "id": "pyup.io-43217",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41228",
+            "id": "pyup.io-43292",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29591",
-            "id": "pyup.io-43143",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41222",
+            "id": "pyup.io-43293",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37673",
-            "id": "pyup.io-43218",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41218",
+            "id": "pyup.io-43295",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37665",
-            "id": "pyup.io-43219",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41216",
+            "id": "pyup.io-43296",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37674",
-            "id": "pyup.io-43220",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41215",
+            "id": "pyup.io-43297",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29596",
-            "id": "pyup.io-43147",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41208",
+            "id": "pyup.io-43298",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29528",
-            "id": "pyup.io-43148",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41217",
+            "id": "pyup.io-43281",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37663",
-            "id": "pyup.io-43221",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41205",
+            "id": "pyup.io-43301",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29593",
-            "id": "pyup.io-43149",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41212",
+            "id": "pyup.io-43302",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37690",
-            "id": "pyup.io-43222",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41210",
+            "id": "pyup.io-43303",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37681",
-            "id": "pyup.io-43223",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41207",
+            "id": "pyup.io-43304",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29597",
-            "id": "pyup.io-43150",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41202",
+            "id": "pyup.io-43305",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37691",
-            "id": "pyup.io-43224",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41201",
+            "id": "pyup.io-43306",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29530",
-            "id": "pyup.io-43151",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41197",
+            "id": "pyup.io-43307",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37637",
-            "id": "pyup.io-43225",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41206",
+            "id": "pyup.io-43300",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29529",
-            "id": "pyup.io-43152",
+            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
+            "cve": "CVE-2021-41198",
+            "id": "pyup.io-43275",
             "specs": [
-                "<1.0.0"
+                "<1.1.0"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1.0"
+        }
+    ],
+    "openxc": [
+        {
+            "advisory": "Openxc 0.15.0 updates multiple dependencies due to vulnerabilities.",
+            "cve": "PVE-2021-41102",
+            "id": "pyup.io-41102",
+            "specs": [
+                "<0.15.0"
+            ],
+            "v": "<0.15.0"
+        }
+    ],
+    "optimade": [
+        {
+            "advisory": "Optimade 0.16.9 updates its dependency 'Elasticsearch' to v7.16.2 to avoid any log4j vulnerability.\r\nhttps://github.com/Materials-Consortia/optimade-python-tools/issues/1040",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-44681",
+            "specs": [
+                "<0.16.9"
+            ],
+            "v": "<0.16.9"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37661",
-            "id": "pyup.io-43226",
+            "advisory": "Optimade 0.16.9 updates its dependency 'Elasticsearch' to v7.16.2 to avoid any log4j vulnerability.\r\nhttps://github.com/Materials-Consortia/optimade-python-tools/issues/1040",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-44696",
             "specs": [
-                "<1.0.0"
+                "<0.16.9"
             ],
-            "v": "<1.0.0"
+            "v": "<0.16.9"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37660",
-            "id": "pyup.io-43227",
+            "advisory": "Optimade 0.16.9 updates its dependency 'Elasticsearch' to v7.16.2 to avoid any log4j vulnerability.\r\nhttps://github.com/Materials-Consortia/optimade-python-tools/issues/1040",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-44695",
             "specs": [
-                "<1.0.0"
+                "<0.16.9"
             ],
-            "v": "<1.0.0"
+            "v": "<0.16.9"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37657",
-            "id": "pyup.io-43228",
+            "advisory": "Optimade 0.7.0 includes a fix that addresses a Django vulnerability. See: <https://github.com/Materials-Consortia/optimade-python-tools/issues/108>.",
+            "cve": "PVE-2021-38453",
+            "id": "pyup.io-38453",
+            "specs": [
+                "<0.7.0"
+            ],
+            "v": "<0.7.0"
+        },
+        {
+            "advisory": "Optimade 0.16.9 uses a version of 'Elasticsearch' (v7.16.2) affected by a log4j vulnerability.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44697",
+            "specs": [
+                "<=0.16.9"
+            ],
+            "v": "<=0.16.9"
+        }
+    ],
+    "optimizely-sdk": [
+        {
+            "advisory": "Optimizely-sdk 4.0.0 stops requiring PyYaml==5.2 as a dependency to resolve security vulnerabilities.\r\nhttps://github.com/optimizely/python-sdk/pull/366/files",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-44535",
+            "specs": [
+                "<4.0.0"
+            ],
+            "v": "<4.0.0"
+        },
+        {
+            "advisory": "Optimizely-sdk 4.0.0 stops requiring PyYaml==5.2 as a dependency to resolve security vulnerabilities.\r\nhttps://github.com/optimizely/python-sdk/pull/366/files",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-44513",
+            "specs": [
+                "<4.0.0"
+            ],
+            "v": "<4.0.0"
+        }
+    ],
+    "orange3-bioinformatics": [
+        {
+            "advisory": "Orange3-bioinformatics 4.2.0 adds the Orange.widgets.credentials.CredentialManager to securely store user password.",
+            "cve": "PVE-2021-38958",
+            "id": "pyup.io-38958",
             "specs": [
-                "<1.0.0"
+                "<4.2.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<4.2.0"
+        }
+    ],
+    "ores": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37653",
-            "id": "pyup.io-43229",
+            "advisory": "Ores 1.3.1 updates its dependency 'pyyaml' to v4.2b4 to include a security fix.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-37949",
             "specs": [
-                "<1.0.0"
+                "<1.3.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.3.1"
+        }
+    ],
+    "ormar": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29599",
-            "id": "pyup.io-43155",
+            "advisory": "Ormar 0.10.9 updates the 'pydantic' library to fix a security vulnerability (CVE-2021-29510).",
+            "cve": "CVE-2021-29510",
+            "id": "pyup.io-40577",
             "specs": [
-                "<1.0.0"
+                "<0.10.9"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.10.9"
+        }
+    ],
+    "ortec.scientific.benchmarks.loadbuilding": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37682",
-            "id": "pyup.io-43230",
+            "advisory": "Ortec.scientific.benchmarks.loadbuilding version 1.0.1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/ORTECScientificBenchmarks/ortec-scientific-benchmarks-loadbuilding/commit/81b5f1ad38bc25ddf8ce1e988cb540a8d7f43482",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41355",
             "specs": [
-                "<1.0.0"
+                "<1.0.1"
             ],
-            "v": "<1.0.0"
+            "v": "<1.0.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37646",
-            "id": "pyup.io-43231",
+            "advisory": "Ortec.scientific.benchmarks.loadbuilding version 0.10.0 is vulnerable to CVE-2020-14343 due to using  \"yaml.full_load()\" and a potentially vulnerable version of its dependency \"pyyaml\". See CVE-2020-14343.\r\nhttps://github.com/ORTECScientificBenchmarks/ortec-scientific-benchmarks-loadbuilding/commit/81b5f1ad38bc25ddf8ce1e988cb540a8d7f43482",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-41757",
             "specs": [
-                "<1.0.0"
+                "==1.0.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "==1.0.1"
+        }
+    ],
+    "osc": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29602",
-            "id": "pyup.io-43157",
+            "advisory": "Osc 0.123 is the first release that performs SSL certificate checks to prevent man-in-the-middle-attacks. Python-m2crypto is needed to make this work. Certificate checks can be turned off per server via 'sslcertck = 0' in .oscrc.",
+            "cve": "PVE-2021-37874",
+            "id": "pyup.io-37874",
             "specs": [
-                "<1.0.0"
+                "<0.123"
             ],
-            "v": "<1.0.0"
+            "v": "<0.123"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37641",
-            "id": "pyup.io-43232",
+            "advisory": "Osc 0.134 includes a security fix for the buildlog function. Terminal control characters are limited now.",
+            "cve": "PVE-2021-37873",
+            "id": "pyup.io-37873",
             "specs": [
-                "<1.0.0"
+                "<0.134"
             ],
-            "v": "<1.0.0"
+            "v": "<0.134"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29601",
-            "id": "pyup.io-43159",
+            "advisory": "Osc 0.151 fixes shell command injection via crafted _service files. See: CVE-2015-0778.",
+            "cve": "CVE-2015-0778",
+            "id": "pyup.io-38486",
             "specs": [
-                "<1.0.0"
+                "<0.151"
             ],
-            "v": "<1.0.0"
+            "v": "<0.151"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37652",
-            "id": "pyup.io-43233",
+            "advisory": "Osc 0.165.3 fixes broken TLS certificate handling. See: CVE-2019-3685.",
+            "cve": "CVE-2019-3685",
+            "id": "pyup.io-38485",
             "specs": [
-                "<1.0.0"
+                "<0.165.3"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.165.3"
+        }
+    ],
+    "osxcollector-output-filters": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37666",
-            "id": "pyup.io-43234",
+            "advisory": "Osxcollector-output-filters version 1.1.1 includes a security patch for the function '_read_config' in 'osxcollector/output_filters/util/config.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/Yelp/osxcollector_output_filters/commit/f9cbe50d8f5a529d59e7cdcddc762cd0f98f5262#diff-40439d01692123eb75a4a7d5114e375d7f08d806adff4806f1f9eab3dd80b0d1",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41356",
             "specs": [
-                "<1.0.0"
+                "<1.1.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.1.1"
+        }
+    ],
+    "otpauth": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29603",
-            "id": "pyup.io-43161",
+            "advisory": "otpauth before 1.0.1 is vulnerable to timing attacks.",
+            "cve": "PVE-2021-25915",
+            "id": "pyup.io-25915",
             "specs": [
-                "<1.0.0"
+                "<1.0.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.0.1"
+        }
+    ],
+    "ovirt-engine-sdk-python": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37659",
-            "id": "pyup.io-43235",
+            "advisory": "The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.",
+            "cve": "CVE-2012-3533",
+            "id": "pyup.io-25916",
             "specs": [
-                "<1.0.0"
+                "<3.1.0.8"
             ],
-            "v": "<1.0.0"
+            "v": "<3.1.0.8"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37650",
-            "id": "pyup.io-43236",
+            "advisory": "ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.",
+            "cve": "CVE-2014-0161",
+            "id": "pyup.io-37754",
             "specs": [
-                "<1.0.0"
+                "<3.4.0.7",
+                "==3.5.0.4"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<3.4.0.7,==3.5.0.4"
+        }
+    ],
+    "ovs": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29542",
-            "id": "pyup.io-43163",
+            "advisory": "ovs 1.3.0 includes a fix that flow setups are now processed in a round-robin manner across ports to prevent any single client from monopolizing the CPU and conducting a denial of service attack.",
+            "cve": "PVE-2021-25917",
+            "id": "pyup.io-25917",
             "specs": [
-                "<1.0.0"
+                "<1.3.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.3.0"
+        }
+    ],
+    "owlmixin": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37688",
-            "id": "pyup.io-43237",
+            "advisory": "An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A \"Load YAML\" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.",
+            "cve": "CVE-2017-16618",
+            "id": "pyup.io-35720",
             "specs": [
-                "<1.0.0"
+                "<2.0.0a12"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<2.0.0a12"
+        }
+    ],
+    "owslib": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29609",
-            "id": "pyup.io-43164",
+            "advisory": "An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected. See CVE-2021-39371.\r\nhttps://github.com/geopython/OWSLib/issues/790\r\nhttps://github.com/geopython/pywps/pull/616",
+            "cve": "CVE-2021-39371",
+            "id": "pyup.io-41213",
             "specs": [
-                "<1.0.0"
+                "==0.24.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "==0.24.1"
+        }
+    ],
+    "paco-models": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37676",
-            "id": "pyup.io-43238",
+            "advisory": "Paco.models 7.8.5 improved the defaults for Load Balancer and CloudFront SSL security policy.\r\nhttps://github.com/waterbear-cloud/paco.models/commit/becf91dd20bb9e7541bda6c91378a20ecf7bb4a8",
+            "cve": "PVE-2021-42798",
+            "id": "pyup.io-42798",
             "specs": [
-                "<1.0.0"
+                "<7.8.5"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<7.8.5"
+        }
+    ],
+    "pact-python": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37675",
-            "id": "pyup.io-43239",
+            "advisory": "Pact-python 1.3.6 includes several vulnerability fixes for Dockerfile(s).",
+            "cve": "PVE-2021-40235",
+            "id": "pyup.io-40235",
             "specs": [
-                "<1.0.0"
+                "<1.3.6"
             ],
-            "v": "<1.0.0"
+            "v": "<1.3.6"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37643",
-            "id": "pyup.io-43240",
+            "advisory": "Pact-python 1.3.7 includes important fixes for Dockerfiles (py37.Dockerfile, py38.Dockerfile, py36.Dockerfile) to reduce vulnerabilities.",
+            "cve": "PVE-2021-40324",
+            "id": "pyup.io-40324",
             "specs": [
-                "<1.0.0"
+                "<1.3.7"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.3.7"
+        }
+    ],
+    "pacyam": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37684",
-            "id": "pyup.io-43242",
+            "advisory": "Pacyam version 1.1.1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/dstarner/pacyam/commit/0640b259c0e5909c1010b6780e10b88f8fdd1c17#diff-8b9ae2192ea7474817342a2e0d103b63f28618bd1e495bc8227f711757ea91eb",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41358",
             "specs": [
-                "<1.0.0"
+                "<1.1.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.1.1"
+        }
+    ],
+    "pakettikauppa": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37667",
-            "id": "pyup.io-43243",
+            "advisory": "pakettikauppa 0.1.2 fixes Pip files and requirement files for fixing security issue in pyyaml module",
+            "cve": "PVE-2021-36779",
+            "id": "pyup.io-36779",
             "specs": [
-                "<1.0.0"
+                "<0.1.2"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.1.2"
+        }
+    ],
+    "palladium": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29523",
-            "id": "pyup.io-43094",
+            "advisory": "Palladium 1.2.2 updates its dependency 'urllib3' to v1.25.3 to include security fixes.",
+            "cve": "CVE-2019-11236",
+            "id": "pyup.io-44632",
             "specs": [
-                "<1.0.0"
+                "<1.2.2"
             ],
-            "v": "<1.0.0"
+            "v": "<1.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29525",
-            "id": "pyup.io-43095",
+            "advisory": "Palladium 1.2.2 updates its dependency 'Werkzeug' to v0.15.5 to include a security fix.",
+            "cve": "CVE-2019-14806",
+            "id": "pyup.io-44633",
             "specs": [
-                "<1.0.0"
+                "<1.2.2"
             ],
-            "v": "<1.0.0"
+            "v": "<1.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29519",
-            "id": "pyup.io-43096",
+            "advisory": "Palladium 1.2.2 updates its dependency 'jinja2' to v2.10.1 to include a security fix.",
+            "cve": "CVE-2019-10906",
+            "id": "pyup.io-37378",
             "specs": [
-                "<1.0.0"
+                "<1.2.2"
             ],
-            "v": "<1.0.0"
+            "v": "<1.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29522",
-            "id": "pyup.io-43097",
+            "advisory": "Palladium 1.2.2 updates its dependency 'numpy' to v1.17.0 to include a security fix.",
+            "cve": "CVE-2019-6446",
+            "id": "pyup.io-44628",
             "specs": [
-                "<1.0.0"
+                "<1.2.2"
             ],
-            "v": "<1.0.0"
+            "v": "<1.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29524",
-            "id": "pyup.io-43098",
+            "advisory": "Palladium 1.2.2 updates its dependency 'SQLAlchemy' to v1.3.6 to include a security fix.",
+            "cve": "CVE-2019-7164",
+            "id": "pyup.io-44629",
             "specs": [
-                "<1.0.0"
+                "<1.2.2"
             ],
-            "v": "<1.0.0"
+            "v": "<1.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29564",
-            "id": "pyup.io-43100",
+            "advisory": "Palladium 1.2.2 updates its dependency 'SQLAlchemy' to v1.3.6 to include a security fix.",
+            "cve": "CVE-2019-7548",
+            "id": "pyup.io-44630",
             "specs": [
-                "<1.0.0"
+                "<1.2.2"
             ],
-            "v": "<1.0.0"
+            "v": "<1.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2020-8169",
-            "id": "pyup.io-43102",
+            "advisory": "Palladium 1.2.2 updates its dependency 'urllib3' to v1.25.3 to include security fixes.",
+            "cve": "CVE-2019-11324",
+            "id": "pyup.io-44631",
             "specs": [
-                "<1.0.0"
+                "<1.2.2"
             ],
-            "v": "<1.0.0"
+            "v": "<1.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29532",
-            "id": "pyup.io-43103",
+            "advisory": "Palladium 1.2.3 updates its requirements in order to use newer versions of dependencies. This fixes some potential security vulnerabilities.",
+            "cve": "PVE-2021-38263",
+            "id": "pyup.io-38263",
             "specs": [
-                "<1.0.0"
+                "<1.2.3"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.2.3"
+        }
+    ],
+    "pandas-zmq": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29616",
-            "id": "pyup.io-43104",
+            "advisory": "Pandas-zmq 0.0.2 adds a signature to improve security.",
+            "cve": "PVE-2021-38627",
+            "id": "pyup.io-38627",
             "specs": [
-                "<1.0.0"
+                "<0.0.2"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.0.2"
+        }
+    ],
+    "pandevice": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29543",
-            "id": "pyup.io-43105",
+            "advisory": "Pandevice 0.11.0 adds `uuid` params for security and NAT rules.",
+            "cve": "PVE-2021-37198",
+            "id": "pyup.io-37198",
             "specs": [
-                "<1.0.0"
+                "<0.11.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.11.0"
+        }
+    ],
+    "pando": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29547",
-            "id": "pyup.io-43106",
+            "advisory": "pando before 0.39 is vulnerable to security bugs related to CRLF injection.",
+            "cve": "PVE-2021-25918",
+            "id": "pyup.io-25918",
             "specs": [
-                "<1.0.0"
+                "<0.39"
             ],
-            "v": "<1.0.0"
+            "v": "<0.39"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29587",
-            "id": "pyup.io-43110",
+            "advisory": "pando before 0.42 is vulnerable to URL redirection attacks.",
+            "cve": "PVE-2021-25919",
+            "id": "pyup.io-25919",
             "specs": [
-                "<1.0.0"
+                "<0.42"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.42"
+        }
+    ],
+    "pangres": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29568",
-            "id": "pyup.io-43111",
+            "advisory": "Pangres 2.1 was released with the claim that it became completely SQL injection safe. Everything is escaped or parameterized including schema, table and column names.",
+            "cve": "PVE-2021-39284",
+            "id": "pyup.io-39284",
             "specs": [
-                "<1.0.0"
+                "<2.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<2.1"
+        }
+    ],
+    "panoptes-utils": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29537",
-            "id": "pyup.io-43116",
+            "advisory": "Panoptes-utils 0.2.21 updates its dependency 'PyYaml' to v5.3.1 to include security fixes.",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-38493",
             "specs": [
-                "<1.0.0"
+                "<0.2.21"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.2.21"
+        }
+    ],
+    "paradrop": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29514",
-            "id": "pyup.io-43117",
+            "advisory": "Paradrop 0.10.0 supports more WiFi encryption settings, including properly supporting CCMP for better security.",
+            "cve": "PVE-2021-37491",
+            "id": "pyup.io-37491",
             "specs": [
-                "<1.0.0"
+                "<0.10.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.10.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29589",
-            "id": "pyup.io-43119",
+            "advisory": "Paradrop 0.13.0 updates its dependency pyOpenSSL to v17.5.0 to include a security fix.",
+            "cve": "CVE-2018-1000808",
+            "id": "pyup.io-37490",
             "specs": [
-                "<1.0.0"
+                "<0.13.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.13.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29512",
-            "id": "pyup.io-43120",
+            "advisory": "Paradrop 0.13.0 updates its dependency urllib3 to v1.24.1 to include a security fix.",
+            "cve": "CVE-2018-20060",
+            "id": "pyup.io-42700",
             "specs": [
-                "<1.0.0"
+                "<0.13.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.13.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29533",
-            "id": "pyup.io-43121",
+            "advisory": "Paradrop 0.13.0 updates its dependency requests to v2.20.1 to include a security fix.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-42701",
             "specs": [
-                "<1.0.0"
+                "<0.13.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.13.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29538",
-            "id": "pyup.io-43125",
+            "advisory": "Paradrop 0.5 secures the router settings page with a login system.",
+            "cve": "PVE-2021-37492",
+            "id": "pyup.io-37492",
             "specs": [
-                "<1.0.0"
+                "<0.5"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.5"
+        }
+    ],
+    "paramiko": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29551",
-            "id": "pyup.io-43128",
+            "advisory": "Paramiko 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5 and 1.17.6 include a fix for CVE-2018-7750: transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.\r\nhttps://github.com/paramiko/paramiko/issues/1175",
+            "cve": "CVE-2018-7750",
+            "id": "pyup.io-41269",
             "specs": [
-                "<1.0.0"
+                "<1.17.6",
+                ">=2.0.0,<2.0.8",
+                ">=2.1.0,<2.1.5",
+                ">=2.2.0,<2.2.3",
+                ">=2.3.0,<2.3.2",
+                "==2.4.0",
+                ">=1.18.0,<1.18.5"
             ],
-            "v": "<1.0.0"
+            "v": "<1.17.6,>=2.0.0,<2.0.8,>=2.1.0,<2.1.5,>=2.2.0,<2.2.3,>=2.3.0,<2.3.2,==2.4.0,>=1.18.0,<1.18.5"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29513",
-            "id": "pyup.io-43129",
+            "advisory": "Paramiko 1.7.2 fixes the PRNG to be more secure on Windows and in cases where fork() is called.",
+            "cve": "PVE-2021-27486",
+            "id": "pyup.io-27486",
             "specs": [
-                "<1.0.0"
+                "<1.7.2"
             ],
-            "v": "<1.0.0"
+            "v": "<1.7.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29572",
-            "id": "pyup.io-43130",
+            "advisory": "Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity. See CVE-2018-1000805.\r\nhttps://github.com/paramiko/paramiko/issues/1283",
+            "cve": "CVE-2018-1000805",
+            "id": "pyup.io-41268",
+            "specs": [
+                "==1.17.6",
+                "==1.18.5",
+                "==2.0.8",
+                "==2.1.5",
+                "==2.2.3",
+                "==2.3.2",
+                "==2.4.1"
+            ],
+            "v": "==1.17.6,==1.18.5,==2.0.8,==2.1.5,==2.2.3,==2.3.2,==2.4.1"
+        }
+    ],
+    "passlib": [
+        {
+            "advisory": "passlib before 1.4 not disabled unix_fallback's \"wildcard password\" support unless explicitly enabled by user.",
+            "cve": "PVE-2021-25921",
+            "id": "pyup.io-25921",
             "specs": [
-                "<1.0.0"
+                "<1.4"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.4"
+        }
+    ],
+    "password-safe-box": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29578",
-            "id": "pyup.io-43132",
+            "advisory": "Password-safe-box 0.2 adds Fast Convert (which provides slightly better security than a normal hash).",
+            "cve": "PVE-2021-38703",
+            "id": "pyup.io-38703",
             "specs": [
-                "<1.0.0"
+                "<0.2"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.2"
+        }
+    ],
+    "paste": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29584",
-            "id": "pyup.io-43136",
+            "advisory": "paste before 0.9.5 has a security vulnerability in ``paste.urlparser``'s StaticURLParser and PkgResourcesParser where, with some servers, you could escape the document root.",
+            "cve": "PVE-2021-25922",
+            "id": "pyup.io-25922",
             "specs": [
-                "<1.0.0"
+                "<0.9.5"
             ],
-            "v": "<1.0.0"
+            "v": "<0.9.5"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29585",
-            "id": "pyup.io-43138",
+            "advisory": "paste 1.1 includes a security fix for ``paste.urlparser.StaticURLParser``.  The problem allowed escaping the root (and reading files) when used with ``paste.httpserver`` (this does not effect other servers, and does not apply when proxying requests from Apache to  ``paste.httpserver``).",
+            "cve": "PVE-2021-25923",
+            "id": "pyup.io-25923",
             "specs": [
-                "<1.0.0"
+                "<1.1"
             ],
-            "v": "<1.0.0"
+            "v": "<1.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29586",
-            "id": "pyup.io-43139",
+            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticURLParser, (2) paste.urlparser.PkgResourcesParser, (3) paste.urlmap.URLMap, and (4) HTTPNotFound.",
+            "cve": "CVE-2010-2477",
+            "id": "pyup.io-35340",
             "specs": [
-                "<1.0.0"
+                "<1.7.4"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.7.4"
+        }
+    ],
+    "pastescript": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29595",
-            "id": "pyup.io-43144",
+            "advisory": "Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.",
+            "cve": "CVE-2012-0878",
+            "id": "pyup.io-25925",
             "specs": [
-                "<1.0.0"
+                "<1.7.5"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.7.5"
+        }
+    ],
+    "pathfinder": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29594",
-            "id": "pyup.io-43145",
+            "advisory": "Pathfinder 0.5.4 includes a fix that addresses a security alert regarding the version of jinja2.",
+            "cve": "PVE-2021-38220",
+            "id": "pyup.io-38220",
             "specs": [
-                "<1.0.0"
+                "<0.5.4"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.5.4"
+        }
+    ],
+    "patroni": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29527",
-            "id": "pyup.io-43146",
+            "advisory": "Patroni 2.0.2 uses 'hmac.compare_digest()' instead of '==' for performing the REST API authentication. The previous was vulnerable to timing attacks.",
+            "cve": "PVE-2021-42998",
+            "id": "pyup.io-42998",
             "specs": [
-                "<1.0.0"
+                "<2.0.2"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<2.0.2"
+        }
+    ],
+    "payton": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29598",
-            "id": "pyup.io-43153",
+            "advisory": "payton 0.1.4 upgrades Pillow from 7.x, since it had a security issue. This version is just for upgrading Pillow up to a secure version.",
+            "cve": "PVE-2021-40214",
+            "id": "pyup.io-40214",
             "specs": [
-                "<1.0.0"
+                "<0.1.4"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.1.4"
+        }
+    ],
+    "pconf": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29531",
-            "id": "pyup.io-43154",
+            "advisory": "pconf before 1.3.3 is vulnerable to arbitrary code execution related to [CVE-2017-18342](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342) because of YAML's `load`. \r\nThis upgrades to use YAML `safe_load` instead of `load`.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-36293",
             "specs": [
-                "<1.0.0"
+                "<1.3.3"
             ],
-            "v": "<1.0.0"
+            "v": "<1.3.3"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29600",
-            "id": "pyup.io-43156",
+            "advisory": "Pconf 1.7.1 updates its dependency 'pyyaml' to v5.3.1 to include security fixes.",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-43971",
             "specs": [
-                "<1.0.0"
+                "<1.7.1"
             ],
-            "v": "<1.0.0"
+            "v": "<1.7.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29604",
-            "id": "pyup.io-43158",
+            "advisory": "Pconf 1.7.1 updates its dependency 'pyyaml' to v5.3.1 to include security fixes.",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-44483",
             "specs": [
-                "<1.0.0"
+                "<1.7.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.7.1"
+        }
+    ],
+    "pcp": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29605",
-            "id": "pyup.io-43160",
+            "advisory": "pcp before 2.1.911 has a not further described vulnerability in pcp.spec.in.",
+            "cve": "PVE-2021-25926",
+            "id": "pyup.io-25926",
             "specs": [
-                "<1.0.0"
+                "<2.1.911"
             ],
-            "v": "<1.0.0"
+            "v": "<2.1.911"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29606",
-            "id": "pyup.io-43162",
+            "advisory": "Pcp 4.3.4 completes the secure TLS connection support for pmproxy.\r\nhttps://github.com/performancecopilot/pcp/commit/7bc3b68d8b93be7b86edaea149237c1ea6f3d9c6",
+            "cve": "PVE-2021-42788",
+            "id": "pyup.io-42788",
             "specs": [
-                "<1.0.0"
+                "<4.3.4"
             ],
-            "v": "<1.0.0"
+            "v": "<4.3.4"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29541",
-            "id": "pyup.io-43165",
+            "advisory": "Pcp 5.2.2 makes pmcd init NSS as read-only when using secure connections.\r\nhttps://github.com/performancecopilot/pcp/commit/c85528b1865336ad108a211a87f24132cf45d554",
+            "cve": "PVE-2021-42786",
+            "id": "pyup.io-42786",
             "specs": [
-                "<1.0.0"
+                "<5.2.2"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<5.2.2"
+        }
+    ],
+    "pdfextract": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29607",
-            "id": "pyup.io-43166",
+            "advisory": "Pdfextract before 0.0.2 is using \"eval\" on filenames, leading to execution of arbitrary Python code.",
+            "cve": "PVE-2021-25927",
+            "id": "pyup.io-25927",
             "specs": [
-                "<1.0.0"
+                "<0.0.2"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.0.2"
+        }
+    ],
+    "pdfreader": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29611",
-            "id": "pyup.io-43167",
+            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
+            "cve": "CVE-2020-10379",
+            "id": "pyup.io-39314",
             "specs": [
-                "<1.0.0"
+                "<0.1.6"
             ],
-            "v": "<1.0.0"
+            "v": "<0.1.6"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29612",
-            "id": "pyup.io-43168",
+            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
+            "cve": "CVE-2020-10994",
+            "id": "pyup.io-43476",
             "specs": [
-                "<1.0.0"
+                "<0.1.6"
             ],
-            "v": "<1.0.0"
+            "v": "<0.1.6"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37658",
-            "id": "pyup.io-43244",
+            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
+            "cve": "CVE-2020-10378",
+            "id": "pyup.io-43477",
             "specs": [
-                "<1.0.0"
+                "<0.1.6"
             ],
-            "v": "<1.0.0"
+            "v": "<0.1.6"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37647",
-            "id": "pyup.io-43245",
+            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
+            "cve": "CVE-2020-10377",
+            "id": "pyup.io-43478",
             "specs": [
-                "<1.0.0"
+                "<0.1.6"
             ],
-            "v": "<1.0.0"
+            "v": "<0.1.6"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37664",
-            "id": "pyup.io-43246",
+            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
+            "cve": "CVE-2020-11538",
+            "id": "pyup.io-43475",
             "specs": [
-                "<1.0.0"
+                "<0.1.6"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.1.6"
+        }
+    ],
+    "pdkit": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37649",
-            "id": "pyup.io-43247",
+            "advisory": "Pdkit 1.2.1 includes an unspecified security fix for included libraries.",
+            "cve": "PVE-2021-37793",
+            "id": "pyup.io-37793",
             "specs": [
-                "<1.0.0"
+                "<1.2.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.2.1"
+        }
+    ],
+    "peewee": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37635",
-            "id": "pyup.io-43248",
+            "advisory": "The main change in this release is the removal of the `AESEncryptedField`,\r\nwhich was included as part of the `playhouse.fields` extension. It was brought\r\nto my attention that there was some serious potential for security\r\nvulnerabilities. Rather than give users a false sense of security, I've decided\r\nthe best course of action is to remove the field.",
+            "cve": "PVE-2021-34337",
+            "id": "pyup.io-34337",
             "specs": [
-                "<1.0.0"
+                "<2.10.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<2.10.0"
+        }
+    ],
+    "pelutils": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37656",
-            "id": "pyup.io-43249",
+            "advisory": "Pelutils version 0.6.0 makes 'log.throw' private, as it could be exploited.",
+            "cve": "PVE-2021-42045",
+            "id": "pyup.io-42045",
             "specs": [
-                "<1.0.0"
+                "<0.6.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.6.0"
+        }
+    ],
+    "peppercorn": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37654",
-            "id": "pyup.io-43250",
+            "advisory": "peppercorn before 0.5 is vulnerable to DoS attacks due to the use of an iterative parser rather than a recursive parser.",
+            "cve": "PVE-2021-25928",
+            "id": "pyup.io-25928",
             "specs": [
-                "<1.0.0"
+                "<0.5"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.5"
+        }
+    ],
+    "perceval-zulip": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37639",
-            "id": "pyup.io-43251",
+            "advisory": "Perceval-zulip 0.2.0 drops support for Python < 3.7 as it arrived to End-of-Life in December 2021.\r\nhttps://github.com/vchrombie/grimoirelab-perceval-zulip/commit/328938531bb95c2407d75d94db452f5dceb73d16",
+            "cve": "CVE-2018-1060",
+            "id": "pyup.io-44442",
             "specs": [
-                "<1.0.0"
+                "<0.2.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.2.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37638",
-            "id": "pyup.io-43253",
+            "advisory": "Perceval-zulip 0.2.0 drops support for Python < 3.7 as it arrived to End-of-Life in December 2021.\r\nhttps://github.com/vchrombie/grimoirelab-perceval-zulip/commit/328938531bb95c2407d75d94db452f5dceb73d16",
+            "cve": "CVE-2018-1061",
+            "id": "pyup.io-44467",
             "specs": [
-                "<1.0.0"
+                "<0.2.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.2.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37636",
-            "id": "pyup.io-43254",
+            "advisory": "Perceval-zulip 0.2.0 drops support for Python < 3.7 as it arrived to End-of-Life in December 2021.\r\nhttps://github.com/vchrombie/grimoirelab-perceval-zulip/commit/328938531bb95c2407d75d94db452f5dceb73d16",
+            "cve": "PVE-2021-42403",
+            "id": "pyup.io-44468",
             "specs": [
-                "<1.0.0"
+                "<0.2.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.2.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37642",
-            "id": "pyup.io-43255",
+            "advisory": "Perceval-zulip 0.2.0 drops support for Python < 3.7 as it arrived to End-of-Life in December 2021.\r\nhttps://github.com/vchrombie/grimoirelab-perceval-zulip/commit/328938531bb95c2407d75d94db452f5dceb73d16",
+            "cve": "CVE-2016-0718",
+            "id": "pyup.io-44469",
             "specs": [
-                "<1.0.0"
+                "<0.2.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.2.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37683",
-            "id": "pyup.io-43256",
+            "advisory": "Perceval-zulip 0.2.0 drops support for Python < 3.7 as it arrived to End-of-Life in December 2021.\r\nhttps://github.com/vchrombie/grimoirelab-perceval-zulip/commit/328938531bb95c2407d75d94db452f5dceb73d16",
+            "cve": "CVE-2016-4472",
+            "id": "pyup.io-44470",
             "specs": [
-                "<1.0.0"
+                "<0.2.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.2.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37689",
-            "id": "pyup.io-43257",
+            "advisory": "Perceval-zulip 0.2.0 drops support for Python < 3.7 as it arrived to End-of-Life in December 2021.\r\nhttps://github.com/vchrombie/grimoirelab-perceval-zulip/commit/328938531bb95c2407d75d94db452f5dceb73d16",
+            "cve": "CVE-2016-5300",
+            "id": "pyup.io-44471",
             "specs": [
-                "<1.0.0"
+                "<0.2.0"
             ],
-            "v": "<1.0.0"
+            "v": "<0.2.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37648",
-            "id": "pyup.io-43258",
+            "advisory": "Perceval-zulip 0.2.0 drops support for Python < 3.7 as it arrived to End-of-Life in December 2021.\r\nhttps://github.com/vchrombie/grimoirelab-perceval-zulip/commit/328938531bb95c2407d75d94db452f5dceb73d16",
+            "cve": "CVE-2012-6702",
+            "id": "pyup.io-44472",
             "specs": [
-                "<1.0.0"
+                "<0.2.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.2.0"
+        }
+    ],
+    "persephone": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37680",
-            "id": "pyup.io-43259",
+            "advisory": "Persephone 0.4.0 updates the nltk dependency to resolve a possible security issue.",
+            "cve": "PVE-2021-38231",
+            "id": "pyup.io-38231",
             "specs": [
-                "<1.0.0"
+                "<0.4.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.4.0"
+        }
+    ],
+    "petl": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37671",
-            "id": "pyup.io-43260",
+            "advisory": "petl before 1.68, in some configurations, allows resolution of entities in an XML document.",
+            "cve": "CVE-2020-29128",
+            "id": "pyup.io-42292",
             "specs": [
-                "<1.0.0"
+                "<1.6.8"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<1.6.8"
+        }
+    ],
+    "pex": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37678",
-            "id": "pyup.io-43261",
+            "advisory": "pex before 0.5.6 follows links which may lead to security issues: https://rbcommons.com/s/twitter/r/293/.",
+            "cve": "PVE-2021-25929",
+            "id": "pyup.io-25929",
             "specs": [
-                "<1.0.0"
+                "<0.5.6"
             ],
-            "v": "<1.0.0"
+            "v": "<0.5.6"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-37662",
-            "id": "pyup.io-43262",
+            "advisory": "Pex 0.8.0 includes a fix to refactor http handling to allow for alternate http implementations.  This adds support  for 'requests' <https://github.com/kennethreitz/requests>, improving both performance and security.  For more information, read the commit notes at <https://github.com/pantsbuild/pex/commit/91c7f324085c18af714d35947b603a5f60aeb682> and <https://rbcommons.com/s/twitter/r/778/>.",
+            "cve": "PVE-2021-27426",
+            "id": "pyup.io-27426",
             "specs": [
-                "<1.0.0"
+                "<0.8.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.8.0"
+        }
+    ],
+    "pfun": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29546",
-            "id": "pyup.io-43169",
+            "advisory": "Pfun 0.12.0 updates the 'aiohttp' dependency to 3.7.4 to avoid an open redirect vulnerability.",
+            "cve": "CVE-2021-21330",
+            "id": "pyup.io-40141",
             "specs": [
-                "<1.0.0"
+                "<0.12.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.12.0"
+        }
+    ],
+    "pgbedrock": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29613",
-            "id": "pyup.io-43170",
+            "advisory": "Pgbedrock version 0.4.2 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/Squarespace/pgbedrock/commit/a217fa419fbb88fd4949ea6db7ca2fa9869cf8e1",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41360",
             "specs": [
-                "<1.0.0"
+                "<0.4.2"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.4.2"
+        }
+    ],
+    "phileo": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29615",
-            "id": "pyup.io-43171",
+            "advisory": "phileo before 0.3 allows users to like anything and everything, which could potentially lead to security problems (eg. liking entries in permission tables, and thus seeing their content; liking administrative users and thus getting their username).",
+            "cve": "PVE-2021-25930",
+            "id": "pyup.io-25930",
             "specs": [
-                "<1.0.0"
+                "<0.3"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.3"
+        }
+    ],
+    "phoenix-letter": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29549",
-            "id": "pyup.io-43172",
+            "advisory": "Phoenix-letter 0.2.0 adds the flag '--aws-keys' to securely ask for the AWS credentials to avoid keeping sensitive information accessible in plain text. Without this flag, it falls back to the Boto3 default credential search.",
+            "cve": "PVE-2021-39438",
+            "id": "pyup.io-39438",
             "specs": [
-                "<1.0.0"
+                "<0.2.0"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.2.0"
+        }
+    ],
+    "phonenumbers": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29553",
-            "id": "pyup.io-43175",
+            "advisory": "Phonenumbers 8.3.1 contains a security improvement of the getNationalSignificantNumber function to make it more robust against malicious input.",
+            "cve": "PVE-2021-39441",
+            "id": "pyup.io-39441",
             "specs": [
-                "<1.0.0"
+                "<8.3.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<8.3.1"
+        }
+    ],
+    "photocrawl": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29619",
-            "id": "pyup.io-43176",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-43529",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29552",
-            "id": "pyup.io-43177",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-43541",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29554",
-            "id": "pyup.io-43178",
+            "advisory": "Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
+            "cve": "CVE-2020-15999",
+            "id": "pyup.io-43530",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2020-8177",
-            "id": "pyup.io-43179",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-43531",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29555",
-            "id": "pyup.io-43180",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-43532",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2020-8231",
-            "id": "pyup.io-43181",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-43533",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29557",
-            "id": "pyup.io-43182",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-25289",
+            "id": "pyup.io-43534",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2020-8284",
-            "id": "pyup.io-43183",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-25290",
+            "id": "pyup.io-43535",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29556",
-            "id": "pyup.io-43184",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-25291",
+            "id": "pyup.io-43536",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29558",
-            "id": "pyup.io-43185",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-25292",
+            "id": "pyup.io-43537",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2020-8286",
-            "id": "pyup.io-43186",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-25293",
+            "id": "pyup.io-43538",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29559",
-            "id": "pyup.io-43187",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-25287",
+            "id": "pyup.io-43539",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29565",
-            "id": "pyup.io-43188",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-25288",
+            "id": "pyup.io-43540",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29518",
-            "id": "pyup.io-43189",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-43542",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29526",
-            "id": "pyup.io-43190",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-43543",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29516",
-            "id": "pyup.io-43191",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-28676",
+            "id": "pyup.io-43544",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29517",
-            "id": "pyup.io-43192",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-28677",
+            "id": "pyup.io-43545",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29569",
-            "id": "pyup.io-43193",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-28678",
+            "id": "pyup.io-43546",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29562",
-            "id": "pyup.io-43194",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-34552",
+            "id": "pyup.io-43547",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
+            "v": "<0.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29561",
-            "id": "pyup.io-43195",
+            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-41714",
             "specs": [
-                "<1.0.0"
+                "<0.3.1"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.3.1"
+        }
+    ],
+    "pi-mqtt-gpio": [
         {
-            "advisory": "Openvino-tensorflow 1.0.0 updates its dependency 'tensorflow' to v2.5.1 to include security fixes.",
-            "cve": "CVE-2021-29570",
-            "id": "pyup.io-43196",
+            "advisory": "Pi-mqtt-gpio 0.5.2 updates the PyYAML to a version that doesn't suffer from CVE-2020-1747 vulnerability.",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-39464",
             "specs": [
-                "<1.0.0"
+                "<0.5.2"
             ],
-            "v": "<1.0.0"
-        },
+            "v": "<0.5.2"
+        }
+    ],
+    "piccolo": [
         {
-            "advisory": "Openvino-tensorflow 1.0.1 adds extra checks to fix vulnerabilities.\r\nhttps://github.com/openvinotoolkit/openvino_tensorflow/pull/199/files",
-            "cve": "PVE-2021-43091",
-            "id": "pyup.io-43091",
+            "advisory": "Piccolo 0.13.1 bumps the 'Node' dependencies with security warnings.",
+            "cve": "PVE-2021-40659",
+            "id": "pyup.io-40659",
             "specs": [
-                "<1.0.1"
+                "<0.13.1"
             ],
-            "v": "<1.0.1"
+            "v": "<0.13.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41195",
-            "id": "pyup.io-43090",
+            "advisory": "Piccolo 0.2 uses 'QueryString' internally to represent queries (instead of raw strings) to harden against SQL injection.",
+            "cve": "PVE-2021-38919",
+            "id": "pyup.io-38919",
             "specs": [
-                "<1.1.0"
+                "<0.2"
             ],
-            "v": "<1.1.0"
+            "v": "<0.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41198",
-            "id": "pyup.io-43275",
+            "advisory": "Piccolo 0.9.1 bumps node requirements because of a security warning.",
+            "cve": "PVE-2021-38768",
+            "id": "pyup.io-38768",
             "specs": [
-                "<1.1.0"
+                "<0.9.1"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<0.9.1"
+        }
+    ],
+    "piccolo-admin": [
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41199",
-            "id": "pyup.io-43276",
+            "advisory": "Piccolo-admin 0.13.1 updates underlying 'Node.js' dependencies with security warnings.",
+            "cve": "PVE-2021-40867",
+            "id": "pyup.io-40867",
             "specs": [
-                "<1.1.0"
+                "<0.13.1"
             ],
-            "v": "<1.1.0"
+            "v": "<0.13.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41196",
-            "id": "pyup.io-43277",
+            "advisory": "Piccolo-admin 0.9.1 upgrades the node requirements because of a security warning.",
+            "cve": "PVE-2021-38643",
+            "id": "pyup.io-38643",
             "specs": [
-                "<1.1.0"
+                "<0.9.1"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<0.9.1"
+        }
+    ],
+    "pigar": [
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41203",
-            "id": "pyup.io-43278",
+            "advisory": "Pigar 0.9.1 fixes some potential security vulnerabilities upgrading its dependency 'requests' to v2.21.0.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36904",
             "specs": [
-                "<1.1.0"
+                "<0.9.1"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<0.9.1"
+        }
+    ],
+    "piicatcher": [
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41200",
-            "id": "pyup.io-43280",
+            "advisory": "Piicatcher 0.14.0 gets security updates.",
+            "cve": "PVE-2021-41186",
+            "id": "pyup.io-41186",
             "specs": [
-                "<1.1.0"
+                "<0.14.0"
             ],
-            "v": "<1.1.0"
+            "v": "<0.14.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41217",
-            "id": "pyup.io-43281",
+            "advisory": "Piicatcher 0.3.1 updates cryptography due to security advisory.",
+            "cve": "PVE-2021-41165",
+            "id": "pyup.io-41165",
             "specs": [
-                "<1.1.0"
+                "<0.3.1"
             ],
-            "v": "<1.1.0"
-        },
+            "v": "<0.3.1"
+        }
+    ],
+    "pikepdf": [
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41214",
-            "id": "pyup.io-43282",
+            "advisory": "models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.",
+            "cve": "CVE-2021-29421",
+            "id": "pyup.io-40137",
             "specs": [
-                "<1.1.0"
+                ">=1.3.0,<=2.9.2"
             ],
-            "v": "<1.1.0"
-        },
+            "v": ">=1.3.0,<=2.9.2"
+        }
+    ],
+    "pillow": [
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41219",
-            "id": "pyup.io-43283",
+            "advisory": "pillow before 2.3.1 makes insecure use of tempfile.mktemp (CVE-2014-1933).",
+            "cve": "CVE-2014-1933",
+            "id": "pyup.io-39580",
             "specs": [
-                "<1.1.0"
+                "<2.3.1"
             ],
-            "v": "<1.1.0"
+            "v": "<2.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41226",
-            "id": "pyup.io-43285",
+            "advisory": "pillow before 2.3.1 makes insecure use of tempfile.mktemp (CVE-2014-1932).",
+            "cve": "CVE-2014-1932",
+            "id": "pyup.io-25931",
             "specs": [
-                "<1.1.0"
+                "<2.3.1"
             ],
-            "v": "<1.1.0"
+            "v": "<2.3.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41227",
-            "id": "pyup.io-43286",
+            "advisory": "Pillow versions 2.3.2 and 2.5.2 include a fix for CVE-2014-3589: PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.\r\nhttps://github.com/python-pillow/Pillow/commit/205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d",
+            "cve": "CVE-2014-3589",
+            "id": "pyup.io-25932",
             "specs": [
-                "<1.1.0"
+                "<2.3.2",
+                ">=2.5.0,<2.5.2"
             ],
-            "v": "<1.1.0"
+            "v": "<2.3.2,>=2.5.0,<2.5.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41225",
-            "id": "pyup.io-43287",
+            "advisory": "Pillow 2.5.0 includes a fix that prevents shell injection.\nhttps://github.com/python-pillow/Pillow/pull/731",
+            "cve": "CVE-2014-3007",
+            "id": "pyup.io-38907",
             "specs": [
-                "<1.1.0"
+                "<2.5.0"
             ],
-            "v": "<1.1.0"
+            "v": "<2.5.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41221",
-            "id": "pyup.io-43288",
+            "advisory": "pillow before 2.5.2 is vulnerable to a DoS in the IcnsImagePlugin.",
+            "cve": "CVE-2014-3589",
+            "id": "pyup.io-25933",
             "specs": [
-                "<1.1.0"
+                "<2.5.2"
             ],
-            "v": "<1.1.0"
+            "v": "<2.5.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41209",
-            "id": "pyup.io-43289",
+            "advisory": "pillow before 2.5.3 is vulnerable to a DoS in the Jpeg2KImagePlugin.",
+            "cve": "CVE-2014-3598",
+            "id": "pyup.io-25934",
             "specs": [
-                "<1.1.0"
+                "<2.5.3"
             ],
-            "v": "<1.1.0"
+            "v": "<2.5.3"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41213",
-            "id": "pyup.io-43290",
+            "advisory": "pillow before 2.6.2 is vulnerable to a PNG decompression DoS (CVE-2014-9601).",
+            "cve": "CVE-2014-9601",
+            "id": "pyup.io-25936",
             "specs": [
-                "<1.1.0"
+                "<2.6.2"
             ],
-            "v": "<1.1.0"
+            "v": "<2.6.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41204",
-            "id": "pyup.io-43291",
+            "advisory": "pillow before 2.7.0 is vulnerable to a PNG decompression DoS (CVE-2014-9601).",
+            "cve": "CVE-2014-9601",
+            "id": "pyup.io-25937",
             "specs": [
-                "<1.1.0"
+                "<2.7.0"
             ],
-            "v": "<1.1.0"
+            "v": "<2.7.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41228",
-            "id": "pyup.io-43292",
+            "advisory": "Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.",
+            "cve": "CVE-2016-0740",
+            "id": "pyup.io-33134",
             "specs": [
-                "<1.1.0"
+                "<3.1.1"
             ],
-            "v": "<1.1.0"
+            "v": "<3.1.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41222",
-            "id": "pyup.io-43293",
+            "advisory": "Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.",
+            "cve": "CVE-2016-2533",
+            "id": "pyup.io-33136",
             "specs": [
-                "<1.1.0"
+                "<3.1.1"
             ],
-            "v": "<1.1.0"
+            "v": "<3.1.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41224",
-            "id": "pyup.io-43294",
+            "advisory": "Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.",
+            "cve": "CVE-2016-4009",
+            "id": "pyup.io-33137",
             "specs": [
-                "<1.1.0"
+                "<3.1.1"
             ],
-            "v": "<1.1.0"
+            "v": "<3.1.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41218",
-            "id": "pyup.io-43295",
+            "advisory": "Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.",
+            "cve": "CVE-2016-0775",
+            "id": "pyup.io-33135",
             "specs": [
-                "<1.1.0"
+                "<3.1.1"
             ],
-            "v": "<1.1.0"
+            "v": "<3.1.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41216",
-            "id": "pyup.io-43296",
+            "advisory": "pillow before 3.1.2 is vulnerable to an integer overflow in Jpeg2KEncode.c causing a buffer overflow. CVE-2016-3076.",
+            "cve": "CVE-2016-3076",
+            "id": "pyup.io-25943",
             "specs": [
-                "<1.1.0"
+                "<3.1.2"
             ],
-            "v": "<1.1.0"
+            "v": "<3.1.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41215",
-            "id": "pyup.io-43297",
+            "advisory": "Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.",
+            "cve": "CVE-2016-9190",
+            "id": "pyup.io-33138",
             "specs": [
-                "<1.1.0"
+                "<3.3.2"
             ],
-            "v": "<1.1.0"
+            "v": "<3.3.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41208",
-            "id": "pyup.io-43298",
+            "advisory": "Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the \"crafted image file\" approach, related to an \"Integer Overflow\" issue affecting the Image.core.map_buffer in map.c component.",
+            "cve": "CVE-2016-9189",
+            "id": "pyup.io-33139",
             "specs": [
-                "<1.1.0"
+                "<3.3.2"
             ],
-            "v": "<1.1.0"
+            "v": "<3.3.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41206",
-            "id": "pyup.io-43300",
+            "advisory": "libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. See: CVE-2020-5310.",
+            "cve": "CVE-2020-5310",
+            "id": "pyup.io-37779",
             "specs": [
-                "<1.1.0"
+                "<6.2.2"
             ],
-            "v": "<1.1.0"
+            "v": "<6.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41205",
-            "id": "pyup.io-43301",
+            "advisory": "libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.",
+            "cve": "CVE-2020-5312",
+            "id": "pyup.io-37781",
             "specs": [
-                "<1.1.0"
+                "<6.2.2"
             ],
-            "v": "<1.1.0"
+            "v": "<6.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41210",
-            "id": "pyup.io-43303",
+            "advisory": "libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. See: CVE-2020-5313.",
+            "cve": "CVE-2020-5313",
+            "id": "pyup.io-37782",
             "specs": [
-                "<1.1.0"
+                "<6.2.2"
             ],
-            "v": "<1.1.0"
+            "v": "<6.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41207",
-            "id": "pyup.io-43304",
+            "advisory": "libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.",
+            "cve": "CVE-2020-5311",
+            "id": "pyup.io-37780",
             "specs": [
-                "<1.1.0"
+                "<6.2.2"
             ],
-            "v": "<1.1.0"
+            "v": "<6.2.2"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41202",
-            "id": "pyup.io-43305",
+            "advisory": "In Pillow before 6.2.3 and 7.x before 7.0.1, there are two Buffer Overflows in libImaging/TiffDecode.c. See: CVE-2020-10379.",
+            "cve": "CVE-2020-10379",
+            "id": "pyup.io-38450",
             "specs": [
-                "<1.1.0"
+                "<6.2.3",
+                ">=7.0.0,<7.0.1"
             ],
-            "v": "<1.1.0"
+            "v": "<6.2.3,>=7.0.0,<7.0.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41212",
-            "id": "pyup.io-43302",
+            "advisory": "In libImaging/PcxDecode.c in Pillow before 6.2.3 and 7.x before 7.0.1, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. See: CVE-2020-10378.",
+            "cve": "CVE-2020-10378",
+            "id": "pyup.io-38449",
+            "specs": [
+                "<6.2.3",
+                ">=7.0.0,<7.0.1"
+            ],
+            "v": "<6.2.3,>=7.0.0,<7.0.1"
+        },
+        {
+            "advisory": "In libImaging/Jpeg2KDecode.c in Pillow before 7.0.0, there are multiple out-of-bounds reads via a crafted JP2 file. See: CVE-2020-10994.",
+            "cve": "CVE-2020-10994",
+            "id": "pyup.io-38451",
             "specs": [
-                "<1.1.0"
+                "<7.0.0"
             ],
-            "v": "<1.1.0"
+            "v": "<7.0.0"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41201",
-            "id": "pyup.io-43306",
+            "advisory": "Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
+            "cve": "CVE-2020-15999",
+            "id": "pyup.io-40264",
             "specs": [
-                "<1.1.0"
+                "<8.0.1"
             ],
-            "v": "<1.1.0"
+            "v": "<8.0.1"
         },
         {
-            "advisory": "Openvino-tensorflow 1.1.0 updates its dependency 'tensorflow' to v2.7.0 to include security fixes.",
-            "cve": "CVE-2021-41197",
-            "id": "pyup.io-43307",
+            "advisory": "Pillow 8.1.0 fixes TIFF OOB Write error. CVE-2020-35654 #5175.",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-40265",
             "specs": [
-                "<1.1.0"
+                "<8.1.0"
             ],
-            "v": "<1.1.0"
-        }
-    ],
-    "openxc": [
+            "v": "<8.1.0"
+        },
         {
-            "advisory": "Openxc 0.15.0 updates multiple dependencies due to vulnerabilities.",
-            "cve": "PVE-2021-41102",
-            "id": "pyup.io-41102",
+            "advisory": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations. See: CVE-2020-35653.",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-40270",
             "specs": [
-                "<0.15.0"
+                "<8.1.0"
             ],
-            "v": "<0.15.0"
-        }
-    ],
-    "optimade": [
+            "v": "<8.1.0"
+        },
         {
-            "advisory": "Optimade 0.7.0 includes a fix that addresses a Django vulnerability. See: <https://github.com/Materials-Consortia/optimade-python-tools/issues/108>.",
-            "cve": "PVE-2021-38453",
-            "id": "pyup.io-38453",
+            "advisory": "Pillow 8.1.0 includes a fix for SGI Decode buffer overrun. CVE-2020-35655 #5173.",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-40271",
             "specs": [
-                "<0.7.0"
+                "<8.1.0"
             ],
-            "v": "<0.7.0"
-        }
-    ],
-    "orange3-bioinformatics": [
+            "v": "<8.1.0"
+        },
         {
-            "advisory": "Orange3-bioinformatics 4.2.0 adds the Orange.widgets.credentials.CredentialManager to securely store user password.",
-            "cve": "PVE-2021-38958",
-            "id": "pyup.io-38958",
+            "advisory": "Pillow 8.1.1 includes a fix for CVE-2021-27921: Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-40263",
             "specs": [
-                "<4.2.0"
+                "<8.1.1"
             ],
-            "v": "<4.2.0"
-        }
-    ],
-    "ores": [
+            "v": "<8.1.1"
+        },
         {
-            "advisory": "Ores 1.3.1 updates its dependency 'pyyaml' to v4.2b4 to include a security fix.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-37949",
+            "advisory": "Pillow 8.1.1 includes a fix for CVE-2021-25290: In TiffDecode.c, there is a negative-offset memcpy with an invalid size.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
+            "cve": "CVE-2021-25290",
+            "id": "pyup.io-40275",
             "specs": [
-                "<1.3.1"
+                "<8.1.1"
             ],
-            "v": "<1.3.1"
+            "v": "<8.1.1"
         },
         {
-            "advisory": "Ores 1.3.1 changes pickle for JSON as celery serializer to avoid security issues.\r\nhttps://github.com/wikimedia/ores/commit/817915caf495c031a232071c27e25cb7c7e7696d",
-            "cve": "PVE-2021-43649",
-            "id": "pyup.io-43649",
+            "advisory": "Pillow 8.1.1 includes a fix for CVE-2021-27922: Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-40267",
             "specs": [
-                "<1.3.1"
+                "<8.1.1"
             ],
-            "v": "<1.3.1"
-        }
-    ],
-    "ormar": [
+            "v": "<8.1.1"
+        },
         {
-            "advisory": "Ormar 0.10.9 updates the 'pydantic' library to fix a security vulnerability (CVE-2021-29510).",
-            "cve": "CVE-2021-29510",
-            "id": "pyup.io-40577",
+            "advisory": "Pillow 8.1.1 includes a fix for CVE-2021-25289: TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
+            "cve": "CVE-2021-25289",
+            "id": "pyup.io-40274",
             "specs": [
-                "<0.10.9"
+                "<8.1.1"
             ],
-            "v": "<0.10.9"
-        }
-    ],
-    "ortec.scientific.benchmarks.loadbuilding": [
+            "v": "<8.1.1"
+        },
         {
-            "advisory": "Ortec.scientific.benchmarks.loadbuilding version 1.0.1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/ORTECScientificBenchmarks/ortec-scientific-benchmarks-loadbuilding/commit/81b5f1ad38bc25ddf8ce1e988cb540a8d7f43482",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41355",
+            "advisory": "Pillow 8.1.1 includes a fix for CVE-2021-25293: There is an out-of-bounds read in SGIRleDecode.c.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
+            "cve": "CVE-2021-25293",
+            "id": "pyup.io-40273",
             "specs": [
-                "<1.0.1"
+                "<8.1.1"
             ],
-            "v": "<1.0.1"
+            "v": "<8.1.1"
         },
         {
-            "advisory": "Ortec.scientific.benchmarks.loadbuilding version 0.10.0 is vulnerable to CVE-2020-14343 due to using  \"yaml.full_load()\" and a potentially vulnerable version of its dependency \"pyyaml\". See CVE-2020-14343.\r\nhttps://github.com/ORTECScientificBenchmarks/ortec-scientific-benchmarks-loadbuilding/commit/81b5f1ad38bc25ddf8ce1e988cb540a8d7f43482",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-41757",
+            "advisory": "Pillow 8.1.1 includes a fix for CVE-2021-25292: The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
+            "cve": "CVE-2021-25292",
+            "id": "pyup.io-40266",
             "specs": [
-                "==1.0.1"
+                "<8.1.1"
             ],
-            "v": "==1.0.1"
-        }
-    ],
-    "osc": [
+            "v": "<8.1.1"
+        },
         {
-            "advisory": "Osc 0.123 is the first release that performs SSL certificate checks to prevent man-in-the-middle-attacks. Python-m2crypto is needed to make this work. Certificate checks can be turned off per server via 'sslcertck = 0' in .oscrc.",
-            "cve": "PVE-2021-37874",
-            "id": "pyup.io-37874",
+            "advisory": "Pillow 8.1.1 includes a fix for CVE-2021-25291: In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
+            "cve": "CVE-2021-25291",
+            "id": "pyup.io-40272",
             "specs": [
-                "<0.123"
+                "<8.1.1"
             ],
-            "v": "<0.123"
+            "v": "<8.1.1"
         },
         {
-            "advisory": "Osc 0.134 includes a security fix for the buildlog function. Terminal control characters are limited now.",
-            "cve": "PVE-2021-37873",
-            "id": "pyup.io-37873",
+            "advisory": "Pillow version 8.2.0 includes a fix for CVE-2021-28676: For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.\r\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/\r\nhttps://github.com/python-pillow/Pillow/pull/5377\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos",
+            "cve": "CVE-2021-28676",
+            "id": "pyup.io-40594",
             "specs": [
-                "<0.134"
+                "<8.2.0"
             ],
-            "v": "<0.134"
+            "v": "<8.2.0"
         },
         {
-            "advisory": "Osc 0.151 fixes shell command injection via crafted _service files. See: CVE-2015-0778.",
-            "cve": "CVE-2015-0778",
-            "id": "pyup.io-38486",
+            "advisory": "Pillow 8.2.0 includes a fix for CVE-2021-25287: There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
+            "cve": "CVE-2021-25287",
+            "id": "pyup.io-40592",
             "specs": [
-                "<0.151"
+                "<8.2.0"
             ],
-            "v": "<0.151"
+            "v": "<8.2.0"
         },
         {
-            "advisory": "Osc 0.165.3 fixes broken TLS certificate handling. See: CVE-2019-3685.",
-            "cve": "CVE-2019-3685",
-            "id": "pyup.io-38485",
+            "advisory": "Pillow version 8.2.0 includes a fix for CVE-2021-28678: For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.\r\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/\r\nhttps://github.com/python-pillow/Pillow/pull/5377\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos",
+            "cve": "CVE-2021-28678",
+            "id": "pyup.io-40596",
             "specs": [
-                "<0.165.3"
+                "<8.2.0"
             ],
-            "v": "<0.165.3"
-        }
-    ],
-    "osxcollector-output-filters": [
+            "v": "<8.2.0"
+        },
         {
-            "advisory": "Osxcollector-output-filters version 1.1.1 includes a security patch for the function '_read_config' in 'osxcollector/output_filters/util/config.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/Yelp/osxcollector_output_filters/commit/f9cbe50d8f5a529d59e7cdcddc762cd0f98f5262#diff-40439d01692123eb75a4a7d5114e375d7f08d806adff4806f1f9eab3dd80b0d1",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41356",
+            "advisory": "Pillow version 8.2.0 includes a fix for CVE-2021-28677: For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.\r\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/\r\nhttps://github.com/python-pillow/Pillow/pull/5377\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open",
+            "cve": "CVE-2021-28677",
+            "id": "pyup.io-40595",
             "specs": [
-                "<1.1.1"
+                "<8.2.0"
             ],
-            "v": "<1.1.1"
-        }
-    ],
-    "otpauth": [
+            "v": "<8.2.0"
+        },
         {
-            "advisory": "otpauth before 1.0.1 is vulnerable to timing attacks.",
-            "cve": "PVE-2021-25915",
-            "id": "pyup.io-25915",
+            "advisory": "Pillow 8.2.0 includes a fix for CVE-2021-25288: There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-25287-cve-2021-25288-fix-oob-read-in-jpeg2kdecode",
+            "cve": "CVE-2021-25288",
+            "id": "pyup.io-40593",
             "specs": [
-                "<1.0.1"
+                "<8.2.0"
             ],
-            "v": "<1.0.1"
-        }
-    ],
-    "ovirt-engine-sdk-python": [
+            "v": "<8.2.0"
+        },
         {
-            "advisory": "The python SDK before 3.1.0.6 and CLI before 3.1.0.8 for oVirt 3.1 does not check the server SSL certificate against the client keys, which allows remote attackers to spoof a server via a man-in-the-middle (MITM) attack.",
-            "cve": "CVE-2012-3533",
-            "id": "pyup.io-25916",
+            "advisory": "Pillow version 8.3.0 includes a fix for CVE-2021-34552: Pillow through 8.2.0 and PIL (also known as Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/index.html",
+            "cve": "CVE-2021-34552",
+            "id": "pyup.io-40965",
             "specs": [
-                "<3.1.0.8"
+                "<8.3.0"
             ],
-            "v": "<3.1.0.8"
+            "v": "<8.3.0"
         },
         {
-            "advisory": "ovirt-engine-sdk-python before 3.4.0.7 and 3.5.0.4 does not verify that the hostname of the remote endpoint matches the Common Name (CN) or subjectAltName as specified by its x.509 certificate in a TLS/SSL session. This could allow man-in-the-middle attackers to spoof remote endpoints via an arbitrary valid certificate.",
-            "cve": "CVE-2014-0161",
-            "id": "pyup.io-37754",
+            "advisory": "Pillow 9.0.0 includes a fix for CVE-2022-22817: PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#restrict-builtins-available-to-imagemath-eval",
+            "cve": "CVE-2022-22817",
+            "id": "pyup.io-44487",
             "specs": [
-                "<3.4.0.7",
-                "==3.5.0.4"
+                "<9.0.0"
             ],
-            "v": "<3.4.0.7,==3.5.0.4"
-        }
-    ],
-    "ovs": [
+            "v": "<9.0.0"
+        },
         {
-            "advisory": "ovs 1.3.0 includes a fix that flow setups are now processed in a round-robin manner across ports to prevent any single client from monopolizing the CPU and conducting a denial of service attack.",
-            "cve": "PVE-2021-25917",
-            "id": "pyup.io-25917",
+            "advisory": "Pillow 9.0.0 includes a fix for CVE-2022-22815: path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling",
+            "cve": "CVE-2022-22815",
+            "id": "pyup.io-44485",
             "specs": [
-                "<1.3.0"
+                "<9.0.0"
             ],
-            "v": "<1.3.0"
-        }
-    ],
-    "owlmixin": [
+            "v": "<9.0.0"
+        },
         {
-            "advisory": "An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before 2.0.0a12. A \"Load YAML\" string or file (aka load_yaml or load_yamlf) can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used. An attacker can insert Python into loaded YAML to trigger this vulnerability.",
-            "cve": "CVE-2017-16618",
-            "id": "pyup.io-35720",
+            "advisory": "Pillow 9.0.0 ensures JpegImagePlugin stops at the end of a truncated file to avoid Denial of Service attacks.\r\nhttps://github.com/python-pillow/Pillow/pull/5921",
+            "cve": "PVE-2022-44524",
+            "id": "pyup.io-44524",
             "specs": [
-                "<2.0.0a12"
+                "<9.0.0"
             ],
-            "v": "<2.0.0a12"
-        }
-    ],
-    "owslib": [
+            "v": "<9.0.0"
+        },
         {
-            "advisory": "An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assigning a path to the entity. OWSLib 0.24.1 may also be affected. See CVE-2021-39371.\r\nhttps://github.com/geopython/OWSLib/issues/790\r\nhttps://github.com/geopython/pywps/pull/616",
-            "cve": "CVE-2021-39371",
-            "id": "pyup.io-41213",
+            "advisory": "Pillow 9.0.0 excludes carriage return in PDF regex to help prevent ReDoS.\r\nhttps://github.com/python-pillow/Pillow/pull/5912\r\nhttps://github.com/python-pillow/Pillow/commit/43b800d933c996226e4d7df00c33fcbe46d97363",
+            "cve": "PVE-2021-44525",
+            "id": "pyup.io-44525",
             "specs": [
-                "==0.24.1"
+                "<9.0.0"
             ],
-            "v": "==0.24.1"
-        }
-    ],
-    "paco-models": [
+            "v": "<9.0.0"
+        },
         {
-            "advisory": "Paco.models 7.8.5 improved the defaults for Load Balancer and CloudFront SSL security policy.\r\nhttps://github.com/waterbear-cloud/paco.models/commit/becf91dd20bb9e7541bda6c91378a20ecf7bb4a8",
-            "cve": "PVE-2021-42798",
-            "id": "pyup.io-42798",
+            "advisory": "Pillow 9.0.0 includes a fix for CVE-2022-22816: path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/9.0.0.html#fixed-imagepath-path-array-handling",
+            "cve": "CVE-2022-22816",
+            "id": "pyup.io-44486",
             "specs": [
-                "<7.8.5"
+                "<9.0.0"
             ],
-            "v": "<7.8.5"
-        }
-    ],
-    "pact-python": [
+            "v": "<9.0.0"
+        },
         {
-            "advisory": "Pact-python 1.3.6 includes several vulnerability fixes for Dockerfile(s).",
-            "cve": "PVE-2021-40235",
-            "id": "pyup.io-40235",
+            "advisory": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files. See: CVE-2020-11538. Note that this is a different issue than CVE-2020-5311.",
+            "cve": "CVE-2020-11538",
+            "id": "pyup.io-38452",
             "specs": [
-                "<1.3.6"
+                "<=7.0.0"
             ],
-            "v": "<1.3.6"
+            "v": "<=7.0.0"
         },
         {
-            "advisory": "Pact-python 1.3.7 includes important fixes for Dockerfiles (py37.Dockerfile, py38.Dockerfile, py36.Dockerfile) to reduce vulnerabilities.",
-            "cve": "PVE-2021-40324",
-            "id": "pyup.io-40324",
+            "advisory": "There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. See: CVE-2019-19911.",
+            "cve": "CVE-2019-19911",
+            "id": "pyup.io-37772",
             "specs": [
-                "<1.3.7"
+                ">6.0,<6.2.2"
             ],
-            "v": "<1.3.7"
-        }
-    ],
-    "pacyam": [
+            "v": ">6.0,<6.2.2"
+        },
         {
-            "advisory": "Pacyam version 1.1.1 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/dstarner/pacyam/commit/0640b259c0e5909c1010b6780e10b88f8fdd1c17#diff-8b9ae2192ea7474817342a2e0d103b63f28618bd1e495bc8227f711757ea91eb",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41358",
+            "advisory": "Pillow 8.1.1 includes a fix for CVE-2021-27923: Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.1.1.html",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-40268",
             "specs": [
-                "<1.1.1"
+                ">=4.3.0,<8.1.1"
             ],
-            "v": "<1.1.1"
-        }
-    ],
-    "pakettikauppa": [
+            "v": ">=4.3.0,<8.1.1"
+        },
         {
-            "advisory": "pakettikauppa 0.1.2 fixes Pip files and requirement files for fixing security issue in pyyaml module",
-            "cve": "PVE-2021-36779",
-            "id": "pyup.io-36779",
+            "advisory": "The package pillow from 5.2.0 and before 8.3.2 is vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.\r\nhttps://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-41271",
             "specs": [
-                "<0.1.2"
+                ">=5.2.0,<8.3.2"
             ],
-            "v": "<0.1.2"
+            "v": ">=5.2.0,<8.3.2"
         }
     ],
-    "palladium": [
+    "pillow-simd": [
         {
-            "advisory": "Palladium 1.2.2 updates requirements, fixing potential security vulnerabilities in dependencies.",
-            "cve": "PVE-2021-37378",
-            "id": "pyup.io-37378",
+            "advisory": "pillow-simd before 2.3.2 is vulnerable to CVE-2014-3589, a DOS in the IcnsImagePlugin.",
+            "cve": "CVE-2014-3589",
+            "id": "pyup.io-39579",
             "specs": [
-                "<1.2.2"
+                "<2.3.2"
             ],
-            "v": "<1.2.2"
+            "v": "<2.3.2"
         },
         {
-            "advisory": "Palladium 1.2.3 updates its requirements in order to use newer versions of dependencies. This fixes some potential security vulnerabilities.",
-            "cve": "PVE-2021-38263",
-            "id": "pyup.io-38263",
+            "advisory": "Pillow-simd 2.5.0 includes changes to prevent shell injection. This is related to CVE-2014-1932.\r\nhttps://github.com/uploadcare/pillow-simd/commit/cd7b45994b1b1a016a29401d7ab3faf9b7c7d054",
+            "cve": "PVE-2021-43447",
+            "id": "pyup.io-43447",
             "specs": [
-                "<1.2.3"
+                "<2.5.0"
             ],
-            "v": "<1.2.3"
-        }
-    ],
-    "pandas-zmq": [
+            "v": "<2.5.0"
+        },
         {
-            "advisory": "Pandas-zmq 0.0.2 adds a signature to improve security.",
-            "cve": "PVE-2021-38627",
-            "id": "pyup.io-38627",
+            "advisory": "pillow-simd before 2.5.2 is vulnerable to CVE-2014-3589, a DOS in the IcnsImagePlugin.",
+            "cve": "CVE-2014-3589",
+            "id": "pyup.io-39578",
             "specs": [
-                "<0.0.2"
+                "<2.5.2"
             ],
-            "v": "<0.0.2"
-        }
-    ],
-    "pandevice": [
+            "v": "<2.5.2"
+        },
         {
-            "advisory": "Pandevice 0.11.0 adds `uuid` params for security and NAT rules.",
-            "cve": "PVE-2021-37198",
-            "id": "pyup.io-37198",
+            "advisory": "Pillow-simd before 2.5.3 is vulnerable to CVE-2014-3598.",
+            "cve": "CVE-2014-3598",
+            "id": "pyup.io-25949",
             "specs": [
-                "<0.11.0"
+                "<2.5.3"
             ],
-            "v": "<0.11.0"
-        }
-    ],
-    "pando": [
+            "v": "<2.5.3"
+        },
         {
-            "advisory": "pando before 0.39 is vulnerable to security bugs related to CRLF injection.",
-            "cve": "PVE-2021-25918",
-            "id": "pyup.io-25918",
+            "advisory": "pillow-simd before 2.6.0rc1 is vulnerable to CVE-2014-3589, a DOS in the IcnsImagePlugin.",
+            "cve": "CVE-2014-3589",
+            "id": "pyup.io-39576",
             "specs": [
-                "<0.39"
+                "<2.6.0rc1"
             ],
-            "v": "<0.39"
+            "v": "<2.6.0rc1"
         },
         {
-            "advisory": "pando before 0.42 is vulnerable to URL redirection attacks.",
-            "cve": "PVE-2021-25919",
-            "id": "pyup.io-25919",
+            "advisory": "pillow-simd before 2.6.2 is vulnerable to a PNG decompression DoS (CVE-2014-9601).",
+            "cve": "CVE-2014-9601",
+            "id": "pyup.io-25951",
             "specs": [
-                "<0.42"
+                "<2.6.2"
             ],
-            "v": "<0.42"
-        }
-    ],
-    "pangres": [
+            "v": "<2.6.2"
+        },
         {
-            "advisory": "Pangres 2.1 was released with the claim that it became completely SQL injection safe. Everything is escaped or parameterized including schema, table and column names.",
-            "cve": "PVE-2021-39284",
-            "id": "pyup.io-39284",
+            "advisory": "pillow-simd before 2.7.0 is vulnerable to a PNG decompression DoS (CVE-2014-9601).",
+            "cve": "CVE-2014-9601",
+            "id": "pyup.io-25952",
             "specs": [
-                "<2.1"
+                "<2.7.0"
             ],
-            "v": "<2.1"
-        }
-    ],
-    "panoptes-utils": [
+            "v": "<2.7.0"
+        },
         {
-            "advisory": "Panoptes-utils 0.2.21 updates its dependency 'PyYaml' to v5.3.1 to include security fixes.",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-38493",
+            "advisory": "Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.",
+            "cve": "CVE-2016-0775",
+            "id": "pyup.io-42330",
             "specs": [
-                "<0.2.21"
+                "<3.1.1"
             ],
-            "v": "<0.2.21"
-        }
-    ],
-    "paradrop": [
+            "v": "<3.1.1"
+        },
         {
-            "advisory": "Paradrop 0.10.0 supports more WiFi encryption settings, including properly supporting CCMP for better security.",
-            "cve": "PVE-2021-37491",
-            "id": "pyup.io-37491",
+            "advisory": "Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.",
+            "cve": "CVE-2016-2533",
+            "id": "pyup.io-42329",
             "specs": [
-                "<0.10.0"
+                "<3.1.1"
             ],
-            "v": "<0.10.0"
+            "v": "<3.1.1"
         },
         {
-            "advisory": "Paradrop 0.13.0 updates its dependency urllib3 to v1.24.1 to include a security fix.",
-            "cve": "CVE-2018-20060",
-            "id": "pyup.io-42700",
+            "advisory": "Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.",
+            "cve": "CVE-2016-0740",
+            "id": "pyup.io-42331",
             "specs": [
-                "<0.13.0"
+                "<3.1.1"
             ],
-            "v": "<0.13.0"
+            "v": "<3.1.1"
         },
         {
-            "advisory": "Paradrop 0.13.0 updates its dependency requests to v2.20.1 to include a security fix.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-42701",
+            "advisory": "pillow-simd before 3.1.1 is vulnerable to multiple buffer overlows in Resample.c, PcdDecode.c, FliDecode.c and TiffDecode.c.",
+            "cve": "PVE-2021-25953",
+            "id": "pyup.io-25953",
             "specs": [
-                "<0.13.0"
+                "<3.1.1"
             ],
-            "v": "<0.13.0"
+            "v": "<3.1.1"
         },
         {
-            "advisory": "Paradrop 0.13.0 updates its dependency pyOpenSSL to v17.5.0 to include a security fix.",
-            "cve": "CVE-2018-1000808",
-            "id": "pyup.io-37490",
+            "advisory": "pillow-simd before 3.1.2 is vulnerable to an integer overflow in Jpeg2KEncode.c causing a buffer overflow. CVE-2016-3076.",
+            "cve": "CVE-2016-3076",
+            "id": "pyup.io-25954",
             "specs": [
-                "<0.13.0"
+                "<3.1.2"
             ],
-            "v": "<0.13.0"
-        },
+            "v": "<3.1.2"
+        }
+    ],
+    "pim-dm": [
         {
-            "advisory": "Paradrop 0.5 secures the router settings page with a login system.",
-            "cve": "PVE-2021-37492",
-            "id": "pyup.io-37492",
+            "advisory": "pim-dm 1.0 includes dissertation work and an unspecified security implementation",
+            "cve": "PVE-2021-37857",
+            "id": "pyup.io-37857",
             "specs": [
-                "<0.5"
+                "<1.0"
             ],
-            "v": "<0.5"
+            "v": "<1.0"
         }
     ],
-    "paramiko": [
+    "pims": [
         {
-            "advisory": "transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.",
-            "cve": "CVE-2018-7750",
-            "id": "pyup.io-41269",
+            "advisory": "Pims 0.5 and prior uses 'loci_tools.jar', which is affected by critical and severe vulnerabilities.\r\nhttps://github.com/soft-matter/pims/issues/400",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-43596",
             "specs": [
-                "<1.17.6",
-                ">=1.8.0,<1.18.5",
-                ">=2.0.0,<2.0.8",
-                ">=2.1.0,<2.1.5",
-                ">=2.2.0,<2.2.3",
-                ">=2.3.0,<2.3.2",
-                "==2.4.0"
+                "<=0.5"
             ],
-            "v": "<1.17.6,>=1.8.0,<1.18.5,>=2.0.0,<2.0.8,>=2.1.0,<2.1.5,>=2.2.0,<2.2.3,>=2.3.0,<2.3.2,==2.4.0"
+            "v": "<=0.5"
         },
         {
-            "advisory": "Paramiko 1.7.2 fixes the PRNG to be more secure on Windows and in cases where fork() is called.",
-            "cve": "PVE-2021-27486",
-            "id": "pyup.io-27486",
+            "advisory": "Pims 0.5 and prior uses 'loci_tools.jar', which is affected by critical and severe vulnerabilities.\r\nhttps://github.com/soft-matter/pims/issues/400",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44456",
             "specs": [
-                "<1.7.2"
+                "<=0.5"
             ],
-            "v": "<1.7.2"
+            "v": "<=0.5"
         },
         {
-            "advisory": "Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE. This attack appear to be exploitable via network connectivity.",
-            "cve": "CVE-2018-1000805",
-            "id": "pyup.io-41268",
+            "advisory": "Pims 0.5 and prior uses 'loci_tools.jar', which is affected by critical and severe vulnerabilities.\r\nhttps://github.com/soft-matter/pims/issues/400",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43595",
             "specs": [
-                "==1.17.6",
-                "==1.18.5",
-                "==2.0.8",
-                "==2.1.5",
-                "==2.2.3",
-                "==2.3.2",
-                "==2.4.1"
+                "<=0.5"
             ],
-            "v": "==1.17.6,==1.18.5,==2.0.8,==2.1.5,==2.2.3,==2.3.2,==2.4.1"
-        }
-    ],
-    "passlib": [
+            "v": "<=0.5"
+        },
         {
-            "advisory": "passlib before 1.4 not disabled unix_fallback's \"wildcard password\" support unless explicitly enabled by user.",
-            "cve": "PVE-2021-25921",
-            "id": "pyup.io-25921",
+            "advisory": "Pims 0.5 and prior uses 'loci_tools.jar', which is affected by critical and severe vulnerabilities.\r\nhttps://github.com/soft-matter/pims/issues/400",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43594",
             "specs": [
-                "<1.4"
+                "<=0.5"
             ],
-            "v": "<1.4"
+            "v": "<=0.5"
         }
     ],
-    "password-safe-box": [
-        {
-            "advisory": "Password-safe-box 0.2 adds Fast Convert (which provides slightly better security than a normal hash).",
-            "cve": "PVE-2021-38703",
-            "id": "pyup.io-38703",
+    "pinax-likes": [
+        {
+            "advisory": "pinax-likes before 0.3 allows users to like anything and everything, which could potentially lead to security problems (eg. liking entries in permission tables, and thus seeing their content; liking administrative users and thus getting their username).",
+            "cve": "PVE-2021-25955",
+            "id": "pyup.io-25955",
             "specs": [
-                "<0.2"
+                "<0.3"
             ],
-            "v": "<0.2"
+            "v": "<0.3"
         }
     ],
-    "paste": [
+    "pip": [
         {
-            "advisory": "paste before 0.9.5 has a security vulnerability in ``paste.urlparser``'s StaticURLParser and PkgResourcesParser where, with some servers, you could escape the document root.",
-            "cve": "PVE-2021-25922",
-            "id": "pyup.io-25922",
+            "advisory": "pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a \"pip install\" operation.",
+            "cve": "CVE-2013-1629",
+            "id": "pyup.io-33140",
             "specs": [
-                "<0.9.5"
+                "<1.3"
             ],
-            "v": "<0.9.5"
+            "v": "<1.3"
         },
         {
-            "advisory": "paste 1.1 includes a security fix for ``paste.urlparser.StaticURLParser``.  The problem allowed escaping the root (and reading files) when used with ``paste.httpserver`` (this does not effect other servers, and does not apply when proxying requests from Apache to  ``paste.httpserver``).",
-            "cve": "PVE-2021-25923",
-            "id": "pyup.io-25923",
+            "advisory": "pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.",
+            "cve": "CVE-2013-1888",
+            "id": "pyup.io-33141",
             "specs": [
-                "<1.1"
+                "<1.3"
             ],
-            "v": "<1.1"
+            "v": "<1.3"
         },
         {
-            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in the paste.httpexceptions implementation in Paste before 1.7.4 allow remote attackers to inject arbitrary web script or HTML via vectors involving a 404 status code, related to (1) paste.urlparser.StaticURLParser, (2) paste.urlparser.PkgResourcesParser, (3) paste.urlmap.URLMap, and (4) HTTPNotFound.",
-            "cve": "CVE-2010-2477",
-            "id": "pyup.io-35340",
+            "advisory": "pip 1.4 includes a security patch to pip's ssl support related to certificate DNS wildcard matching.",
+            "cve": "PVE-2021-25959",
+            "id": "pyup.io-25959",
             "specs": [
-                "<1.7.4"
+                "<1.4"
             ],
-            "v": "<1.7.4"
-        }
-    ],
-    "pastescript": [
+            "v": "<1.4"
+        },
         {
-            "advisory": "Paste Script 1.7.5 and earlier does not properly set group memberships during execution with root privileges, which might allow remote attackers to bypass intended file-access restrictions by leveraging a web application that uses the local filesystem.",
-            "cve": "CVE-2012-0878",
-            "id": "pyup.io-25925",
+            "advisory": "The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. See CVE-2013-5123.",
+            "cve": "CVE-2013-5123",
+            "id": "pyup.io-37752",
             "specs": [
-                "<1.7.5"
+                "<1.5"
             ],
-            "v": "<1.7.5"
-        }
-    ],
-    "pathfinder": [
+            "v": "<1.5"
+        },
         {
-            "advisory": "Pathfinder 0.5.4 includes a fix that addresses a security alert regarding the version of jinja2.",
-            "cve": "PVE-2021-38220",
-            "id": "pyup.io-38220",
+            "advisory": "The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.",
+            "cve": "CVE-2019-20916",
+            "id": "pyup.io-38765",
             "specs": [
-                "<0.5.4"
+                "<19.2"
             ],
-            "v": "<0.5.4"
-        }
-    ],
-    "patroni": [
+            "v": "<19.2"
+        },
         {
-            "advisory": "Patroni 2.0.2 uses 'hmac.compare_digest()' instead of '==' for performing the REST API authentication. The previous was vulnerable to timing attacks.",
-            "cve": "PVE-2021-42998",
-            "id": "pyup.io-42998",
+            "advisory": "Pip version 21.1 stops splitting on unicode separators in git references, which could be maliciously used to install a different revision on the repository. \r\nhttps://github.com/pypa/pip/issues/9827",
+            "cve": "PVE-2021-42218",
+            "id": "pyup.io-42218",
             "specs": [
-                "<2.0.2"
+                "<21.1"
             ],
-            "v": "<2.0.2"
-        }
-    ],
-    "payton": [
+            "v": "<21.1"
+        },
         {
-            "advisory": "payton 0.1.4 upgrades Pillow from 7.x, since it had a security issue. This version is just for upgrading Pillow up to a secure version.",
-            "cve": "PVE-2021-40214",
-            "id": "pyup.io-40214",
+            "advisory": "Pip 21.1 updates its dependency 'urllib3' to v1.26.4 due to security issues.",
+            "cve": "CVE-2021-28363",
+            "id": "pyup.io-40291",
             "specs": [
-                "<0.1.4"
+                "<21.1"
             ],
-            "v": "<0.1.4"
-        }
-    ],
-    "pconf": [
+            "v": "<21.1"
+        },
         {
-            "advisory": "pconf before 1.3.3 is vulnerable to arbitrary code execution related to [CVE-2017-18342](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18342) because of YAML's `load`. \r\nThis upgrades to use YAML `safe_load` instead of `load`.",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-36293",
+            "advisory": "Pip version 21.1 includes a fix for CVE-2021-3572: A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1962856",
+            "cve": "CVE-2021-3572",
+            "id": "pyup.io-42559",
             "specs": [
-                "<1.3.3"
+                "<21.1"
             ],
-            "v": "<1.3.3"
-        }
-    ],
-    "pcp": [
+            "v": "<21.1"
+        },
         {
-            "advisory": "pcp before 2.1.911 has a not further described vulnerability in pcp.spec.in.",
-            "cve": "PVE-2021-25926",
-            "id": "pyup.io-25926",
+            "advisory": "pip before 6.0 is not using a randomized and secure default build directory when possible. (CVE-2014-8991).",
+            "cve": "CVE-2014-8991",
+            "id": "pyup.io-25960",
             "specs": [
-                "<2.1.911"
+                "<6.0"
             ],
-            "v": "<2.1.911"
+            "v": "<6.0"
         },
         {
-            "advisory": "Pcp 4.3.4 completes the secure TLS connection support for pmproxy.\r\nhttps://github.com/performancecopilot/pcp/commit/7bc3b68d8b93be7b86edaea149237c1ea6f3d9c6",
-            "cve": "PVE-2021-42788",
-            "id": "pyup.io-42788",
+            "advisory": "The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.",
+            "cve": "CVE-2015-2296",
+            "id": "pyup.io-42324",
             "specs": [
-                "<4.3.4"
+                "<6.1.0"
             ],
-            "v": "<4.3.4"
+            "v": "<6.1.0"
         },
         {
-            "advisory": "Pcp 5.2.2 makes pmcd init NSS as read-only when using secure connections.\r\nhttps://github.com/performancecopilot/pcp/commit/c85528b1865336ad108a211a87f24132cf45d554",
-            "cve": "PVE-2021-42786",
-            "id": "pyup.io-42786",
+            "advisory": "pip before 6.1.0 bundles a request release with a known security vulnerability. See  CVE-2015-2296.",
+            "cve": "CVE-2014-8991",
+            "id": "pyup.io-25961",
             "specs": [
-                "<5.2.2"
+                "<6.1.0"
             ],
-            "v": "<5.2.2"
+            "v": "<6.1.0"
         }
     ],
-    "pdfextract": [
+    "pipenv": [
         {
-            "advisory": "Pdfextract before 0.0.2 is using \"eval\" on filenames, leading to execution of arbitrary Python code.",
-            "cve": "PVE-2021-25927",
-            "id": "pyup.io-25927",
+            "advisory": "Pipenv 2020.5.28 includes the --key command to include a personal PyUp API token when running `pipenv check`. This version also updates several dependencies to their latest versions for security and bug fixes.",
+            "cve": "PVE-2021-38334",
+            "id": "pyup.io-38334",
             "specs": [
-                "<0.0.2"
+                "<2020.5.28"
             ],
-            "v": "<0.0.2"
+            "v": "<2020.5.28"
+        },
+        {
+            "advisory": "Pipenv 2022.1.8 includes a fix for CVE-2022-21668: Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere within a requirements.txt file, which will cause victims who use pipenv to install the requirements file to download dependencies from a package index server controlled by the attacker. By embedding malicious code in packages served from their malicious index server, the attacker can trigger arbitrary remote code execution (RCE) on the victims' systems. If an attacker is able to hide a malicious '--index-url' option in a requirements file that a victim installs with pipenv, the attacker can embed arbitrary malicious code in packages served from their malicious index server that will be executed on the victim's host during installation (remote code execution/RCE). When pip installs from a source distribution, any code in the setup.py is executed by the install process.\r\nhttps://github.com/pypa/pipenv/security/advisories/GHSA-qc9x-gjcv-465w",
+            "cve": "CVE-2022-21668",
+            "id": "pyup.io-44492",
+            "specs": [
+                ">=2018.10.9,<=2021.11.23"
+            ],
+            "v": ">=2018.10.9,<=2021.11.23"
         }
     ],
-    "pdfreader": [
+    "pipenv-setup": [
         {
-            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
-            "cve": "CVE-2020-10379",
-            "id": "pyup.io-39314",
+            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'sqlalchemy' to v1.3.0 to include a security fix.",
+            "cve": "CVE-2019-7164",
+            "id": "pyup.io-42742",
             "specs": [
-                "<0.1.6"
+                "<3.1.4"
             ],
-            "v": "<0.1.6"
+            "v": "<3.1.4"
         },
         {
-            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
-            "cve": "CVE-2020-11538",
-            "id": "pyup.io-43475",
+            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'sqlalchemy' to v1.3.0 to include a security fix.",
+            "cve": "CVE-2019-7548",
+            "id": "pyup.io-42760",
             "specs": [
-                "<0.1.6"
+                "<3.1.4"
             ],
-            "v": "<0.1.6"
+            "v": "<3.1.4"
         },
         {
-            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
-            "cve": "CVE-2020-10994",
-            "id": "pyup.io-43476",
+            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'lxml' to v4.6.3 to include a security fix.",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-42761",
             "specs": [
-                "<0.1.6"
+                "<3.1.4"
             ],
-            "v": "<0.1.6"
+            "v": "<3.1.4"
         },
         {
-            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
-            "cve": "CVE-2020-10378",
-            "id": "pyup.io-43477",
+            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'sqlalchemy' to v1.3.0 to include a security fix.",
+            "cve": "CVE-2020-27783",
+            "id": "pyup.io-42762",
             "specs": [
-                "<0.1.6"
+                "<3.1.4"
             ],
-            "v": "<0.1.6"
+            "v": "<3.1.4"
         },
         {
-            "advisory": "Pdfreader 0.1.6 updates its dependency 'pillow' to a version >= 7.1.0 to include security fixes.",
-            "cve": "CVE-2020-10377",
-            "id": "pyup.io-43478",
+            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'sqlalchemy' to v1.3.0 to include a security fix.",
+            "cve": "CVE-2018-19787",
+            "id": "pyup.io-42763",
             "specs": [
-                "<0.1.6"
+                "<3.1.4"
             ],
-            "v": "<0.1.6"
+            "v": "<3.1.4"
         }
     ],
-    "pdkit": [
+    "pirate-get": [
         {
-            "advisory": "Pdkit 1.2.1 includes an unspecified security fix for included libraries.",
-            "cve": "PVE-2021-37793",
-            "id": "pyup.io-37793",
+            "advisory": "pirate-get before 0.2.8 is not properly validating torrent file names.\r\n\r\n- https://github.com/vikstrous/pirate-get/issues/73",
+            "cve": "PVE-2021-34168",
+            "id": "pyup.io-34168",
             "specs": [
-                "<1.2.1"
+                "<0.2.8"
             ],
-            "v": "<1.2.1"
+            "v": "<0.2.8"
         }
     ],
-    "peewee": [
+    "pirxcypinger": [
         {
-            "advisory": "The main change in this release is the removal of the `AESEncryptedField`,\r\nwhich was included as part of the `playhouse.fields` extension. It was brought\r\nto my attention that there was some serious potential for security\r\nvulnerabilities. Rather than give users a false sense of security, I've decided\r\nthe best course of action is to remove the field.",
-            "cve": "PVE-2021-34337",
-            "id": "pyup.io-34337",
+            "advisory": "Pirxcypinger 3.2 includes a fix for preventing abuse of URLs.\r\nhttps://github.com/PirxcyFinal/PirxcyPinger/commit/bc318987c5e8bf72bf4994ff797f09acce815fba",
+            "cve": "PVE-2021-42378",
+            "id": "pyup.io-42378",
             "specs": [
-                "<2.10.0"
+                "<3.2"
             ],
-            "v": "<2.10.0"
+            "v": "<3.2"
         }
     ],
-    "pelutils": [
+    "pkgcore": [
         {
-            "advisory": "Pelutils version 0.6.0 makes 'log.throw' private, as it could be exploited.",
-            "cve": "PVE-2021-42045",
-            "id": "pyup.io-42045",
+            "advisory": "pkgcore 0.4.7.12 includes a security fix; force cwd to something controlled for ebuild env.  This blocks an attack detailed in glsa 200810-02; namely that an ebuild invoking python -c (which looks in cwd for modules to load) allows for an attacker to slip something in.",
+            "cve": "PVE-2021-25962",
+            "id": "pyup.io-25962",
             "specs": [
-                "<0.6.0"
+                "<0.4.7.12"
             ],
-            "v": "<0.6.0"
+            "v": "<0.4.7.12"
         }
     ],
-    "peppercorn": [
+    "platformio": [
         {
-            "advisory": "peppercorn before 0.5 is vulnerable to DoS attacks due to the use of an iterative parser rather than a recursive parser.",
-            "cve": "PVE-2021-25928",
-            "id": "pyup.io-25928",
+            "advisory": "platformio 4.1.0 fixes a security issue when extracting items from TAR archive - see https://github.com/platformio/platformio-core/issues/2995",
+            "cve": "PVE-2021-37869",
+            "id": "pyup.io-37869",
             "specs": [
-                "<0.5"
+                "<4.1.0"
             ],
-            "v": "<0.5"
+            "v": "<4.1.0"
         }
     ],
-    "persephone": [
+    "plex-mpv-shim": [
         {
-            "advisory": "Persephone 0.4.0 updates the nltk dependency to resolve a possible security issue.",
-            "cve": "PVE-2021-38231",
-            "id": "pyup.io-38231",
+            "advisory": "Plex-mpv-shim 1.10.01 upgrades to a newer MPV build for security reasons.",
+            "cve": "PVE-2021-42829",
+            "id": "pyup.io-42829",
             "specs": [
-                "<0.4.0"
+                "<1.10.01"
             ],
-            "v": "<0.4.0"
+            "v": "<1.10.01"
         }
     ],
-    "petl": [
+    "plomino": [
         {
-            "advisory": "petl before 1.68, in some configurations, allows resolution of entities in an XML document.",
-            "cve": "CVE-2020-29128",
-            "id": "pyup.io-42292",
+            "advisory": "plomino before 1.18 has a major vulnerability in open_url (now, targeted sources must be declared safe from an local package).",
+            "cve": "PVE-2021-25963",
+            "id": "pyup.io-25963",
             "specs": [
-                "<1.6.8"
+                "<1.18"
             ],
-            "v": "<1.6.8"
+            "v": "<1.18"
+        },
+        {
+            "advisory": "plomino 1.5.3 includes a security fix: when a group has PlominoAuthors rights, members of this group are just authors on their own documents.",
+            "cve": "PVE-2021-25964",
+            "id": "pyup.io-25964",
+            "specs": [
+                "<1.5.3"
+            ],
+            "v": "<1.5.3"
         }
     ],
-    "pex": [
+    "plone": [
         {
-            "advisory": "pex before 0.5.6 follows links which may lead to security issues: https://rbcommons.com/s/twitter/r/293/.",
-            "cve": "PVE-2021-25929",
-            "id": "pyup.io-25929",
+            "advisory": "Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.",
+            "cve": "CVE-2011-1340",
+            "id": "pyup.io-25966",
             "specs": [
-                "<0.5.6"
+                "<2.5.3"
             ],
-            "v": "<0.5.6"
+            "v": "<2.5.3"
         },
         {
-            "advisory": "Pex 0.8.0 includes a fix to refactor http handling to allow for alternate http implementations.  This adds support  for 'requests' <https://github.com/kennethreitz/requests>, improving both performance and security.  For more information, read the commit notes at <https://github.com/pantsbuild/pex/commit/91c7f324085c18af714d35947b603a5f60aeb682> and <https://rbcommons.com/s/twitter/r/778/>.",
-            "cve": "PVE-2021-27426",
-            "id": "pyup.io-27426",
+            "advisory": "Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safe_html transform.",
+            "cve": "CVE-2010-2422",
+            "id": "pyup.io-25967",
             "specs": [
-                "<0.8.0"
+                "<3.3.4"
             ],
-            "v": "<0.8.0"
-        }
-    ],
-    "pfun": [
+            "v": "<3.3.4"
+        },
         {
-            "advisory": "Pfun 0.12.0 updates the 'aiohttp' dependency to 3.7.4 to avoid an open redirect vulnerability.",
-            "cve": "PVE-2021-40141",
-            "id": "pyup.io-40141",
+            "advisory": "kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.",
+            "cve": "CVE-2012-5496",
+            "id": "pyup.io-33143",
             "specs": [
-                "<0.12.0"
+                "<4.0"
             ],
-            "v": "<0.12.0"
-        }
-    ],
-    "pgbedrock": [
+            "v": "<4.0"
+        },
         {
-            "advisory": "Pgbedrock version 0.4.2 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/Squarespace/pgbedrock/commit/a217fa419fbb88fd4949ea6db7ca2fa9869cf8e1",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41360",
+            "advisory": "Plone 4.0.7 includes a fix for CVE-2011-1948: Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.\r\nhttps://plone.org/security/hotfix/20110531/cross-site-scripting",
+            "cve": "CVE-2011-1948",
+            "id": "pyup.io-25972",
             "specs": [
-                "<0.4.2"
+                "<4.0.7",
+                ">=4.1a0,<=4.1"
             ],
-            "v": "<0.4.2"
-        }
-    ],
-    "phileo": [
+            "v": "<4.0.7,>=4.1a0,<=4.1"
+        },
         {
-            "advisory": "phileo before 0.3 allows users to like anything and everything, which could potentially lead to security problems (eg. liking entries in permission tables, and thus seeing their content; liking administrative users and thus getting their username).",
-            "cve": "PVE-2021-25930",
-            "id": "pyup.io-25930",
+            "advisory": "Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.",
+            "cve": "CVE-2011-4462",
+            "id": "pyup.io-25973",
             "specs": [
-                "<0.3"
+                "<4.1.3"
             ],
-            "v": "<0.3"
-        }
-    ],
-    "phoenix-letter": [
+            "v": "<4.1.3"
+        },
         {
-            "advisory": "Phoenix-letter 0.2.0 adds the flag '--aws-keys' to securely ask for the AWS credentials to avoid keeping sensitive information accessible in plain text. Without this flag, it falls back to the Boto3 default credential search.",
-            "cve": "PVE-2021-39438",
-            "id": "pyup.io-39438",
+            "advisory": "ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.",
+            "cve": "CVE-2012-5503",
+            "id": "pyup.io-25999",
             "specs": [
-                "<0.2.0"
+                "<4.2.3",
+                "<4.3b1"
             ],
-            "v": "<0.2.0"
-        }
-    ],
-    "phonenumbers": [
+            "v": "<4.2.3,<4.3b1"
+        },
         {
-            "advisory": "Phonenumbers 8.3.1 contains a security improvement of the getNationalSignificantNumber function to make it more robust against malicious input.",
-            "cve": "PVE-2021-39441",
-            "id": "pyup.io-39441",
+            "advisory": "Plone versions 4.2.3 and 4.3b1 include a fix for CVE-2012-6661, a vulnerability in its dependency \"zope\".",
+            "cve": "CVE-2012-6661",
+            "id": "pyup.io-42186",
             "specs": [
-                "<8.3.1"
+                "<4.2.3",
+                ">=4.3a1,<4.3b1"
             ],
-            "v": "<8.3.1"
-        }
-    ],
-    "photocrawl": [
+            "v": "<4.2.3,>=4.3a1,<4.3b1"
+        },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-41714",
+            "advisory": "Plone versions 4.2.3 and 4.3b1 include a fix for CVE-2012-5508: The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors.  NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG reseeding issue in Zope.\r\nhttp://www.openwall.com/lists/oss-security/2012/11/10/1\r\nhttps://bugs.launchpad.net/zope2/+bug/1071067\r\nhttps://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt\r\nhttps://plone.org/products/plone-hotfix/releases/20121124\r\nhttps://plone.org/products/plone/security/advisories/20121106/24",
+            "cve": "CVE-2012-5508",
+            "id": "pyup.io-35398",
             "specs": [
-                "<0.3.1"
+                "<4.2.3",
+                ">=4.3a1,<4.3b1"
             ],
-            "v": "<0.3.1"
+            "v": "<4.2.3,>=4.3a1,<4.3b1"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-43529",
+            "advisory": "ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.",
+            "cve": "CVE-2012-5486",
+            "id": "pyup.io-25996",
             "specs": [
-                "<0.3.1"
+                "<4.3"
             ],
-            "v": "<0.3.1"
+            "v": "<4.3"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2020-15999",
-            "id": "pyup.io-43530",
+            "advisory": "The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. See CVE-2020-35190.",
+            "cve": "CVE-2020-35190",
+            "id": "pyup.io-39305",
             "specs": [
-                "<0.3.1"
+                "<4.3.18"
             ],
-            "v": "<0.3.1"
+            "v": "<4.3.18"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-43531",
+            "advisory": "Plone 5.2.2rc1 fixes that isURLInPortal could be tricked into accepting malicious links.",
+            "cve": "PVE-2021-38991",
+            "id": "pyup.io-38991",
             "specs": [
-                "<0.3.1"
+                "<5.2.2rc1"
             ],
-            "v": "<0.3.1"
+            "v": "<5.2.2rc1"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-43532",
+            "advisory": "Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). See CVE-2020-28735.",
+            "cve": "CVE-2020-28735",
+            "id": "pyup.io-39377",
             "specs": [
-                "<0.3.1"
+                "<5.2.3"
             ],
-            "v": "<0.3.1"
+            "v": "<5.2.3"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-25290",
-            "id": "pyup.io-43535",
+            "advisory": "Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role). See CVE-2020-28736.",
+            "cve": "CVE-2020-28736",
+            "id": "pyup.io-39378",
             "specs": [
-                "<0.3.1"
+                "<5.2.3"
             ],
-            "v": "<0.3.1"
+            "v": "<5.2.3"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-43541",
+            "advisory": "Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. See CVE-2020-28734.",
+            "cve": "CVE-2020-28734",
+            "id": "pyup.io-39376",
             "specs": [
-                "<0.3.1"
+                "<5.2.3"
             ],
-            "v": "<0.3.1"
+            "v": "<5.2.3"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-43542",
+            "advisory": "Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.",
+            "cve": "CVE-2021-3313",
+            "id": "pyup.io-40528",
+            "specs": [
+                "<5.2.4"
+            ],
+            "v": "<5.2.4"
+        },
+        {
+            "advisory": "Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.",
+            "cve": "CVE-2021-33512",
+            "id": "pyup.io-40537",
+            "specs": [
+                "<=5.2.4"
+            ],
+            "v": "<=5.2.4"
+        },
+        {
+            "advisory": "Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.",
+            "cve": "CVE-2021-33510",
+            "id": "pyup.io-40535",
+            "specs": [
+                "<=5.2.4"
+            ],
+            "v": "<=5.2.4"
+        },
+        {
+            "advisory": "Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.",
+            "cve": "CVE-2021-33513",
+            "id": "pyup.io-40538",
+            "specs": [
+                "<=5.2.4"
+            ],
+            "v": "<=5.2.4"
+        },
+        {
+            "advisory": "Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.",
+            "cve": "CVE-2021-33508",
+            "id": "pyup.io-40533",
+            "specs": [
+                "<=5.2.4"
+            ],
+            "v": "<=5.2.4"
+        },
+        {
+            "advisory": "Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.",
+            "cve": "CVE-2021-33511",
+            "id": "pyup.io-40536",
+            "specs": [
+                "<=5.2.4"
+            ],
+            "v": "<=5.2.4"
+        },
+        {
+            "advisory": "Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.",
+            "cve": "CVE-2021-33509",
+            "id": "pyup.io-40534",
             "specs": [
-                "<0.3.1"
+                "<=5.2.4"
             ],
-            "v": "<0.3.1"
+            "v": "<=5.2.4"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-28677",
-            "id": "pyup.io-43545",
+            "advisory": "Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.",
+            "cve": "CVE-2021-33507",
+            "id": "pyup.io-40821",
             "specs": [
-                "<0.3.1"
+                "<=5.2.4"
             ],
-            "v": "<0.3.1"
+            "v": "<=5.2.4"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-28678",
-            "id": "pyup.io-43546",
+            "advisory": "Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a \"highly serious vulnerability.\" NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.",
+            "cve": "CVE-2011-2528",
+            "id": "pyup.io-25965",
             "specs": [
-                "<0.3.1"
+                "==3.3.5,==3.3.4,==3.3.3,==3.3.2"
             ],
-            "v": "<0.3.1"
+            "v": "==3.3.5,==3.3.4,==3.3.3,==3.3.2"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-43533",
+            "advisory": "Plone 5.2.3 is affected by CVE-2021-29002: A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the \"form.widgets.site_title\" parameter.\r\nhttps://www.exploit-db.com/exploits/49668",
+            "cve": "CVE-2021-29002",
+            "id": "pyup.io-40094",
             "specs": [
-                "<0.3.1"
+                "==5.2.3"
             ],
-            "v": "<0.3.1"
+            "v": "==5.2.3"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-25289",
-            "id": "pyup.io-43534",
+            "advisory": "Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.",
+            "cve": "CVE-2011-3587",
+            "id": "pyup.io-33144",
             "specs": [
-                "<0.3.1"
+                ">4,<4.2a2"
             ],
-            "v": "<0.3.1"
+            "v": ">4,<4.2a2"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-25292",
-            "id": "pyup.io-43537",
+            "advisory": "Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.",
+            "cve": "CVE-2017-5524",
+            "id": "pyup.io-35733",
             "specs": [
-                "<0.3.1"
+                ">4,<=4.3.11",
+                ">5,<=5.0.6"
             ],
-            "v": "<0.3.1"
+            "v": ">4,<=4.3.11,>5,<=5.0.6"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-25293",
-            "id": "pyup.io-43538",
+            "advisory": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)",
+            "cve": "CVE-2017-1000484",
+            "id": "pyup.io-35704",
             "specs": [
-                "<0.3.1"
+                ">4,<=4.3.15",
+                ">=5.0,<5.1rc1"
             ],
-            "v": "<0.3.1"
+            "v": ">4,<=4.3.15,>=5.0,<5.1rc1"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-25287",
-            "id": "pyup.io-43539",
+            "advisory": "Plone 4.2 and 4.0.6 include a fix for CVE-2011-1949: Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422.\r\nhttps://plone.org/security/hotfix/20110531/persistent-xss",
+            "cve": "CVE-2011-1949",
+            "id": "pyup.io-25997",
             "specs": [
-                "<0.3.1"
+                ">=2.1,<4.0.6",
+                ">=4.1a0,<4.2"
             ],
-            "v": "<0.3.1"
+            "v": ">=2.1,<4.0.6,>=4.1a0,<4.2"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-25288",
-            "id": "pyup.io-43540",
+            "advisory": "Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.",
+            "cve": "CVE-2011-0720",
+            "id": "pyup.io-33142",
             "specs": [
-                "<0.3.1"
+                ">=2.5,<4.0"
             ],
-            "v": "<0.3.1"
+            "v": ">=2.5,<4.0"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-43543",
+            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method. See: CVE-2013-7062.",
+            "cve": "CVE-2013-7062",
+            "id": "pyup.io-37753",
             "specs": [
-                "<0.3.1"
+                ">=3.3.0,<=3.3.6",
+                ">=4.0,<=4.0.9",
+                ">=4.1.0,<=4.1.6",
+                ">=4.2.0,<=4.2.7",
+                ">=4.3,<=4.3.2"
             ],
-            "v": "<0.3.1"
+            "v": ">=3.3.0,<=3.3.6,>=4.0,<=4.0.9,>=4.1.0,<=4.1.6,>=4.2.0,<=4.2.7,>=4.3,<=4.3.2"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-25291",
-            "id": "pyup.io-43536",
+            "advisory": "The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.",
+            "cve": "CVE-2011-4030",
+            "id": "pyup.io-33145",
             "specs": [
-                "<0.3.1"
+                ">=4,<4.2a2"
             ],
-            "v": "<0.3.1"
+            "v": ">=4,<4.2a2"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-28676",
-            "id": "pyup.io-43544",
+            "advisory": "SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) See: CVE-2020-7939.",
+            "cve": "CVE-2020-7939",
+            "id": "pyup.io-37787",
             "specs": [
-                "<0.3.1"
+                ">=4.0,<=5.2.1"
             ],
-            "v": "<0.3.1"
+            "v": ">=4.0,<=5.2.1"
         },
         {
-            "advisory": "Photocrawl 0.3.1 updates the minimum version requirement of \"Pillow\" to 8.3.2 to include security patches.",
-            "cve": "CVE-2021-34552",
-            "id": "pyup.io-43547",
+            "advisory": "An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site. See: CVE-2020-7936.",
+            "cve": "CVE-2020-7936",
+            "id": "pyup.io-37784",
             "specs": [
-                "<0.3.1"
+                ">=4.0,<=5.2.1"
             ],
-            "v": "<0.3.1"
-        }
-    ],
-    "pi-mqtt-gpio": [
+            "v": ">=4.0,<=5.2.1"
+        },
         {
-            "advisory": "Pi-mqtt-gpio 0.5.2 updates the PyYAML to a version that doesn't suffer from CVE-2020-1747 vulnerability.",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-39464",
+            "advisory": "Plone 4.2 and 4.0.6 include a fix for CVE-2011-1950: plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.\r\nhttps://plone.org/security/hotfix/20110531/privilege-escalation",
+            "cve": "CVE-2011-1950",
+            "id": "pyup.io-25974",
             "specs": [
-                "<0.5.2"
+                ">=4.1a0,<4.2",
+                "<4.0.6"
             ],
-            "v": "<0.5.2"
-        }
-    ],
-    "piccolo": [
+            "v": ">=4.1a0,<4.2,<4.0.6"
+        },
         {
-            "advisory": "Piccolo 0.13.1 bumps the 'Node' dependencies with security warnings.",
-            "cve": "PVE-2021-40659",
-            "id": "pyup.io-40659",
+            "advisory": "Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. See: CVE-2020-7940.",
+            "cve": "CVE-2020-7940",
+            "id": "pyup.io-37788",
             "specs": [
-                "<0.13.1"
+                ">=4.3,<=5.2.0"
             ],
-            "v": "<0.13.1"
+            "v": ">=4.3,<=5.2.0"
         },
         {
-            "advisory": "Piccolo 0.2 uses 'QueryString' internally to represent queries (instead of raw strings) to harden against SQL injection.",
-            "cve": "PVE-2021-38919",
-            "id": "pyup.io-38919",
+            "advisory": "A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. See: CVE-2020-7941.",
+            "cve": "CVE-2020-7941",
+            "id": "pyup.io-36898",
             "specs": [
-                "<0.2"
+                ">=4.3,<=5.2.1"
             ],
-            "v": "<0.2"
+            "v": ">=4.3,<=5.2.1"
         },
         {
-            "advisory": "Piccolo 0.9.1 bumps node requirements because of a security warning.",
-            "cve": "PVE-2021-38768",
-            "id": "pyup.io-38768",
+            "advisory": "An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site. See: CVE-2020-7937.",
+            "cve": "CVE-2020-7937",
+            "id": "pyup.io-37785",
             "specs": [
-                "<0.9.1"
+                ">=5.0,<=5.2.1"
             ],
-            "v": "<0.9.1"
-        }
-    ],
-    "piccolo-admin": [
+            "v": ">=5.0,<=5.2.1"
+        },
         {
-            "advisory": "Piccolo-admin 0.13.1 updates underlying 'Node.js' dependencies with security warnings.",
-            "cve": "PVE-2021-40867",
-            "id": "pyup.io-40867",
+            "advisory": "In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.",
+            "cve": "CVE-2021-35959",
+            "id": "pyup.io-40886",
             "specs": [
-                "<0.13.1"
+                ">=5.0.0,<=5.2.4"
             ],
-            "v": "<0.13.1"
+            "v": ">=5.0.0,<=5.2.4"
         },
         {
-            "advisory": "Piccolo-admin 0.9.1 upgrades the node requirements because of a security warning.",
-            "cve": "PVE-2021-38643",
-            "id": "pyup.io-38643",
+            "advisory": "plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. See: CVE-2020-7938.",
+            "cve": "CVE-2020-7938",
+            "id": "pyup.io-37786",
             "specs": [
-                "<0.9.1"
+                ">=5.2.0,<=5.2.1"
             ],
-            "v": "<0.9.1"
+            "v": ">=5.2.0,<=5.2.1"
         }
     ],
-    "pigar": [
+    "plone-app-contentmenu": [
         {
-            "advisory": "Pigar 0.9.1 fixes some potential security vulnerabilities upgrading its dependency 'requests' to v2.21.0.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36904",
+            "advisory": "Plone-app-contentmenu  1.1.7 escapes the title of the defaultpage in the DisplayMenu. This fixes a potential XSS vulnerability.\r\nhttps://github.com/plone/plone.app.contentmenu/commit/6d7d5d51c12c82fc0eeaded0841fc57d2258e9af",
+            "cve": "PVE-2021-36047",
+            "id": "pyup.io-36047",
             "specs": [
-                "<0.9.1"
+                "<1.1.7"
             ],
-            "v": "<0.9.1"
+            "v": "<1.1.7"
         }
     ],
-    "piicatcher": [
+    "plone-app-contenttypes": [
         {
-            "advisory": "Piicatcher 0.14.0 gets security updates.",
-            "cve": "PVE-2021-41186",
-            "id": "pyup.io-41186",
+            "advisory": "Plone.app.contenttypes 1.2.15 fixes a possible cross site scripting (XSS) attack in lead image caption.\r\nhttps://github.com/plone/plone.app.contenttypes/commit/16f2c31cada65f7c969e4d314c70d39d1db01f17",
+            "cve": "PVE-2021-35870",
+            "id": "pyup.io-35870",
             "specs": [
-                "<0.14.0"
+                "<1.2.15"
             ],
-            "v": "<0.14.0"
+            "v": "<1.2.15"
         },
         {
-            "advisory": "Piicatcher 0.3.1 updates cryptography due to security advisory.",
-            "cve": "PVE-2021-41165",
-            "id": "pyup.io-41165",
+            "advisory": "Plone-app-contenttypes version 2.1.6 includes a fix for CVE-2020-7941: A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.",
+            "cve": "CVE-2020-7941",
+            "id": "pyup.io-41880",
             "specs": [
-                "<0.3.1"
+                "<2.1.6"
             ],
-            "v": "<0.3.1"
+            "v": "<2.1.6"
         }
     ],
-    "pikepdf": [
+    "plone-app-discussion": [
         {
-            "advisory": "models/metadata.py in the pikepdf package 1.3.0 through 2.9.2 for Python allows XXE when parsing XMP metadata entries.",
-            "cve": "CVE-2021-29421",
-            "id": "pyup.io-40137",
+            "advisory": "plone-app-discussion 2.4.14 fixes a possible cross site scripting (XSS) attack on moderate comments page.",
+            "cve": "PVE-2021-35864",
+            "id": "pyup.io-35864",
             "specs": [
-                ">=1.3.0,<=2.9.2"
+                "<2.4.14"
             ],
-            "v": ">=1.3.0,<=2.9.2"
+            "v": "<2.4.14"
         }
     ],
-    "pillow": [
+    "plone-app-event": [
         {
-            "advisory": "pillow before 2.3.1 makes insecure use of tempfile.mktemp (CVE-2014-1933).",
-            "cve": "CVE-2014-1933",
-            "id": "pyup.io-39580",
+            "advisory": "Plone.app.event 3.0 fixes a possible cross site scripting (XSS) attack in location field.\r\nhttps://github.com/plone/plone.app.event/pull/233",
+            "cve": "PVE-2021-35923",
+            "id": "pyup.io-35923",
             "specs": [
-                "<2.3.1"
+                "<3.0"
             ],
-            "v": "<2.3.1"
-        },
+            "v": "<3.0"
+        }
+    ],
+    "plone-app-layout": [
         {
-            "advisory": "pillow before 2.3.1 makes insecure use of tempfile.mktemp (CVE-2014-1932).",
-            "cve": "CVE-2014-1932",
-            "id": "pyup.io-25931",
+            "advisory": "Plone-app-layout version 2.5.1 adds csrf tokens automatically for contentview urls.",
+            "cve": "PVE-2021-41878",
+            "id": "pyup.io-41878",
             "specs": [
-                "<2.3.1"
+                "<2.5.1"
             ],
-            "v": "<2.3.1"
+            "v": "<2.5.1"
         },
         {
-            "advisory": "Pillow versions 2.3.2 and 2.5.2 include a fix for CVE-2014-3589: PIL/IcnsImagePlugin.py in Python Imaging Library (PIL) and Pillow before 2.3.2 and 2.5.x before 2.5.2 allows remote attackers to cause a denial of service via a crafted block size.\r\nhttps://github.com/python-pillow/Pillow/commit/205e056f8f9b06ed7b925cf8aa0874bc4aaf8a7d",
-            "cve": "CVE-2014-3589",
-            "id": "pyup.io-25932",
+            "advisory": "Plone-app-layout version 3.4.1 integrates a fix for CVE-2020-7937, which affects the core package Plone.\r\nhttps://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher",
+            "cve": "CVE-2020-7937",
+            "id": "pyup.io-41877",
             "specs": [
-                "<2.3.2",
-                ">=2.5.0,<2.5.2"
+                "<3.4.1"
             ],
-            "v": "<2.3.2,>=2.5.0,<2.5.2"
+            "v": "<3.4.1"
         },
         {
-            "advisory": "Pillow 2.5.0 includes a fix that prevents shell injection.",
-            "cve": "PVE-2021-38907",
-            "id": "pyup.io-38907",
+            "advisory": "Plone-app-layout version 4.0.0a2 fixes several information exposure vulnerabilities. The new version:\r\n- Only shows document_byline to public if 'display_publication_date_in_byline' in site controlpanel is active.\r\n- Only shows author if 'allow_anon_views_about' in security controlpanel is active. \r\n- Shows 'modification_date' only if not published or 'modification_date' is greater that 'effective_date'.",
+            "cve": "PVE-2021-41876",
+            "id": "pyup.io-41876",
             "specs": [
-                "<2.5.0"
+                "<4.0.0a2"
             ],
-            "v": "<2.5.0"
-        },
+            "v": "<4.0.0a2"
+        }
+    ],
+    "plone-app-linkintegrity": [
         {
-            "advisory": "pillow before 2.5.2 is vulnerable to a DoS in the IcnsImagePlugin.",
-            "cve": "PVE-2021-25933",
-            "id": "pyup.io-25933",
+            "advisory": "Plone-app-linkintegrity 1.0.2 includes a fix for CVE-2007-5741: Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.\r\nhttps://github.com/plone/plone.app.linkintegrity/commit/4be49548c4f1046a8204030f26a603c29f38d9dd",
+            "cve": "CVE-2007-5741",
+            "id": "pyup.io-36046",
             "specs": [
-                "<2.5.2"
+                "<1.0.2"
             ],
-            "v": "<2.5.2"
-        },
+            "v": "<1.0.2"
+        }
+    ],
+    "plone-app-theming": [
         {
-            "advisory": "pillow before 2.5.3 is vulnerable to a DoS in the Jpeg2KImagePlugin.",
-            "cve": "PVE-2021-25934",
-            "id": "pyup.io-25934",
+            "advisory": "Plone-app-theming 4.1.6 includes the following security improvements:\r\n-Fails when trying file protocol access in diazo rules\r\n-Doesn't resolves entities\r\n-Removes processing instructions",
+            "cve": "PVE-2021-41938",
+            "id": "pyup.io-41938",
             "specs": [
-                "<2.5.3"
+                "<4.1.6"
             ],
-            "v": "<2.5.3"
+            "v": "<4.1.6"
         },
         {
-            "advisory": "pillow before 2.6.0rc1 is vulnerable to CVE-2014-3598, a DOS in the Jpeg2KImagePlugin and CVE-2014-3589, a DOS in the IcnsImagePlugin.",
-            "cve": "CVE-2014-3598",
-            "id": "pyup.io-25935",
+            "advisory": "Plone.app.theming 5.0.0a1 and 4.1.6 include a fix for CVE-2021-33511: Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.\r\nhttps://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser",
+            "cve": "CVE-2021-33511",
+            "id": "pyup.io-41937",
             "specs": [
-                "<2.6.0rc1"
+                "<4.1.6"
             ],
-            "v": "<2.6.0rc1"
-        },
+            "v": "<4.1.6"
+        }
+    ],
+    "plone-app-users": [
         {
-            "advisory": "pillow before 2.6.2 is vulnerable to a PNG decompression DoS (CVE-2014-9601).",
-            "cve": "CVE-2014-9601",
-            "id": "pyup.io-25936",
+            "advisory": "Plone-app-users before 1.0.5 does not check for permission when editing other users' profiles. This fixes http://dev.plone.org/plone/ticket/11842 and http://plone.org/products/plone/security/advisories/CVE-2011-1950.",
+            "cve": "CVE-2011-1950",
+            "id": "pyup.io-36096",
             "specs": [
-                "<2.6.2"
+                "<1.0.5"
             ],
-            "v": "<2.6.2"
-        },
+            "v": "<1.0.5"
+        }
+    ],
+    "plone-app-z3cform": [
         {
-            "advisory": "pillow before 2.7.0 is vulnerable to a PNG decompression DoS (CVE-2014-9601).",
-            "cve": "CVE-2014-9601",
-            "id": "pyup.io-25937",
+            "advisory": "Plone-app-z3cform version 0.5.4 makes LookupErrors no longer visible to improve security.",
+            "cve": "PVE-2021-42026",
+            "id": "pyup.io-42026",
             "specs": [
-                "<2.7.0"
+                "<0.5.4"
             ],
-            "v": "<2.7.0"
-        },
+            "v": "<0.5.4"
+        }
+    ],
+    "plone-dexterity": [
         {
-            "advisory": "Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.",
-            "cve": "CVE-2016-0740",
-            "id": "pyup.io-33134",
+            "advisory": "In plone-dexterity before 2.3.0 Attribute access to schema fields can be protected. This\r\n  worked for direct schemas, but was not implemented for permissions coming\r\n  from behaviors.",
+            "cve": "PVE-2021-35873",
+            "id": "pyup.io-35873",
             "specs": [
-                "<3.1.1"
+                "<2.3.0"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<2.3.0"
+        }
+    ],
+    "plone-portlet-static": [
         {
-            "advisory": "Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.",
-            "cve": "CVE-2016-2533",
-            "id": "pyup.io-33136",
+            "advisory": "Plone-portlet-static version 1.2 ensures that text output is passed through the safe-html transform to protect against malicious text.",
+            "cve": "PVE-2021-41932",
+            "id": "pyup.io-41932",
             "specs": [
-                "<3.1.1"
+                "<1.2"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<1.2"
+        }
+    ],
+    "plone-restapi": [
         {
-            "advisory": "Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have unspecified impact via negative values of the new size, which triggers a heap-based buffer overflow.",
-            "cve": "CVE-2016-4009",
-            "id": "pyup.io-33137",
+            "advisory": "Plone-restapi 8.4.0 adds security decorators in the PAS plugin.",
+            "cve": "PVE-2021-41890",
+            "id": "pyup.io-41890",
             "specs": [
-                "<3.1.1"
+                "<8.4.0"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<8.4.0"
+        }
+    ],
+    "plone-supermodel": [
         {
-            "advisory": "Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.",
-            "cve": "CVE-2016-0775",
-            "id": "pyup.io-33135",
+            "advisory": "Plone-supermodel 1.6.3 doesn't resolves entities in the xml parser and removes processing instructions to increase security.",
+            "cve": "PVE-2021-41933",
+            "id": "pyup.io-41933",
             "specs": [
-                "<3.1.1"
+                "<1.6.3"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<1.6.3"
+        }
+    ],
+    "plone-testing": [
         {
-            "advisory": "pillow before 3.1.2 is vulnerable to an integer overflow in Jpeg2KEncode.c causing a buffer overflow. CVE-2016-3076.",
-            "cve": "CVE-2016-3076",
-            "id": "pyup.io-25943",
+            "advisory": "Plone-testing 6.1.0 fixes teardown of the \"plone.testing.security.Checkers\" layer, which was not properly restoring zope.security's \"_checkers\" dict.",
+            "cve": "PVE-2021-41931",
+            "id": "pyup.io-41931",
             "specs": [
-                "<3.1.2"
+                "<6.1.0"
             ],
-            "v": "<3.1.2"
-        },
+            "v": "<6.1.0"
+        }
+    ],
+    "plone.app.content": [
         {
-            "advisory": "Pillow before 3.3.2 allows context-dependent attackers to execute arbitrary code by using the \"crafted image file\" approach, related to an \"Insecure Sign Extension\" issue affecting the ImagingNew in Storage.c component.",
-            "cve": "CVE-2016-9190",
-            "id": "pyup.io-33138",
+            "advisory": "plone.app.content 3.3.1 includes security hotfix 20160830 for folder factories redirection.",
+            "cve": "PVE-2021-26000",
+            "id": "pyup.io-26000",
             "specs": [
-                "<3.3.2"
+                "<3.3.1"
             ],
-            "v": "<3.3.2"
+            "v": "<3.3.1"
         },
         {
-            "advisory": "Pillow before 3.3.2 allows context-dependent attackers to obtain sensitive information by using the \"crafted image file\" approach, related to an \"Integer Overflow\" issue affecting the Image.core.map_buffer in map.c component.",
-            "cve": "CVE-2016-9189",
-            "id": "pyup.io-33139",
+            "advisory": "Plone.app.content 3.8.1 integrate the Plone20200121 hotfix to prevent XSS in title - see: https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher",
+            "cve": "CVE-2020-7937",
+            "id": "pyup.io-38030",
             "specs": [
-                "<3.3.2"
+                "<3.8.1"
             ],
-            "v": "<3.3.2"
+            "v": "<3.8.1"
         },
         {
-            "advisory": "libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc. See: CVE-2020-5310.",
-            "cve": "CVE-2020-5310",
-            "id": "pyup.io-37779",
+            "advisory": "Plone.app.content 4.0.0a3 includes fixes for:\r\n-Stored XSS in folder contents.\r\nhttps://plone.org/security/hotfix/20210518/stored-xss-in-folder-contents\r\n-Stored XSS from user fullname and possibly other places where \"getVocabulary\" is called. This is an alternative to the \"plone.app.users\" workaround from the \"PloneHotfix20210518\" fullname fix.\r\nhttps://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname\r\nSee CVE-2021-35959.",
+            "cve": "CVE-2021-35959",
+            "id": "pyup.io-41256",
             "specs": [
-                "<6.2.2"
+                "<4.0.0a3"
             ],
-            "v": "<6.2.2"
-        },
+            "v": "<4.0.0a3"
+        }
+    ],
+    "plone.app.contentmenu": [
         {
-            "advisory": "libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.",
-            "cve": "CVE-2020-5312",
-            "id": "pyup.io-37781",
+            "advisory": "Plone.app.contentmenu  1.1.7 escapes the title of the defaultpage in the DisplayMenu. This fixes a potential XSS vulnerability.\r\nhttps://github.com/plone/plone.app.contentmenu/commit/6d7d5d51c12c82fc0eeaded0841fc57d2258e9af",
+            "cve": "PVE-2021-26001",
+            "id": "pyup.io-26001",
             "specs": [
-                "<6.2.2"
+                "<1.1.7"
             ],
-            "v": "<6.2.2"
-        },
+            "v": "<1.1.7"
+        }
+    ],
+    "plone.app.contenttypes": [
         {
-            "advisory": "libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow. See: CVE-2020-5313.",
-            "cve": "CVE-2020-5313",
-            "id": "pyup.io-37782",
+            "advisory": "Plone.app.contenttypes 1.2.15 fixes a possible cross site scripting (XSS) attack in lead image caption.\r\nhttps://github.com/plone/plone.app.contenttypes/commit/16f2c31cada65f7c969e4d314c70d39d1db01f17",
+            "cve": "PVE-2021-26002",
+            "id": "pyup.io-26002",
             "specs": [
-                "<6.2.2"
+                "<1.2.15"
             ],
-            "v": "<6.2.2"
+            "v": "<1.2.15"
         },
         {
-            "advisory": "libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.",
-            "cve": "CVE-2020-5311",
-            "id": "pyup.io-37780",
+            "advisory": "A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. See: CVE-2020-7941.",
+            "cve": "CVE-2020-7941",
+            "id": "pyup.io-37887",
             "specs": [
-                "<6.2.2"
+                "<2.1.6"
             ],
-            "v": "<6.2.2"
-        },
+            "v": "<2.1.6"
+        }
+    ],
+    "plone.app.dexterity": [
         {
-            "advisory": "In Pillow before 6.2.3 and 7.x before 7.0.1, there are two Buffer Overflows in libImaging/TiffDecode.c. See: CVE-2020-10379.",
-            "cve": "CVE-2020-10379",
-            "id": "pyup.io-38450",
+            "advisory": "The modeleditor in plone.app.dexterity 2.6.8 no longer resolves entities, and it removes processing instructions. This increases the security.",
+            "cve": "PVE-2021-39143",
+            "id": "pyup.io-39143",
+            "specs": [
+                "<2.6.8"
+            ],
+            "v": "<2.6.8"
+        }
+    ],
+    "plone.app.discussion": [
+        {
+            "advisory": "Plone.app.discussion 2.4.14 fixes a possible cross site scripting (XSS) attack on moderate comments page.\r\nhttps://github.com/plone/plone.app.discussion/commit/e1dbaef82a801c58576057564ab3689dba983c15",
+            "cve": "PVE-2021-26003",
+            "id": "pyup.io-26003",
             "specs": [
-                "<6.2.3",
-                ">=7.0.0,<7.0.1"
+                "<2.4.14"
             ],
-            "v": "<6.2.3,>=7.0.0,<7.0.1"
+            "v": "<2.4.14"
         },
         {
-            "advisory": "In libImaging/PcxDecode.c in Pillow before 6.2.3 and 7.x before 7.0.1, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer. See: CVE-2020-10378.",
-            "cve": "CVE-2020-10378",
-            "id": "pyup.io-38449",
+            "advisory": "plone.app.discussion 2.4.18 includes security hotfix 20160830 for redirects.",
+            "cve": "PVE-2021-26004",
+            "id": "pyup.io-26004",
             "specs": [
-                "<6.2.3",
-                ">=7.0.0,<7.0.1"
+                "<2.4.18"
             ],
-            "v": "<6.2.3,>=7.0.0,<7.0.1"
-        },
+            "v": "<2.4.18"
+        }
+    ],
+    "plone.app.event": [
         {
-            "advisory": "In libImaging/Jpeg2KDecode.c in Pillow before 7.0.0, there are multiple out-of-bounds reads via a crafted JP2 file. See: CVE-2020-10994.",
-            "cve": "CVE-2020-10994",
-            "id": "pyup.io-38451",
+            "advisory": "Plone.app.event 3.0 fixes a possible cross site scripting (XSS) attack in location field.\r\nhttps://github.com/plone/plone.app.event/pull/233",
+            "cve": "PVE-2021-26005",
+            "id": "pyup.io-26005",
             "specs": [
-                "<7.0.0"
+                "<3.0"
             ],
-            "v": "<7.0.0"
+            "v": "<3.0"
         },
         {
-            "advisory": "Pillow 8.0.1 updates FreeType used in binary wheels to 2.10.4 to fix CVE-2020-15999.",
-            "cve": "CVE-2020-15999",
-            "id": "pyup.io-40264",
+            "advisory": "Plone.app.event 3.2.10 gives a validation error in the ical importer when a 'file://' URL is used (this could be a line of attack for a hacker).",
+            "cve": "PVE-2021-39140",
+            "id": "pyup.io-39140",
             "specs": [
-                "<8.0.1"
+                "<3.2.10"
             ],
-            "v": "<8.0.1"
+            "v": "<3.2.10"
         },
         {
-            "advisory": "Pillow 8.1.0 fixes TIFF OOB Write error. CVE-2020-35654 #5175.",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-40265",
+            "advisory": "Plone.app.event 4.0.0a4 includes a fix for a server-side-request-forgery vulnerability. Now, \"file:\" protocol is not allowed in iCal url. Previously, only \"file://\" was disallowed, but this left room for relative paths.\r\nhttps://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url",
+            "cve": "PVE-2021-41254",
+            "id": "pyup.io-41254",
             "specs": [
-                "<8.1.0"
+                "<4.0.0a4"
             ],
-            "v": "<8.1.0"
-        },
+            "v": "<4.0.0a4"
+        }
+    ],
+    "plone.app.layout": [
         {
-            "advisory": "In Pillow before 8.1.0, PcxDecode has a buffer over-read when decoding a crafted PCX file because the user-supplied stride value is trusted for buffer calculations. See: CVE-2020-35653.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-40270",
+            "advisory": "Plone.app.layout 2.5.1 adds CSRF tokens automatically for contentview urls.",
+            "cve": "PVE-2021-41705",
+            "id": "pyup.io-41705",
             "specs": [
-                "<8.1.0"
+                "<2.5.1"
             ],
-            "v": "<8.1.0"
+            "v": "<2.5.1"
         },
         {
-            "advisory": "Pillow 8.1.0 includes a fix for SGI Decode buffer overrun. CVE-2020-35655 #5173.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-40271",
+            "advisory": "Plone.app.layout 3.4.1 integrates the Plone20200121 hotfix to prevent XSS in title - see: https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher.",
+            "cve": "CVE-2020-7937",
+            "id": "pyup.io-38031",
             "specs": [
-                "<8.1.0"
+                "<3.4.1"
             ],
-            "v": "<8.1.0"
+            "v": "<3.4.1"
         },
         {
-            "advisory": "An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is a negative-offset memcpy with an invalid size.",
-            "cve": "CVE-2021-25290",
-            "id": "pyup.io-40275",
+            "advisory": "Plone.app.layout 4.0.0a2 includes fixes for information-exposure vulnerabilities:\r\n-Show document_byline to public if \"display_publication_date_in_byline\" in site controlpanel is active\r\n-Only show author if \"allow_anon_views_about\" in security controlpanel is active\r\n-Show \"modification_date\" if not published or \"modification_date\" is greater that \"effective_date\"",
+            "cve": "PVE-2021-41704",
+            "id": "pyup.io-41704",
             "specs": [
-                "<8.1.1"
+                "<4.0.0a2"
             ],
-            "v": "<8.1.1"
-        },
+            "v": "<4.0.0a2"
+        }
+    ],
+    "plone.app.linkintegrity": [
         {
-            "advisory": "An issue was discovered in Pillow before 8.1.1. TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation conflicts with LibTIFF in RGBA mode. NOTE: this issue exists because of an incomplete fix for CVE-2020-35654.",
-            "cve": "CVE-2021-25289",
-            "id": "pyup.io-40274",
+            "advisory": "Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.",
+            "cve": "CVE-2007-5741",
+            "id": "pyup.io-42336",
             "specs": [
-                "<8.1.1"
+                "<1.0.2"
             ],
-            "v": "<8.1.1"
+            "v": "<1.0.2"
         },
         {
-            "advisory": "An issue was discovered in Pillow before 8.1.1. In TiffDecode.c, there is an out-of-bounds read in TiffreadRGBATile via invalid tile boundaries.",
-            "cve": "CVE-2021-25291",
-            "id": "pyup.io-40272",
+            "advisory": "plone.app.linkintegrity 1.0.2 fixed security issue due to using pickles (see CVE-2007-5741).",
+            "cve": "CVE-2014-8991",
+            "id": "pyup.io-26006",
             "specs": [
-                "<8.1.1"
+                "<1.0.2"
             ],
-            "v": "<8.1.1"
-        },
+            "v": "<1.0.2"
+        }
+    ],
+    "plone.dexterity": [
         {
-            "advisory": "An issue was discovered in Pillow before 8.1.1. The PDF parser allows a regular expression DoS (ReDoS) attack via a crafted PDF file because of a catastrophic backtracking regex.",
-            "cve": "CVE-2021-25292",
-            "id": "pyup.io-40266",
+            "advisory": "plone.dexterity 2.3.0 fixes a security issue. Attribute access to schema fields can be protected. This worked for direct schemas, but was not implemented for permissions coming from behaviors.",
+            "cve": "PVE-2021-26007",
+            "id": "pyup.io-26007",
             "specs": [
-                "<8.1.1"
+                "<2.3.0"
             ],
-            "v": "<8.1.1"
-        },
+            "v": "<2.3.0"
+        }
+    ],
+    "plone.formwidget.contenttree": [
         {
-            "advisory": "An issue was discovered in Pillow before 8.1.1. There is an out-of-bounds read in SGIRleDecode.c.",
-            "cve": "CVE-2021-25293",
-            "id": "pyup.io-40273",
+            "advisory": "plone.formwidget.contenttree 1.0a3 fixes an issues with the security validator to work properly on add views and other views using namespace traversal.",
+            "cve": "PVE-2021-26008",
+            "id": "pyup.io-26008",
             "specs": [
-                "<8.1.1"
+                "<1.0a3"
             ],
-            "v": "<8.1.1"
-        },
+            "v": "<1.0a3"
+        }
+    ],
+    "plone.memoize": [
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for a BLP container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-40263",
+            "advisory": "Plone.memoize 1.0.3 no longeruses hash when making cache keys. This is to avoid cache collisions, and to avoid a potential security problem where an attacker could manually craft collisions. Also, the use of hash() is no longer recommending in tests.",
+            "cve": "PVE-2021-37107",
+            "id": "pyup.io-37107",
             "specs": [
-                "<8.1.2"
+                "<1.0.3"
             ],
-            "v": "<8.1.2"
-        },
+            "v": "<1.0.3"
+        }
+    ],
+    "plone.mockup": [
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-40268",
+            "advisory": "Plone.mockup before 2.1.3 is vulnerable to a XSS attack in structure and relateditem pattern.\r\nhttps://github.com/plone/mockup/pull/627",
+            "cve": "PVE-2021-26009",
+            "id": "pyup.io-26009",
             "specs": [
-                "<8.1.2"
+                "<2.1.3"
             ],
-            "v": "<8.1.2"
-        },
+            "v": "<2.1.3"
+        }
+    ],
+    "plone.namedfile": [
         {
-            "advisory": "Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICNS container, and thus an attempted memory allocation can be very large.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-40267",
+            "advisory": "Plone.namedfile 5.5.0 prevents stored XSS from file upload (svg, html) by implementing an allowlist of trusted mimetypes.\r\nhttps://github.com/plone/plone.namedfile/commit/37b9b7f29b0f804df622db9502abae28f3eccf38\r\nhttps://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots",
+            "cve": "CVE-2021-33507",
+            "id": "pyup.io-43737",
             "specs": [
-                "<8.1.2"
+                "<5.5.0"
             ],
-            "v": "<8.1.2"
-        },
+            "v": "<5.5.0"
+        }
+    ],
+    "plone.openid": [
         {
-            "advisory": "Pillow version 8.2.0 includes a fix for CVE-2021-28676: For FLI data, FliDecode did not properly check that the block advance was non-zero, potentially leading to an infinite loop on load.\r\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/\r\nhttps://github.com/python-pillow/Pillow/pull/5377\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28676-fix-fli-dos",
-            "cve": "CVE-2021-28676",
-            "id": "pyup.io-40594",
+            "advisory": "plone.openid before 2.0.2 is not using the system number generator, even if it is available.",
+            "cve": "PVE-2021-26010",
+            "id": "pyup.io-26010",
             "specs": [
-                "<8.2.0"
+                "<2.0.2"
             ],
-            "v": "<8.2.0"
-        },
+            "v": "<2.0.2"
+        }
+    ],
+    "plone.portlet.static": [
         {
-            "advisory": "Pillow version 8.2.0 includes a fix for CVE-2021-28678: For BLP data, BlpImagePlugin did not properly check that reads (after jumping to file offsets) returned data. This could lead to a DoS where the decoder could be run a large number of times on empty data.\r\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/\r\nhttps://github.com/python-pillow/Pillow/pull/5377\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28678-fix-blp-dos",
-            "cve": "CVE-2021-28678",
-            "id": "pyup.io-40596",
+            "advisory": "Plone.portlet.static 1.2 starts to ensure that text output is passed through the 'safe-html' transform to protect against malicious text.",
+            "cve": "PVE-2021-40232",
+            "id": "pyup.io-40232",
             "specs": [
-                "<8.2.0"
+                "<1.2"
             ],
-            "v": "<8.2.0"
-        },
+            "v": "<1.2"
+        }
+    ],
+    "plone.recipe.varnish": [
         {
-            "advisory": "Pillow version 8.2.0 includes a fix for CVE-2021-28677: For EPS data, the readline implementation used in EPSImageFile has to deal with any combination of \\r and \\n as line endings. It used an accidentally quadratic method of accumulating lines while looking for a line ending. A malicious EPS file could use this to perform a DoS of Pillow in the open phase, before an image was accepted for opening.\r\nhttps://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MQHA5HAIBOYI3R6HDWCLAGFTIQP767FL/\r\nhttps://github.com/python-pillow/Pillow/pull/5377\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.2.0.html#cve-2021-28677-fix-eps-dos-on-open",
-            "cve": "CVE-2021-28677",
-            "id": "pyup.io-40595",
+            "advisory": "Plone.recipe.varnish 6.0.0b1 updates to Varnish 6.0.6 LTS security release.",
+            "cve": "PVE-2021-37942",
+            "id": "pyup.io-37942",
             "specs": [
-                "<8.2.0"
+                "<6.0.0b1"
             ],
-            "v": "<8.2.0"
-        },
+            "v": "<6.0.0b1"
+        }
+    ],
+    "plone.session": [
         {
-            "advisory": "An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_gray_i.",
-            "cve": "CVE-2021-25288",
-            "id": "pyup.io-40593",
+            "advisory": "Plone.session 3.6.2 hardens the default timeout of session. This solves Plone security internal issue 126 (severity low, non-critical). Also, the session timeout is now the same as in mod_auth_tkt: 2h. This follows the recommendation of the German BSI (federal office for security in the information technology) - see <https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Internetsicherheit/isi_web_server_checkliste_Plone.pdf>.  For existing sites this can be adjusted at <https://HOST/acl_users/session/manage_propertiesForm>. The Plone Security Team follows the BSI and recommends administrators to change the setting in their existing Plone sites.",
+            "cve": "PVE-2021-38207",
+            "id": "pyup.io-38207",
             "specs": [
-                "<8.2.0"
+                "<3.6.2"
             ],
-            "v": "<8.2.0"
-        },
+            "v": "<3.6.2"
+        }
+    ],
+    "plone.supermodel": [
         {
-            "advisory": "An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la.",
-            "cve": "CVE-2021-25287",
-            "id": "pyup.io-40592",
+            "advisory": "Plone.supermodel 1.6.3 no longer resolves entities in the xml parser. It also removes processing instructions. These are both security enhancements.",
+            "cve": "PVE-2021-39141",
+            "id": "pyup.io-39141",
             "specs": [
-                "<8.2.0"
+                "<1.6.3"
             ],
-            "v": "<8.2.0"
-        },
+            "v": "<1.6.3"
+        }
+    ],
+    "plone.z3cform": [
         {
-            "advisory": "Pillow version 8.3.0 includes a fix for CVE-2021-34552: Pillow through 8.2.0 and PIL (also known as Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convert function to trigger a buffer overflow in Convert.c\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.3.0.html#buffer-overflow\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/index.html",
-            "cve": "CVE-2021-34552",
-            "id": "pyup.io-40965",
+            "advisory": "Plone.z3cform 0.5.9 fixes a security problem with the ++widget++ namespace [optilude].",
+            "cve": "PVE-2021-37035",
+            "id": "pyup.io-37035",
             "specs": [
-                "<8.3.0"
+                "<0.5.9"
             ],
-            "v": "<8.3.0"
-        },
+            "v": "<0.5.9"
+        }
+    ],
+    "plotly": [
         {
-            "advisory": "In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files. See: CVE-2020-11538. Note that this is a different issue than CVE-2020-5311.",
-            "cve": "CVE-2020-11538",
-            "id": "pyup.io-38452",
+            "advisory": "Plotly 1.12.6 includes Plotly.js v1.16.2, which fixes a potential XSS vulnerability in 'text' fields.\r\nhttps://github.com/plotly/plotly.js/pull/736\r\nhttps://plotly.com/chart-studio-help/security-advisories/2016-08-08-plotlyjs-xss-advisory/",
+            "cve": "CVE-2017-1000006",
+            "id": "pyup.io-37053",
             "specs": [
-                "<=7.0.0"
+                "<1.12.6"
             ],
-            "v": "<=7.0.0"
+            "v": "<1.12.6"
         },
         {
-            "advisory": "There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer. See: CVE-2019-19911.",
-            "cve": "CVE-2019-19911",
-            "id": "pyup.io-37772",
+            "advisory": "Plotly 1.5.1 updates insecure dev dependencies `ecstatic` and `uglify-js`.",
+            "cve": "PVE-2021-38545",
+            "id": "pyup.io-38545",
             "specs": [
-                ">6.0,<6.2.2"
+                "<1.5.1"
             ],
-            "v": ">6.0,<6.2.2"
+            "v": "<1.5.1"
         },
         {
-            "advisory": "The package pillow from 5.2.0 and before 8.3.2 is vulnerable to Regular Expression Denial of Service (ReDoS) via the getrgb function.\r\nhttps://github.com/python-pillow/Pillow/commit/9e08eb8f78fdfd2f476e1b20b7cf38683754866b\r\nhttps://pillow.readthedocs.io/en/stable/releasenotes/8.3.2.html",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-41271",
+            "advisory": "Plotly 1.54.4 bumps `ecstatic`, `gl-selet-static`, `gl-plot2d` & `gl-plot3d` and drops `cwise` to simplify build process & address security warnings [4929, 4930, 4934].",
+            "cve": "PVE-2021-38454",
+            "id": "pyup.io-38454",
             "specs": [
-                ">=5.2.0,<8.3.2"
+                "<1.54.4"
             ],
-            "v": ">=5.2.0,<8.3.2"
+            "v": "<1.54.4"
         },
         {
-            "advisory": "Pillow 8.3.2 fixes a 6-byte out-of-bounds (OOB) read. The previous bounds check in FliDecode.c incorrectly calculated the required read buffer size when copying a chunk, potentially reading six extra bytes off the end of the allocated buffer from the heap. Present since Pillow 7.1.0.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-41277",
+            "advisory": "Plotly 2.0.7 includes Plotly.js 1.25.0, which contains a fix for an XSS vulnerability in a trace name on hover.\r\nhttps://github.com/plotly/plotly.js/pull/1307",
+            "cve": "PVE-2021-37052",
+            "id": "pyup.io-37052",
             "specs": [
-                ">=7.1.0,<8.3.2"
+                "<2.0.7"
             ],
-            "v": ">=7.1.0,<8.3.2"
+            "v": "<2.0.7"
         }
     ],
-    "pillow-simd": [
+    "plugwise": [
         {
-            "advisory": "pillow-simd before 2.3.2 is vulnerable to CVE-2014-3589, a DOS in the IcnsImagePlugin.",
-            "cve": "CVE-2014-3589",
-            "id": "pyup.io-39579",
+            "advisory": "Plugwise 0.8.2 improves the security by switching from lxml to defusedxml.",
+            "cve": "PVE-2021-39026",
+            "id": "pyup.io-39026",
             "specs": [
-                "<2.3.2"
+                "<0.8.2"
             ],
-            "v": "<2.3.2"
-        },
+            "v": "<0.8.2"
+        }
+    ],
+    "plumi.app": [
         {
-            "advisory": "pillow-simd before 2.3.2 is vulnerable to CVE-2014-3598, a DOS in the Jpeg2KImagePlugin.",
-            "cve": "CVE-2014-3598",
-            "id": "pyup.io-25947",
+            "advisory": "plumi.app 4.2 includes a security hotfix related to  LinguaPlone & plone.app.discussion.",
+            "cve": "PVE-2021-26011",
+            "id": "pyup.io-26011",
             "specs": [
-                "<2.3.2"
+                "<4.2"
             ],
-            "v": "<2.3.2"
+            "v": "<4.2"
         },
         {
-            "advisory": "Pillow-simd 2.5.0 includes changes to prevent shell injection. This is related to CVE-2014-1932.\r\nhttps://github.com/uploadcare/pillow-simd/commit/cd7b45994b1b1a016a29401d7ab3faf9b7c7d054",
-            "cve": "PVE-2021-43447",
-            "id": "pyup.io-43447",
+            "advisory": "Plumi.app 4.2.1 updates its dependency 'plone' to v4.0.7 to include security fixes.",
+            "cve": "CVE-2011-1948",
+            "id": "pyup.io-26012",
             "specs": [
-                "<2.5.0"
+                "<4.2.1"
             ],
-            "v": "<2.5.0"
+            "v": "<4.2.1"
         },
         {
-            "advisory": "pillow-simd before 2.5.2 is vulnerable to CVE-2014-3598.",
-            "cve": "CVE-2014-3598",
-            "id": "pyup.io-25948",
+            "advisory": "Plumi.app 4.2.1 updates its dependency 'plone' to v4.0.7 to include security fixes.",
+            "cve": "CVE-2011-1950",
+            "id": "pyup.io-44593",
             "specs": [
-                "<2.5.2"
+                "<4.2.1"
             ],
-            "v": "<2.5.2"
+            "v": "<4.2.1"
         },
         {
-            "advisory": "pillow-simd before 2.5.2 is vulnerable to CVE-2014-3589, a DOS in the IcnsImagePlugin.",
-            "cve": "CVE-2014-3589",
-            "id": "pyup.io-39578",
+            "advisory": "Plumi.app 4.2.1 updates its dependency 'plone' to v4.0.7 to include security fixes.",
+            "cve": "CVE-2011-1949",
+            "id": "pyup.io-44594",
             "specs": [
-                "<2.5.2"
+                "<4.2.1"
             ],
-            "v": "<2.5.2"
+            "v": "<4.2.1"
         },
         {
-            "advisory": "Pillow-simd before 2.5.3 is vulnerable to CVE-2014-3598.",
-            "cve": "CVE-2014-3598",
-            "id": "pyup.io-25949",
+            "advisory": "Plumi.app 4.2.2 patches a serious security vulnerability affecting its dependency 'Zope'.\r\nhttps://plone.org/security/hotfix/20110622/privilege-escalation",
+            "cve": "CVE-2011-2528",
+            "id": "pyup.io-26013",
             "specs": [
-                "<2.5.3"
+                "<4.2.2"
             ],
-            "v": "<2.5.3"
-        },
+            "v": "<4.2.2"
+        }
+    ],
+    "plumpy": [
         {
-            "advisory": "pillow-simd before 2.5.3 is vulnerable to CVE-2014-3589, a DOS in the IcnsImagePlugin.",
-            "cve": "CVE-2014-3589",
-            "id": "pyup.io-39577",
+            "advisory": "Plumpy 0.20.0 updates its dependency \"Pyyaml\" to a secure version (>=5.4).",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-41835",
             "specs": [
-                "<2.5.3"
+                "<0.20.0"
             ],
-            "v": "<2.5.3"
-        },
+            "v": "<0.20.0"
+        }
+    ],
+    "plusminus": [
         {
-            "advisory": "pillow-simd before 2.6.0rc1 is vulnerable to CVE-2014-3589, a DOS in the IcnsImagePlugin.",
-            "cve": "CVE-2014-3589",
-            "id": "pyup.io-39576",
+            "advisory": "Plusminus 0.3.0 has been hardened against some possible attacks, using deep expression nesting or formula references.",
+            "cve": "PVE-2021-38323",
+            "id": "pyup.io-38323",
             "specs": [
-                "<2.6.0rc1"
+                "<0.3.0"
             ],
-            "v": "<2.6.0rc1"
-        },
+            "v": "<0.3.0"
+        }
+    ],
+    "pm4py": [
         {
-            "advisory": "Pillow-simd before 2.6.0rc1 is vulnerable to CVE-2014-3598.",
-            "cve": "CVE-2014-3598",
-            "id": "pyup.io-25950",
+            "advisory": "Pm4py 2.2.13.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-43358",
             "specs": [
-                "<2.6.0rc1"
+                "<2.2.13.1"
             ],
-            "v": "<2.6.0rc1"
+            "v": "<2.2.13.1"
         },
         {
-            "advisory": "pillow-simd before 2.6.2 is vulnerable to a PNG decompression DoS (CVE-2014-9601).",
-            "cve": "CVE-2014-9601",
-            "id": "pyup.io-25951",
+            "advisory": "Pm4py 2.2.13.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-42161",
             "specs": [
-                "<2.6.2"
+                "<2.2.13.1"
             ],
-            "v": "<2.6.2"
+            "v": "<2.2.13.1"
         },
         {
-            "advisory": "pillow-simd before 2.7.0 is vulnerable to a PNG decompression DoS (CVE-2014-9601).",
-            "cve": "CVE-2014-9601",
-            "id": "pyup.io-25952",
+            "advisory": "Pm4py 2.2.17.1 includes a fix for a command injection vulnerability in Data Petri Nets.\r\nhttps://github.com/pm4py/pm4py-core/commit/512c071e4990cb2f2fda523e223007256c0ec62e",
+            "cve": "PVE-2021-43434",
+            "id": "pyup.io-43434",
             "specs": [
-                "<2.7.0"
+                "<2.2.17.1"
             ],
-            "v": "<2.7.0"
+            "v": "<2.2.17.1"
         },
         {
-            "advisory": "Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a denial of service (crash) via a crafted FLI file.",
-            "cve": "CVE-2016-0775",
-            "id": "pyup.io-42330",
+            "advisory": "Pm4py 2.2.4 updates its dependency 'lxml' to v4.6.3 to include a security fix.",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-42160",
             "specs": [
-                "<3.1.1"
+                "<2.2.4"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<2.2.4"
+        }
+    ],
+    "pmr2.oauth": [
         {
-            "advisory": "Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier allows remote attackers to cause a denial of service (crash) via a crafted PhotoCD file.",
-            "cve": "CVE-2016-2533",
-            "id": "pyup.io-42329",
+            "advisory": "pmr2.oauth before 0.4.2 is vulnerable to CSRF attacks.",
+            "cve": "PVE-2021-26014",
+            "id": "pyup.io-26014",
             "specs": [
-                "<3.1.1"
+                "<0.4.2"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<0.4.2"
+        }
+    ],
+    "podder-task-base": [
         {
-            "advisory": "Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to overwrite memory via a crafted TIFF file.",
-            "cve": "CVE-2016-0740",
-            "id": "pyup.io-42331",
+            "advisory": "podder-task-base 0.4.0 changes: Update version of SQLAlchemy, Jinja for security reason",
+            "cve": "PVE-2021-37260",
+            "id": "pyup.io-37260",
             "specs": [
-                "<3.1.1"
+                "<0.4.0"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<0.4.0"
+        }
+    ],
+    "pokedex.py": [
         {
-            "advisory": "pillow-simd before 3.1.1 is vulnerable to multiple buffer overlows in Resample.c, PcdDecode.c, FliDecode.c and TiffDecode.c.",
-            "cve": "PVE-2021-25953",
-            "id": "pyup.io-25953",
+            "advisory": "Pokedex.py 1.1.2 updates 'requests' package to version >=2.20.0 to fix an information exposure vulnerability.",
+            "cve": "CVE-2018-18074",
+            "id": "pyup.io-36593",
             "specs": [
-                "<3.1.1"
+                "<1.1.2"
             ],
-            "v": "<3.1.1"
-        },
+            "v": "<1.1.2"
+        }
+    ],
+    "pollbot": [
         {
-            "advisory": "pillow-simd before 3.1.2 is vulnerable to an integer overflow in Jpeg2KEncode.c causing a buffer overflow. CVE-2016-3076.",
-            "cve": "CVE-2016-3076",
-            "id": "pyup.io-25954",
+            "advisory": "Pollbot is open source software which \"frees its human masters from the toilsome task of polling for the state of things during the Firefox release process.\" In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of \"https://pollbot.services.mozilla.com/\". An attacker can redirect anyone to malicious sites. To Reproduce type in this URL: \"https://pollbot.services.mozilla.com//evil.com/\". Affected versions will redirect to that website when you inject a payload like \"//evil.com/\". This is fixed in version 1.4.4.",
+            "cve": "CVE-2021-21354",
+            "id": "pyup.io-42300",
             "specs": [
-                "<3.1.2"
+                "<1.4.4"
             ],
-            "v": "<3.1.2"
+            "v": "<1.4.4"
         }
     ],
-    "pim-dm": [
+    "polyaxon": [
         {
-            "advisory": "pim-dm 1.0 includes dissertation work and an unspecified security implementation",
-            "cve": "PVE-2021-37857",
-            "id": "pyup.io-37857",
+            "advisory": "Polyaxon 0.4.1 updates dependencies exposing security vulnerabilities.",
+            "cve": "PVE-2021-38029",
+            "id": "pyup.io-38029",
             "specs": [
-                "<1.0"
+                "<0.4.1"
             ],
-            "v": "<1.0"
-        }
-    ],
-    "pims": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Pims 0.5 and prior uses 'loci_tools.jar', which is affected by critical and severe vulnerabilities.\r\nhttps://github.com/soft-matter/pims/issues/400",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43595",
+            "advisory": "Polyaxon 0.4.3 update some packages that have some security and deprecation problems.",
+            "cve": "PVE-2021-38028",
+            "id": "pyup.io-38028",
             "specs": [
-                "<=0.5"
+                "<0.4.3"
             ],
-            "v": "<=0.5"
+            "v": "<0.4.3"
         },
         {
-            "advisory": "Pims 0.5 and prior uses 'loci_tools.jar', which is affected by critical and severe vulnerabilities.\r\nhttps://github.com/soft-matter/pims/issues/400",
-            "cve": "CVE-2021-45105",
-            "id": "pyup.io-43596",
+            "advisory": "Polyaxon 0.5.1 updates lodash: vulnerability issue.",
+            "cve": "PVE-2021-38025",
+            "id": "pyup.io-38025",
             "specs": [
-                "<=0.5"
+                "<0.5.1"
             ],
-            "v": "<=0.5"
+            "v": "<0.5.1"
+        },
+        {
+            "advisory": "Polyaxon 0.5.5 updates dependencies with security release.",
+            "cve": "PVE-2021-38023",
+            "id": "pyup.io-38023",
+            "specs": [
+                "<0.5.5"
+            ],
+            "v": "<0.5.5"
         },
         {
-            "advisory": "Pims 0.5 and prior uses 'loci_tools.jar', which is affected by critical and severe vulnerabilities.\r\nhttps://github.com/soft-matter/pims/issues/400",
-            "cve": "CVE-2021-44228",
-            "id": "pyup.io-43594",
+            "advisory": "Polyaxon 0.6.0 fixes some unspecified security issues.",
+            "cve": "PVE-2021-38022",
+            "id": "pyup.io-38022",
             "specs": [
-                "<=0.5"
+                "<0.6.0"
             ],
-            "v": "<=0.5"
+            "v": "<0.6.0"
         }
     ],
-    "pinax-likes": [
+    "polyswarm-client": [
         {
-            "advisory": "pinax-likes before 0.3 allows users to like anything and everything, which could potentially lead to security problems (eg. liking entries in permission tables, and thus seeing their content; liking administrative users and thus getting their username).",
-            "cve": "PVE-2021-25955",
-            "id": "pyup.io-25955",
+            "advisory": "Polyswarm-client 2.11.7 updates its dependency 'aiohttp' to v3.7.4 to include a security fix.",
+            "cve": "CVE-2021-21330",
+            "id": "pyup.io-40126",
             "specs": [
-                "<0.3"
+                "<2.11.7"
             ],
-            "v": "<0.3"
+            "v": "<2.11.7"
         }
     ],
-    "pip": [
+    "poorwsgi": [
         {
-            "advisory": "pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response to a \"pip install\" operation.",
-            "cve": "CVE-2013-1629",
-            "id": "pyup.io-33140",
+            "advisory": "poorwsgi 1.0.2 includes several security related enhancements related to secret key generation.",
+            "cve": "PVE-2021-26015",
+            "id": "pyup.io-26015",
             "specs": [
-                "<1.3"
+                "<1.0.2"
             ],
-            "v": "<1.3"
-        },
+            "v": "<1.0.2"
+        }
+    ],
+    "pootle": [
         {
-            "advisory": "pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.",
-            "cve": "CVE-2013-1888",
-            "id": "pyup.io-33141",
+            "advisory": "pootle before 2.8.0rc5 is vulnerable to several undisclosed security vulnerabilites.",
+            "cve": "PVE-2021-34211",
+            "id": "pyup.io-34211",
             "specs": [
-                "<1.3"
+                "<2.8.0rc5"
             ],
-            "v": "<1.3"
+            "v": "<2.8.0rc5"
         },
         {
-            "advisory": "pip 1.4 includes a security patch to pip's ssl support related to certificate DNS wildcard matching.",
-            "cve": "PVE-2021-25959",
-            "id": "pyup.io-25959",
+            "advisory": "pootle before 2.8.0rc6 has multiple, undisclosed, security vulnerabilites that were found during an audit.",
+            "cve": "PVE-2021-34790",
+            "id": "pyup.io-34790",
             "specs": [
-                "<1.4"
+                "<2.8.0rc6"
             ],
-            "v": "<1.4"
+            "v": "<2.8.0rc6"
         },
         {
-            "advisory": "The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks. See CVE-2013-5123.",
-            "cve": "CVE-2013-5123",
-            "id": "pyup.io-37752",
+            "advisory": "Pootle 2.7.x before 2.7.3 is affected by several XSS vulnerabilities.\r\nhttps://github.com/translate/pootle/commit/d36f91a9a3c022251d927a439a7566e57127367f\r\nhttps://github.com/translate/pootle/commit/82e6cb6c9b9468090d0b0cee81e706ee175d1e36\r\nhttps://github.com/translate/pootle/commit/7d5a80c3fdd9cf70ccb7a6966e964566c0f764ff",
+            "cve": "PVE-2021-34201",
+            "id": "pyup.io-34201",
             "specs": [
-                "<1.5"
+                ">=2.7.0,<2.7.3"
             ],
-            "v": "<1.5"
+            "v": ">=2.7.0,<2.7.3"
         },
         {
-            "advisory": "The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/authorized_keys file. This occurs in _download_http_url in _internal/download.py.",
-            "cve": "CVE-2019-20916",
-            "id": "pyup.io-38765",
+            "advisory": "Pootle 2.7.3 prevents the leak of user data.\r\nhttps://github.com/translate/pootle/commit/07839d4abe1663f890e28a6b2cc28b59148b184b",
+            "cve": "PVE-2021-42747",
+            "id": "pyup.io-42747",
             "specs": [
-                "<19.2"
+                ">=2.7.0,<2.7.3"
             ],
-            "v": "<19.2"
-        },
+            "v": ">=2.7.0,<2.7.3"
+        }
+    ],
+    "portray": [
         {
-            "advisory": "Pip version 21.1 stops splitting on unicode separators in git references, which could be maliciously used to install a different revision on the repository. \r\nhttps://github.com/pypa/pip/issues/9827",
-            "cve": "PVE-2021-42218",
-            "id": "pyup.io-42218",
+            "advisory": "Portray 1.6.0 updates the minimum version of the 'mkdocs-material' to 7.0.0 to address a security concerns in earlier versions.",
+            "cve": "PVE-2021-40138",
+            "id": "pyup.io-40138",
             "specs": [
-                "<21.1"
+                "<1.6.0"
             ],
-            "v": "<21.1"
-        },
+            "v": "<1.6.0"
+        }
+    ],
+    "postfix-mta-sts-resolver": [
         {
-            "advisory": "The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.",
-            "cve": "CVE-2021-28363",
-            "id": "pyup.io-40291",
+            "advisory": "In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.",
+            "cve": "CVE-2019-16791",
+            "id": "pyup.io-42264",
             "specs": [
-                "<21.1"
+                "<0.5.1"
             ],
-            "v": "<21.1"
+            "v": "<0.5.1"
         },
         {
-            "advisory": "Pip version 21.1 includes a fix for CVE-2021-3572: A flaw was found in python-pip in the way it handled Unicode separators in git references. A remote attacker could possibly use this issue to install a different revision on a repository. The highest threat from this vulnerability is to data integrity.\r\nhttps://bugzilla.redhat.com/show_bug.cgi?id=1962856",
-            "cve": "CVE-2021-3572",
-            "id": "pyup.io-42559",
+            "advisory": "Postfix-mta-sts-resolver 0.6.1 hardens the container security.",
+            "cve": "PVE-2021-37461",
+            "id": "pyup.io-37461",
             "specs": [
-                "<21.1"
+                "<0.6.1"
             ],
-            "v": "<21.1"
-        },
+            "v": "<0.6.1"
+        }
+    ],
+    "postorius": [
         {
-            "advisory": "pip before 6.0 is not using a randomized and secure default build directory when possible. (CVE-2014-8991).",
-            "cve": "CVE-2014-8991",
-            "id": "pyup.io-25960",
+            "advisory": "An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.",
+            "cve": "CVE-2021-40347",
+            "id": "pyup.io-42321",
             "specs": [
-                "<6.0"
+                "<1.3.5"
             ],
-            "v": "<6.0"
-        },
+            "v": "<1.3.5"
+        }
+    ],
+    "posty": [
         {
-            "advisory": "The resolve_redirects function in sessions.py in requests 2.1.0 through 2.5.3 allows remote attackers to conduct session fixation attacks via a cookie without a host value in a redirect.",
-            "cve": "CVE-2015-2296",
-            "id": "pyup.io-42324",
+            "advisory": "Posty version 2.1.0 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/nickpegg/posty/commit/d2f3fbd15cc685c425aaa3edc4a113c4218674ef",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41365",
             "specs": [
-                "<6.1.0"
+                "<2.1.0"
             ],
-            "v": "<6.1.0"
-        },
+            "v": "<2.1.0"
+        }
+    ],
+    "ppgan": [
         {
-            "advisory": "pip before 6.1.0 bundles a request release with a known security vulnerability. See  CVE-2015-2296.",
-            "cve": "CVE-2014-8991",
-            "id": "pyup.io-25961",
+            "advisory": "Ppgan version 0.1.3 includes a security patch for the function 'init' in 'ppgan/apps/first_order_predictor.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/PaddlePaddle/PaddleGAN/commit/b4f066016ba664b84a55d7894e554db771995187#diff-ea93fd79db0cbeaf277ce407386f1a8a5b7446fd0955294d922165b739eb2e52",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41366",
             "specs": [
-                "<6.1.0"
+                "<0.1.3"
             ],
-            "v": "<6.1.0"
+            "v": "<0.1.3"
         }
     ],
-    "pipenv": [
+    "pre-commit": [
         {
-            "advisory": "Pipenv 2020.5.28 includes the --key command to include a personal PyUp API token when running `pipenv check`. This version also updates several dependencies to their latest versions for security and bug fixes.",
-            "cve": "PVE-2021-38334",
-            "id": "pyup.io-38334",
+            "advisory": "Pre-commit 1.10.4 replaces 'yaml.load' with safe alternative to avoid a remote code execution vulnerability.\r\nhttps://github.com/pre-commit/pre-commit/commit/6853f4aa4c8d7e411839bacc66876baea443186a",
+            "cve": "CVE-2017-18342",
+            "id": "pyup.io-42949",
             "specs": [
-                "<2020.5.28"
+                "<1.10.4"
             ],
-            "v": "<2020.5.28"
+            "v": "<1.10.4"
         }
     ],
-    "pipenv-setup": [
+    "predictionio": [
         {
-            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'lxml' to v4.6.3 to include a security fix.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-42761",
+            "advisory": "Predictionio 0.12.1 updates dependencies to include security fixes.",
+            "cve": "PVE-2021-41882",
+            "id": "pyup.io-41882",
             "specs": [
-                "<3.1.4"
+                "<0.12.1"
             ],
-            "v": "<3.1.4"
-        },
+            "v": "<0.12.1"
+        }
+    ],
+    "prefect": [
         {
-            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'sqlalchemy' to v1.3.0 to include a security fix.",
-            "cve": "CVE-2019-7164",
-            "id": "pyup.io-42742",
+            "advisory": "Prefect 0.12.6 removes password from Postgres tasks' initialization methods for security.",
+            "cve": "PVE-2021-38663",
+            "id": "pyup.io-38663",
             "specs": [
-                "<3.1.4"
+                "<0.12.6"
             ],
-            "v": "<3.1.4"
+            "v": "<0.12.6"
         },
         {
-            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'sqlalchemy' to v1.3.0 to include a security fix.",
-            "cve": "CVE-2020-27783",
-            "id": "pyup.io-42762",
+            "advisory": "Prefect 0.15.8 includes a version of Prefect UI which updates a dependency (npm:graphiql) to include a security fix.",
+            "cve": "CVE-2021-41248",
+            "id": "pyup.io-42952",
             "specs": [
-                "<3.1.4"
+                "<0.15.8"
             ],
-            "v": "<3.1.4"
+            "v": "<0.15.8"
         },
         {
-            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'sqlalchemy' to v1.3.0 to include a security fix.",
-            "cve": "CVE-2018-19787",
-            "id": "pyup.io-42763",
+            "advisory": "Prefect 0.15.8 includes a Prefect Server update that bumps an upstream dependency to fix a security vulnerability. See CVE-2021-41249.",
+            "cve": "CVE-2021-41249",
+            "id": "pyup.io-42552",
             "specs": [
-                "<3.1.4"
+                "<0.15.8"
             ],
-            "v": "<3.1.4"
+            "v": "<0.15.8"
         },
         {
-            "advisory": "Pipenv-setup 3.1.4 updates its dependency 'sqlalchemy' to v1.3.0 to include a security fix.",
-            "cve": "CVE-2019-7548",
-            "id": "pyup.io-42760",
+            "advisory": "Prefect 0.5.1 bumps `distributed` to 1.26.1 for enhanced security features - [878].",
+            "cve": "PVE-2021-37020",
+            "id": "pyup.io-37020",
             "specs": [
-                "<3.1.4"
+                "<0.5.1"
             ],
-            "v": "<3.1.4"
+            "v": "<0.5.1"
         }
     ],
-    "pirate-get": [
+    "press": [
         {
-            "advisory": "pirate-get before 0.2.8 is not properly validating torrent file names.\r\n\r\n- https://github.com/vikstrous/pirate-get/issues/73",
-            "cve": "PVE-2021-34168",
-            "id": "pyup.io-34168",
+            "advisory": "Press version 0.5.8 includes a security patch for the function 'configuration_from_yaml' in 'press/configuration/util.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/jr0d/press/commit/c641f54ed39d1c3a335cd967954760ede9454052#diff-482d133cd7fc1e6dde3facc3af875192a5f8397fa3054ff21956c05e1138f26f",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41367",
             "specs": [
-                "<0.2.8"
+                "<0.5.8"
             ],
-            "v": "<0.2.8"
+            "v": "<0.5.8"
         }
     ],
-    "pirxcypinger": [
+    "pretaweb.healthcheck": [
         {
-            "advisory": "Pirxcypinger 3.2 includes a fix for preventing abuse of URLs.",
-            "cve": "PVE-2021-42378",
-            "id": "pyup.io-42378",
+            "advisory": "pretaweb.healthcheck before 1.0 is vulnerable to DoS attacks.",
+            "cve": "PVE-2021-26016",
+            "id": "pyup.io-26016",
             "specs": [
-                "<3.2"
+                "<1.0"
             ],
-            "v": "<3.2"
+            "v": "<1.0"
         }
     ],
-    "pkgcore": [
+    "priority": [
         {
-            "advisory": "pkgcore 0.4.7.12 includes a security fix; force cwd to something controlled for ebuild env.  This blocks an attack detailed in glsa 200810-02; namely that an ebuild invoking python -c (which looks in cwd for modules to load) allows for an attacker to slip something in.",
-            "cve": "PVE-2021-25962",
-            "id": "pyup.io-25962",
+            "advisory": "A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.",
+            "cve": "CVE-2016-6580",
+            "id": "pyup.io-42335",
             "specs": [
-                "<0.4.7.12"
+                "<1.2.0"
             ],
-            "v": "<0.4.7.12"
-        }
-    ],
-    "platformio": [
+            "v": "<1.2.0"
+        },
         {
-            "advisory": "platformio 4.1.0 fixes a security issue when extracting items from TAR archive - see https://github.com/platformio/platformio-core/issues/2995",
-            "cve": "PVE-2021-37869",
-            "id": "pyup.io-37869",
+            "advisory": "priority before 1.2.0 is vulnerable to a denial of service attack whereby a remote peer can cause a user to insert an unbounded number of streams into the priority tree, eventually consuming all available memory.",
+            "cve": "PVE-2021-26017",
+            "id": "pyup.io-26017",
             "specs": [
-                "<4.1.0"
+                "<1.2.0"
             ],
-            "v": "<4.1.0"
+            "v": "<1.2.0"
         }
     ],
-    "plex-mpv-shim": [
+    "prisma-cloud-pipeline": [
         {
-            "advisory": "Plex-mpv-shim 1.10.01 upgrades to a newer MPV build for security reasons.",
-            "cve": "PVE-2021-42829",
-            "id": "pyup.io-42829",
+            "advisory": "Prisma-cloud-pipeline 0.1.3 updates pyyaml to v5.4.1 to include a security fix.",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-39686",
             "specs": [
-                "<1.10.01"
+                "<0.1.3"
             ],
-            "v": "<1.10.01"
+            "v": "<0.1.3"
         }
     ],
-    "plomino": [
+    "privacyidea": [
         {
-            "advisory": "plomino before 1.18 has a major vulnerability in open_url (now, targeted sources must be declared safe from an local package).",
-            "cve": "PVE-2021-25963",
-            "id": "pyup.io-25963",
+            "advisory": "Privacyidea 3.4.1 uses a secure way to compare strings to avoid theoretical side channel attacks.",
+            "cve": "PVE-2021-39341",
+            "id": "pyup.io-39341",
             "specs": [
-                "<1.18"
+                "<3.4.1"
             ],
-            "v": "<1.18"
+            "v": "<3.4.1"
         },
         {
-            "advisory": "plomino 1.5.3 includes a security fix: when a group has PlominoAuthors rights, members of this group are just authors on their own documents.",
-            "cve": "PVE-2021-25964",
-            "id": "pyup.io-25964",
+            "advisory": "Privacyidea 3.6 includes more secure configuration defaults.",
+            "cve": "PVE-2021-40970",
+            "id": "pyup.io-40970",
             "specs": [
-                "<1.5.3"
+                "<3.6"
             ],
-            "v": "<1.5.3"
+            "v": "<3.6"
         }
     ],
-    "plone": [
+    "products-btreefolder2": [
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in skins/plone_templates/default_error_message.pt in Plone before 2.5.3 allows remote attackers to inject arbitrary web script or HTML via the type_name parameter to Members/ipa/createObject.",
-            "cve": "CVE-2011-1340",
-            "id": "pyup.io-25966",
+            "advisory": "Products-btreefolder2 version 2.13.4 includes a security declaration for 'BTreeFolder2Base.hasObject' method.",
+            "cve": "PVE-2021-42029",
+            "id": "pyup.io-42029",
             "specs": [
-                "<2.5.3"
+                "<2.13.4"
             ],
-            "v": "<2.5.3"
-        },
+            "v": "<2.13.4"
+        }
+    ],
+    "products-cmfcore": [
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in PortalTransforms in Plone 2.1 through 3.3.4 before hotfix 20100612 allows remote attackers to inject arbitrary web script or HTML via the safe_html transform.",
-            "cve": "CVE-2010-2422",
-            "id": "pyup.io-25967",
+            "advisory": "Products-cmfcore 2.1.0beta2 adds POST-only protections to security critical methods. See: CVE-2007-0240.",
+            "cve": "CVE-2007-0240",
+            "id": "pyup.io-36125",
             "specs": [
-                "<3.3.4"
+                "<2.1.0beta2"
             ],
-            "v": "<3.3.4"
-        },
+            "v": "<2.1.0beta2"
+        }
+    ],
+    "products-ploneformgen": [
         {
-            "advisory": "kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.",
-            "cve": "CVE-2012-5496",
-            "id": "pyup.io-33143",
+            "advisory": "Products-ploneformgen 1.7.19 and 1.8.1 include a fix for a XSS vulnerability that could be exploited by users with the ability to create forms.\r\nhttps://github.com/smcmahon/Products.PloneFormGen/commit/b9590e5573660ee6b8d151430ca2b459f05388ca",
+            "cve": "PVE-2021-35878",
+            "id": "pyup.io-35878",
             "specs": [
-                "<4.0"
+                "<1.8.1"
             ],
-            "v": "<4.0"
-        },
+            "v": "<1.8.1"
+        }
+    ],
+    "products-plonepas": [
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in Plone 4.1 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted URL.",
-            "cve": "CVE-2011-1948",
-            "id": "pyup.io-25972",
+            "advisory": "Products-plonepas 3.9 fixes the cookie plugin's login handler to not trust the username from the request. Instead, now it's used the login name of the currently authenticated user. This fixes CVE-2009-0662.",
+            "cve": "CVE-2009-0662",
+            "id": "pyup.io-35982",
             "specs": [
-                "<4.1"
+                "<3.9"
             ],
-            "v": "<4.1"
-        },
+            "v": "<3.9"
+        }
+    ],
+    "products-zopetree": [
         {
-            "advisory": "Plone 4.1.3 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.",
-            "cve": "CVE-2011-4462",
-            "id": "pyup.io-25973",
+            "advisory": "Products-zopetree 1.3 fixes a security hole in the tree state decompressing mechanism. Previous versions were vulnerable to a denial of service attack using large tree states.",
+            "cve": "PVE-2021-37726",
+            "id": "pyup.io-37726",
             "specs": [
-                "<4.1.3"
+                "<1.3"
             ],
-            "v": "<4.1.3"
-        },
+            "v": "<1.3"
+        }
+    ],
+    "products.cmfcontentpanels": [
         {
-            "advisory": "plone.app.users in Plone 4.0 and 4.1 allows remote authenticated users to modify the properties of arbitrary accounts via unspecified vectors, as exploited in the wild in June 2011.",
-            "cve": "CVE-2011-1950",
-            "id": "pyup.io-25974",
+            "advisory": "products.cmfcontentpanels before 1.4.1 has two not disclosed security issues.",
+            "cve": "PVE-2021-26020",
+            "id": "pyup.io-26020",
             "specs": [
-                "<4.2"
+                "<1.4.1"
             ],
-            "v": "<4.2"
-        },
+            "v": "<1.4.1"
+        }
+    ],
+    "products.cmfcore": [
         {
-            "advisory": "ftp.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read hidden folder contents via unspecified vectors.",
-            "cve": "CVE-2012-5503",
-            "id": "pyup.io-25999",
+            "advisory": "Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request. See: CVE-2007-0240.",
+            "cve": "CVE-2007-0240",
+            "id": "pyup.io-35820",
             "specs": [
-                "<4.2.3",
-                "<4.3b1"
+                "<2.1.0beta2"
             ],
-            "v": "<4.2.3,<4.3b1"
+            "v": "<2.1.0beta2"
         },
         {
-            "advisory": "Plone versions 4.2.3 and 4.3b1 include a fix for CVE-2012-6661, a vulnerability in its dependency \"zope\".",
-            "cve": "CVE-2012-6661",
-            "id": "pyup.io-42186",
+            "advisory": "Products.cmfcore 2.3.0beta tightens the security for anonymous test user.",
+            "cve": "PVE-2021-35818",
+            "id": "pyup.io-35818",
             "specs": [
-                "<4.2.3",
-                ">=4.3a1,<4.3b1"
+                "<2.3.0beta"
             ],
-            "v": "<4.2.3,>=4.3a1,<4.3b1"
-        },
+            "v": "<2.3.0beta"
+        }
+    ],
+    "products.cmfplone": [
         {
-            "advisory": "Plone versions 4.2.3 and 4.3b1 include a fix for CVE-2012-5508: The error pages in Plone before 4.2.3 and 4.3 before beta 1 allow remote attackers to obtain random numbers and derive the PRNG state for password resets via unspecified vectors.  NOTE: this identifier was SPLIT per ADT2 due to different vulnerability types. CVE-2012-6661 was assigned for the PRNG reseeding issue in Zope.\r\nhttp://www.openwall.com/lists/oss-security/2012/11/10/1\r\nhttps://bugs.launchpad.net/zope2/+bug/1071067\r\nhttps://github.com/plone/Products.CMFPlone/blob/4.2.3/docs/CHANGES.txt\r\nhttps://plone.org/products/plone-hotfix/releases/20121124\r\nhttps://plone.org/products/plone/security/advisories/20121106/24",
-            "cve": "CVE-2012-5508",
-            "id": "pyup.io-35398",
+            "advisory": "Products.cmfplone versions 4.3.20, 5.1.7, 5.2.5 and 6.0.0a1.dev0 integrate a fix for CVE-2020-7936: An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.",
+            "cve": "CVE-2020-7936",
+            "id": "pyup.io-41842",
             "specs": [
-                "<4.2.3",
-                ">=4.3a1,<4.3b1"
+                "<4.3.20",
+                ">4.3.20,<5.1.7",
+                ">5.1.7,<5.2.5",
+                ">5.2.5,<6.0.0a1.dev0"
             ],
-            "v": "<4.2.3,>=4.3a1,<4.3b1"
+            "v": "<4.3.20,>4.3.20,<5.1.7,>5.1.7,<5.2.5,>5.2.5,<6.0.0a1.dev0"
         },
         {
-            "advisory": "ZPublisher.HTTPRequest._scrubHeader in Zope 2 before 2.13.19, as used in Plone before 4.3 beta 1, allows remote attackers to inject arbitrary HTTP headers via a linefeed (LF) character.",
-            "cve": "CVE-2012-5486",
-            "id": "pyup.io-25996",
+            "advisory": "Products.cmfplone versions 4.3.20, 5.1.7, 5.2.5 and 6.0.0a1.dev0 integrate a fix for CVE-2020-7940: Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.",
+            "cve": "CVE-2020-7940",
+            "id": "pyup.io-41959",
             "specs": [
-                "<4.3"
+                "<4.3.20",
+                ">4.3.20,<5.1.7",
+                ">5.1.7,<5.2.5",
+                ">5.2.5,<6.0.0a1.dev0"
             ],
-            "v": "<4.3"
+            "v": "<4.3.20,>4.3.20,<5.1.7,>5.1.7,<5.2.5,>5.2.5,<6.0.0a1.dev0"
         },
         {
-            "advisory": "The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password. See CVE-2020-35190.",
-            "cve": "CVE-2020-35190",
-            "id": "pyup.io-39305",
+            "advisory": "In Products.CMFPlone before 5.1b1, it's possible to access private content via str.format in through-the-web templates and scripts.",
+            "cve": "PVE-2021-32997",
+            "id": "pyup.io-32997",
             "specs": [
-                "<4.3.18"
+                "<5.1b1"
             ],
-            "v": "<4.3.18"
+            "v": "<5.1b1"
         },
         {
-            "advisory": "Plone 5.2.2 contains Products.isurlinportal 1.1.0 with a minor security hardening fix.",
-            "cve": "PVE-2021-38990",
-            "id": "pyup.io-38990",
+            "advisory": "Products.cmfplone 5.2.2 contains Products.isurlinportal 1.1.0 with a minor security hardening fix.",
+            "cve": "PVE-2021-38701",
+            "id": "pyup.io-38701",
             "specs": [
                 "<5.2.2"
             ],
             "v": "<5.2.2"
         },
         {
-            "advisory": "Plone 5.2.2rc1 fixes that isURLInPortal could be tricked into accepting malicious links.",
-            "cve": "PVE-2021-38991",
-            "id": "pyup.io-38991",
+            "advisory": "Products.cmfplone 5.2.2rc1 fixes that isURLInPortal could be tricked into accepting malicious links.",
+            "cve": "PVE-2021-39021",
+            "id": "pyup.io-39021",
             "specs": [
                 "<5.2.2rc1"
             ],
             "v": "<5.2.2rc1"
         },
         {
-            "advisory": "Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role). See CVE-2020-28735.",
-            "cve": "CVE-2020-28735",
-            "id": "pyup.io-39377",
+            "advisory": "Products.cmfplone versions 5.2.5 and 6.0.0a1.dev0 include a fix for CVE-2021-32633. The vulnerability was present in its dependency \"Zope\".\r\nhttps://plone.org/security/hotfix/20210518/remote-code-execution-via-traversal-in-expressions",
+            "cve": "CVE-2021-32633",
+            "id": "pyup.io-41960",
             "specs": [
-                "<5.2.3"
+                ">5.2.5,<6.0.0a1.dev0",
+                "<5.2.5"
             ],
-            "v": "<5.2.3"
+            "v": ">5.2.5,<6.0.0a1.dev0,<5.2.5"
         },
         {
-            "advisory": "Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role). See CVE-2020-28736.",
-            "cve": "CVE-2020-28736",
-            "id": "pyup.io-39378",
+            "advisory": "Products.cmfplone versions 5.2.5 and 6.0.0a1.dev0 integrates a fix for CVE-2021-33507: Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.\r\nhttps://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots",
+            "cve": "CVE-2021-33507",
+            "id": "pyup.io-41961",
+            "specs": [
+                ">5.2.5,<6.0.0a1.dev0",
+                "<5.2.5"
+            ],
+            "v": ">5.2.5,<6.0.0a1.dev0,<5.2.5"
+        }
+    ],
+    "products.cmfquickinstallertool": [
+        {
+            "advisory": "Products.cmfquickinstallertool before 3.0.14 is vulnerable to several cross site scripting (XSS) attacks.\r\nhttps://github.com/plone/Products.CMFQuickInstallerTool/commit/1cd430b74353ac023493e2dd19613a2e390c451d",
+            "cve": "CVE-2016-7138",
+            "id": "pyup.io-26021",
+            "specs": [
+                "<3.0.14"
+            ],
+            "v": "<3.0.14"
+        }
+    ],
+    "products.cmfuid": [
+        {
+            "advisory": "Products.cmfuid before 2.1.0beta2 has a vulnerability because it includes the Zope dependency version <2.10.2, which has an injection vulnerability. See: CVE-2007-0240.",
+            "cve": "CVE-2007-0240",
+            "id": "pyup.io-36300",
+            "specs": [
+                "<2.1.0beta2"
+            ],
+            "v": "<2.1.0beta2"
+        }
+    ],
+    "products.dcworkflow": [
+        {
+            "advisory": "Products.dcworkflow 2.1.0beta2 adds POST-only protections to security critical methods. See: CVE-2007-0240.",
+            "cve": "CVE-2007-0240",
+            "id": "pyup.io-38035",
+            "specs": [
+                "<2.1.0beta2"
+            ],
+            "v": "<2.1.0beta2"
+        }
+    ],
+    "products.genericsetup": [
+        {
+            "advisory": "Products.genericsetup 2.1.1 includes a fix for CVE-2021-21360: Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install \"Products.GenericSetup>=2.1.1\".\r\nhttps://github.com/zopefoundation/Products.GenericSetup/security/advisories/GHSA-jff3-mwp3-f8cw",
+            "cve": "CVE-2021-21360",
+            "id": "pyup.io-39685",
             "specs": [
-                "<5.2.3"
+                "<2.1.1"
             ],
-            "v": "<5.2.3"
-        },
+            "v": "<2.1.1"
+        }
+    ],
+    "products.isurlinportal": [
         {
-            "advisory": "Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role. See CVE-2020-28734.",
-            "cve": "CVE-2020-28734",
-            "id": "pyup.io-39376",
+            "advisory": "Products.isurlinportal 1.2.0 includes a fix for security issue: Treat urls like ``https:example.org`` without slashes as outside the portal. Some browsers would redirect to example.org, some would redirect to a non-existing local page.",
+            "cve": "PVE-2021-41086",
+            "id": "pyup.io-41086",
             "specs": [
-                "<5.2.3"
+                "<1.2.0"
             ],
-            "v": "<5.2.3"
+            "v": "<1.2.0"
         },
         {
-            "advisory": "Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.",
-            "cve": "CVE-2021-3313",
-            "id": "pyup.io-40528",
+            "advisory": "Products.isurlinportal version 1.2.0 includes a fix for CVE-2021-32806: Versions of products.isurlinportal prior to 1.2.0 have an open redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like \"https://example.org\" is not in the portal. The url \"https:example.org\" without slashes is considered to be in the portal. When redirecting, some browsers go to \"https://example.org\", others give an error.\r\nAttackers may use this to redirect victims to their site, especially as part of a phishing attack.\r\nhttps://github.com/plone/Products.isurlinportal/security/advisories/GHSA-q3m9-9fj2-mfwr\r\nhttps://github.com/plone/Products.isurlinportal/commit/d4fd34990d18adf05a10dc5e2bb4b066798280ba",
+            "cve": "CVE-2021-32806",
+            "id": "pyup.io-41068",
             "specs": [
-                "<5.2.4"
+                "<1.2.0"
             ],
-            "v": "<5.2.4"
-        },
+            "v": "<1.2.0"
+        }
+    ],
+    "products.ldapuserfolder": [
         {
-            "advisory": "Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.",
-            "cve": "CVE-2021-33512",
-            "id": "pyup.io-40537",
+            "advisory": "The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges.",
+            "cve": "PVE-2021-33148",
+            "id": "pyup.io-33148",
             "specs": [
-                "<=5.2.4"
+                "<2.19"
             ],
-            "v": "<=5.2.4"
+            "v": "<2.19"
         },
         {
-            "advisory": "Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.",
-            "cve": "CVE-2021-33510",
-            "id": "pyup.io-40535",
+            "advisory": "Products.ldapuserfolder version 2.20 includes a fix for CVE-2010-2944: The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges.\r\nhttps://github.com/dataflake/Products.LDAPUserFolder/commit/246257dbe5f73a6fd3c3e597814038977004cdd7",
+            "cve": "CVE-2010-2944",
+            "id": "pyup.io-26023",
             "specs": [
-                "<=5.2.4"
+                "<2.20"
             ],
-            "v": "<=5.2.4"
-        },
+            "v": "<2.20"
+        }
+    ],
+    "products.ploneformgen": [
         {
-            "advisory": "Plone through 5.2.4 allows XSS via the inline_diff methods in Products.CMFDiffTool.",
-            "cve": "CVE-2021-33513",
-            "id": "pyup.io-40538",
+            "advisory": "Products.ploneformgen 1.7.19 and 1.8.1 include a fix for a XSS vulnerability that could be exploited by users with the ability to create forms.\r\nhttps://github.com/smcmahon/Products.PloneFormGen/commit/b9590e5573660ee6b8d151430ca2b459f05388ca",
+            "cve": "PVE-2021-26024",
+            "id": "pyup.io-26024",
             "specs": [
-                "<=5.2.4"
+                "<1.7.19",
+                ">=1.8.0.alpha1,<1.8.1"
             ],
-            "v": "<=5.2.4"
-        },
+            "v": "<1.7.19,>=1.8.0.alpha1,<1.8.1"
+        }
+    ],
+    "products.plonepas": [
         {
-            "advisory": "Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.",
-            "cve": "CVE-2021-33508",
-            "id": "pyup.io-40533",
+            "advisory": "The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.",
+            "cve": "CVE-2009-0662",
+            "id": "pyup.io-33149",
             "specs": [
-                "<=5.2.4"
+                ">3.2.2,<3.9"
             ],
-            "v": "<=5.2.4"
-        },
+            "v": ">3.2.2,<3.9"
+        }
+    ],
+    "products.pluggableauthservice": [
         {
-            "advisory": "Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.",
-            "cve": "CVE-2021-33511",
-            "id": "pyup.io-40536",
+            "advisory": "Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install \"Products.PluggableAuthService>=2.6.0\"`.",
+            "cve": "CVE-2021-21336",
+            "id": "pyup.io-39681",
             "specs": [
-                "<=5.2.4"
+                "<2.6.0"
             ],
-            "v": "<=5.2.4"
+            "v": "<2.6.0"
         },
         {
-            "advisory": "Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.",
-            "cve": "CVE-2021-33509",
-            "id": "pyup.io-40534",
+            "advisory": "Products.pluggableauthservice 2.6.1 includes a fix for CVE-2021-21337: In Products.PluggableAuthService before version 2.6.1 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to '2.6.1' and re-run the buildout, or if you used 'pip' simply do 'pip install \"Products.PluggableAuthService>=2.6.1\"'.\r\nhttps://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr",
+            "cve": "CVE-2021-21337",
+            "id": "pyup.io-39682",
             "specs": [
-                "<=5.2.4"
+                "<2.6.1"
             ],
-            "v": "<=5.2.4"
+            "v": "<2.6.1"
         },
         {
             "advisory": "Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.",
             "cve": "CVE-2021-33507",
-            "id": "pyup.io-40821",
+            "id": "pyup.io-39695",
             "specs": [
-                "<=5.2.4"
+                "<2.6.2"
             ],
-            "v": "<=5.2.4"
+            "v": "<2.6.2"
         },
         {
-            "advisory": "Unspecified vulnerability in (1) Zope 2.12.x before 2.12.19 and 2.13.x before 2.13.8, as used in Plone 4.x and other products, and (2) PloneHotfix20110720 for Plone 3.x allows attackers to gain privileges via unspecified vectors, related to a \"highly serious vulnerability.\" NOTE: this vulnerability exists because of an incorrect fix for CVE-2011-0720.",
-            "cve": "CVE-2011-2528",
-            "id": "pyup.io-25965",
+            "advisory": "Products.pluggableauthservice 2.6.3 fixes CSRF token access for tigher TAL path expression security in Zope 5.2.1.",
+            "cve": "PVE-2021-40631",
+            "id": "pyup.io-40631",
             "specs": [
-                "==3.3.5,==3.3.4,==3.3.3,==3.3.2"
+                "<2.6.3"
             ],
-            "v": "==3.3.5,==3.3.4,==3.3.3,==3.3.2"
-        },
+            "v": "<2.6.3"
+        }
+    ],
+    "products.poi": [
         {
-            "advisory": "A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the \"form.widgets.site_title\" parameter.",
-            "cve": "CVE-2021-29002",
-            "id": "pyup.io-40094",
+            "advisory": "products.poi before 2.2.3 allows anonymous users to see issues inside private folders.",
+            "cve": "PVE-2021-26027",
+            "id": "pyup.io-26027",
             "specs": [
-                "==5.2.3"
+                "<2.2.3"
             ],
-            "v": "==5.2.3"
-        },
+            "v": "<2.2.3"
+        }
+    ],
+    "project-manager": [
         {
-            "advisory": "Unspecified vulnerability in Zope 2.12.x and 2.13.x, as used in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2, allows remote attackers to execute arbitrary commands via vectors related to the p_ class in OFS/misc_.py and the use of Python modules.",
-            "cve": "CVE-2011-3587",
-            "id": "pyup.io-33144",
+            "advisory": "Project-manager version 0.2.0 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/kpj/project_manager/commit/07aef0e023f07563ae9141674e1de3508e178358#diff-03ec8dd0ad6683512ebfb1545fbf01618075f2118c80cc4878cd76ff5bf26aeb",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-41371",
             "specs": [
-                ">4,<4.2a2"
+                "<0.2.0"
             ],
-            "v": ">4,<4.2a2"
+            "v": "<0.2.0"
         },
         {
-            "advisory": "Plone 4.x through 4.3.11 and 5.x through 5.0.6 allow remote attackers to bypass a sandbox protection mechanism and obtain sensitive information by leveraging the Python string format method.",
-            "cve": "CVE-2017-5524",
-            "id": "pyup.io-35733",
+            "advisory": "Project-manager 0.2.0 is vulnerable to CVE-2020-14343 due to using  \"yaml.full_load()\" and a potentially vulnerable version of its dependency \"pyyaml\". See CVE-2020-14343.\r\nhttps://github.com/kpj/project_manager/commit/07aef0e023f07563ae9141674e1de3508e178358",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-41756",
             "specs": [
-                ">4,<=4.3.11",
-                ">5,<=5.0.6"
+                "==0.2.0"
             ],
-            "v": ">4,<=4.3.11,>5,<=5.0.6"
-        },
+            "v": "==0.2.0"
+        }
+    ],
+    "projen": [
         {
-            "advisory": "By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. (The specific url can be seen by inspecting the hotfix code, but we don't want to make it too easy for attackers by spelling it out here.)",
-            "cve": "CVE-2017-1000484",
-            "id": "pyup.io-35704",
+            "advisory": "Projen 0.3.10 inlcudes a fix for a security issue with standard-version 8.0.0.",
+            "cve": "PVE-2021-39417",
+            "id": "pyup.io-39417",
             "specs": [
-                ">4,<=4.3.15",
-                ">=5.0,<5.1rc1"
+                "<0.3.10"
             ],
-            "v": ">4,<=4.3.15,>=5.0,<5.1rc1"
+            "v": "<0.3.10"
         },
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in the safe_html filter in Products.PortalTransforms in Plone 2.1 through 4.1 allows remote authenticated users to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2010-2422.",
-            "cve": "CVE-2011-1949",
-            "id": "pyup.io-25997",
+            "advisory": "Projen 0.7.0 addresses a security issue with standard-version 8.0.0.",
+            "cve": "PVE-2021-39416",
+            "id": "pyup.io-39416",
             "specs": [
-                ">=2.1,<4.2"
+                "<0.7.0"
             ],
-            "v": ">=2.1,<4.2"
+            "v": "<0.7.0"
         },
         {
-            "advisory": "Unspecified vulnerability in Plone 2.5 through 4.0, as used in Conga, luci, and possibly other products, allows remote attackers to obtain administrative access, read or create arbitrary content, and change the site skin via unknown vectors.",
-            "cve": "CVE-2011-0720",
-            "id": "pyup.io-33142",
+            "advisory": "Projen 0.8.0 addresses a security issue with standard-version 8.0.0.",
+            "cve": "PVE-2021-39415",
+            "id": "pyup.io-39415",
             "specs": [
-                ">=2.5,<4.0"
+                "<0.8.0"
             ],
-            "v": ">=2.5,<4.0"
+            "v": "<0.8.0"
         },
         {
-            "advisory": "Multiple cross-site scripting (XSS) vulnerabilities in Zope, as used in Plone 3.3.x through 3.3.6, 4.0.x through 4.0.9, 4.1.x through 4.1.6, 4.2.x through 4.2.7, and 4.3 through 4.3.2, allow remote attackers to inject arbitrary web script or HTML via unspecified input in the (1) browser_id_manager or (2) OFS.Image method. See: CVE-2013-7062.",
-            "cve": "CVE-2013-7062",
-            "id": "pyup.io-37753",
+            "advisory": "Projen 0.9.0 addresses a security issue with standard-version 8.0.0.",
+            "cve": "PVE-2021-39414",
+            "id": "pyup.io-39414",
             "specs": [
-                ">=3.3.0,<=3.3.6",
-                ">=4.0,<=4.0.9",
-                ">=4.1.0,<=4.1.6",
-                ">=4.2.0,<=4.2.7",
-                ">=4.3,<=4.3.2"
+                "<0.9.0"
             ],
-            "v": ">=3.3.0,<=3.3.6,>=4.0,<=4.0.9,>=4.1.0,<=4.1.6,>=4.2.0,<=4.2.7,>=4.3,<=4.3.2"
-        },
+            "v": "<0.9.0"
+        }
+    ],
+    "proxy.py": [
         {
-            "advisory": "The CMFEditions component 2.x in Plone 4.0.x through 4.0.9, 4.1, and 4.2 through 4.2a2 does not prevent the KwAsAttributes classes from being publishable, which allows remote attackers to access sub-objects via unspecified vectors, a different vulnerability than CVE-2011-3587.",
-            "cve": "CVE-2011-4030",
-            "id": "pyup.io-33145",
+            "advisory": "before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).",
+            "cve": "CVE-2021-3116",
+            "id": "pyup.io-42312",
             "specs": [
-                ">=4,<4.2a2"
+                "<2.3.1"
             ],
-            "v": ">=4,<4.2a2"
-        },
+            "v": "<2.3.1"
+        }
+    ],
+    "psd-tools": [
         {
-            "advisory": "SQL Injection in DTML or in connection objects in Plone 4.0 through 5.2.1 allows users to perform unwanted SQL queries. (This is a problem in Zope.) See: CVE-2020-7939.",
-            "cve": "CVE-2020-7939",
-            "id": "pyup.io-37787",
+            "advisory": "An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.",
+            "cve": "CVE-2020-10571",
+            "id": "pyup.io-42270",
             "specs": [
-                ">=4.0,<=5.2.1"
+                "<1.9.4"
             ],
-            "v": ">=4.0,<=5.2.1"
+            "v": "<1.9.4"
         },
         {
-            "advisory": "An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site. See: CVE-2020-7936.",
-            "cve": "CVE-2020-7936",
-            "id": "pyup.io-37784",
+            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
+            "cve": "CVE-2019-19911",
+            "id": "pyup.io-38525",
             "specs": [
-                ">=4.0,<=5.2.1"
+                "<=1.9.18"
             ],
-            "v": ">=4.0,<=5.2.1"
+            "v": "<=1.9.18"
         },
         {
-            "advisory": "Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking. See: CVE-2020-7940.",
-            "cve": "CVE-2020-7940",
-            "id": "pyup.io-37788",
+            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
+            "cve": "CVE-2020-5310",
+            "id": "pyup.io-43468",
             "specs": [
-                ">=4.3,<=5.2.0"
+                "<=1.9.18"
             ],
-            "v": ">=4.3,<=5.2.0"
+            "v": "<=1.9.18"
         },
         {
-            "advisory": "A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. See: CVE-2020-7941.",
-            "cve": "CVE-2020-7941",
-            "id": "pyup.io-36898",
+            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
+            "cve": "CVE-2020-5311",
+            "id": "pyup.io-43469",
             "specs": [
-                ">=4.3,<=5.2.1"
+                "<=1.9.18"
             ],
-            "v": ">=4.3,<=5.2.1"
+            "v": "<=1.9.18"
         },
         {
-            "advisory": "An XSS issue in the title field in Plone 5.0 through 5.2.1 allows users with a certain privilege level to insert JavaScript that will be executed when other users access the site. See: CVE-2020-7937.",
-            "cve": "CVE-2020-7937",
-            "id": "pyup.io-37785",
+            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
+            "cve": "CVE-2020-5312",
+            "id": "pyup.io-43470",
             "specs": [
-                ">=5.0,<=5.2.1"
+                "<=1.9.18"
             ],
-            "v": ">=5.0,<=5.2.1"
+            "v": "<=1.9.18"
         },
         {
-            "advisory": "In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.",
-            "cve": "CVE-2021-35959",
-            "id": "pyup.io-40886",
+            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
+            "cve": "CVE-2020-5313",
+            "id": "pyup.io-43471",
             "specs": [
-                ">=5.0.0,<=5.2.4"
+                "<=1.9.18"
             ],
-            "v": ">=5.0.0,<=5.2.4"
+            "v": "<=1.9.18"
         },
         {
-            "advisory": "plone.restapi in Plone 5.2.0 through 5.2.1 allows users with a certain privilege level to escalate their privileges up to the highest level. See: CVE-2020-7938.",
-            "cve": "CVE-2020-7938",
-            "id": "pyup.io-37786",
-            "specs": [
-                ">=5.2.0,<=5.2.1"
-            ],
-            "v": ">=5.2.0,<=5.2.1"
-        }
-    ],
-    "plone-app-contentmenu": [
-        {
-            "advisory": "Plone-app-contentmenu  1.1.7 escapes the title of the defaultpage in the DisplayMenu. This fixes a potential XSS vulnerability.\r\nhttps://github.com/plone/plone.app.contentmenu/commit/6d7d5d51c12c82fc0eeaded0841fc57d2258e9af",
-            "cve": "PVE-2021-36047",
-            "id": "pyup.io-36047",
+            "advisory": "Psd-tools 1.9.4 fixes a security issue related to compression in 1.8.37 - 1.9.3.",
+            "cve": "PVE-2021-37654",
+            "id": "pyup.io-37654",
             "specs": [
-                "<1.1.7"
+                ">=1.8.37,<=1.9.3"
             ],
-            "v": "<1.1.7"
+            "v": ">=1.8.37,<=1.9.3"
         }
     ],
-    "plone-app-contenttypes": [
+    "psd-tools3": [
         {
-            "advisory": "Plone.app.contenttypes 1.2.15 fixes a possible cross site scripting (XSS) attack in lead image caption.\r\nhttps://github.com/plone/plone.app.contenttypes/commit/16f2c31cada65f7c969e4d314c70d39d1db01f17",
-            "cve": "PVE-2021-35870",
-            "id": "pyup.io-35870",
+            "advisory": "Psd-tools3 1.9.1 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-42025",
             "specs": [
-                "<1.2.15"
+                "<1.9.1"
             ],
-            "v": "<1.2.15"
+            "v": "<1.9.1"
         },
         {
-            "advisory": "Plone-app-contenttypes version 2.1.6 includes a fix for CVE-2020-7941: A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission.",
-            "cve": "CVE-2020-7941",
-            "id": "pyup.io-41880",
+            "advisory": "Psd-tools3 1.9.1 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-43548",
             "specs": [
-                "<2.1.6"
+                "<1.9.1"
             ],
-            "v": "<2.1.6"
-        }
-    ],
-    "plone-app-discussion": [
+            "v": "<1.9.1"
+        },
         {
-            "advisory": "plone-app-discussion 2.4.14 fixes a possible cross site scripting (XSS) attack on moderate comments page.",
-            "cve": "PVE-2021-35864",
-            "id": "pyup.io-35864",
+            "advisory": "Psd-tools3 1.9.1 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-34552",
+            "id": "pyup.io-43549",
             "specs": [
-                "<2.4.14"
+                "<1.9.1"
             ],
-            "v": "<2.4.14"
+            "v": "<1.9.1"
         }
     ],
-    "plone-app-event": [
+    "psiz": [
         {
-            "advisory": "Plone.app.event 3.0 fixes a possible cross site scripting (XSS) attack in location field.\r\nhttps://github.com/plone/plone.app.event/pull/233",
-            "cve": "PVE-2021-35923",
-            "id": "pyup.io-35923",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15205",
+            "id": "pyup.io-43979",
             "specs": [
-                "<3.0"
+                "<0.4.1"
             ],
-            "v": "<3.0"
-        }
-    ],
-    "plone-app-layout": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-app-layout version 2.5.1 adds csrf tokens automatically for contentview urls.",
-            "cve": "PVE-2021-41878",
-            "id": "pyup.io-41878",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15209",
+            "id": "pyup.io-43983",
             "specs": [
-                "<2.5.1"
+                "<0.4.1"
             ],
-            "v": "<2.5.1"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "Plone-app-layout version 3.4.1 integrates a fix for CVE-2020-7937, which affects the core package Plone.\r\nhttps://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher",
-            "cve": "CVE-2020-7937",
-            "id": "pyup.io-41877",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15191",
+            "id": "pyup.io-43993",
             "specs": [
-                "<3.4.1"
+                "<0.4.1"
             ],
-            "v": "<3.4.1"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "Plone-app-layout version 4.0.0a2 fixes several information exposure vulnerabilities. The new version:\r\n- Only shows document_byline to public if 'display_publication_date_in_byline' in site controlpanel is active.\r\n- Only shows author if 'allow_anon_views_about' in security controlpanel is active. \r\n- Shows 'modification_date' only if not published or 'modification_date' is greater that 'effective_date'.",
-            "cve": "PVE-2021-41876",
-            "id": "pyup.io-41876",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15199",
+            "id": "pyup.io-43998",
             "specs": [
-                "<4.0.0a2"
+                "<0.4.1"
             ],
-            "v": "<4.0.0a2"
-        }
-    ],
-    "plone-app-linkintegrity": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-app-linkintegrity 1.0.2 includes a fix for CVE-2007-5741: Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.\r\nhttps://github.com/plone/plone.app.linkintegrity/commit/4be49548c4f1046a8204030f26a603c29f38d9dd",
-            "cve": "CVE-2007-5741",
-            "id": "pyup.io-36046",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15200",
+            "id": "pyup.io-43999",
             "specs": [
-                "<1.0.2"
+                "<0.4.1"
             ],
-            "v": "<1.0.2"
-        }
-    ],
-    "plone-app-theming": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-app-theming 4.1.6 includes the following security improvements:\r\n-Fails when trying file protocol access in diazo rules\r\n-Doesn't resolves entities\r\n-Removes processing instructions",
-            "cve": "PVE-2021-41938",
-            "id": "pyup.io-41938",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15198",
+            "id": "pyup.io-43997",
             "specs": [
-                "<4.1.6"
+                "<0.4.1"
             ],
-            "v": "<4.1.6"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "Plone.app.theming 5.0.0a1 and 4.1.6 include a fix for CVE-2021-33511: Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.\r\nhttps://plone.org/security/hotfix/20210518/server-side-request-forgery-via-lxml-parser",
-            "cve": "CVE-2021-33511",
-            "id": "pyup.io-41937",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15204",
+            "id": "pyup.io-43978",
             "specs": [
-                "<4.1.6"
+                "<0.4.1"
             ],
-            "v": "<4.1.6"
-        }
-    ],
-    "plone-app-users": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-app-users before 1.0.5 does not check for permission when editing other users' profiles. This fixes http://dev.plone.org/plone/ticket/11842 and http://plone.org/products/plone/security/advisories/CVE-2011-1950.",
-            "cve": "CVE-2011-1950",
-            "id": "pyup.io-36096",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15202",
+            "id": "pyup.io-43980",
             "specs": [
-                "<1.0.5"
+                "<0.4.1"
             ],
-            "v": "<1.0.5"
-        }
-    ],
-    "plone-app-z3cform": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-app-z3cform version 0.5.4 makes LookupErrors no longer visible to improve security.",
-            "cve": "PVE-2021-42026",
-            "id": "pyup.io-42026",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15206",
+            "id": "pyup.io-43981",
             "specs": [
-                "<0.5.4"
+                "<0.4.1"
             ],
-            "v": "<0.5.4"
-        }
-    ],
-    "plone-dexterity": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "In plone-dexterity before 2.3.0 Attribute access to schema fields can be protected. This\r\n  worked for direct schemas, but was not implemented for permissions coming\r\n  from behaviors.",
-            "cve": "PVE-2021-35873",
-            "id": "pyup.io-35873",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15208",
+            "id": "pyup.io-43982",
             "specs": [
-                "<2.3.0"
+                "<0.4.1"
             ],
-            "v": "<2.3.0"
-        }
-    ],
-    "plone-portlet-static": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-portlet-static version 1.2 ensures that text output is passed through the safe-html transform to protect against malicious text.",
-            "cve": "PVE-2021-41932",
-            "id": "pyup.io-41932",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15195",
+            "id": "pyup.io-43984",
             "specs": [
-                "<1.2"
+                "<0.4.1"
             ],
-            "v": "<1.2"
-        }
-    ],
-    "plone-restapi": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-restapi 8.4.0 adds security decorators in the PAS plugin.",
-            "cve": "PVE-2021-41890",
-            "id": "pyup.io-41890",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15207",
+            "id": "pyup.io-43985",
             "specs": [
-                "<8.4.0"
+                "<0.4.1"
             ],
-            "v": "<8.4.0"
-        }
-    ],
-    "plone-supermodel": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-supermodel 1.6.3 doesn't resolves entities in the xml parser and removes processing instructions to increase security.",
-            "cve": "PVE-2021-41933",
-            "id": "pyup.io-41933",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15190",
+            "id": "pyup.io-43986",
             "specs": [
-                "<1.6.3"
+                "<0.4.1"
             ],
-            "v": "<1.6.3"
-        }
-    ],
-    "plone-testing": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone-testing 6.1.0 fixes teardown of the \"plone.testing.security.Checkers\" layer, which was not properly restoring zope.security's \"_checkers\" dict.",
-            "cve": "PVE-2021-41931",
-            "id": "pyup.io-41931",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15203",
+            "id": "pyup.io-43987",
             "specs": [
-                "<6.1.0"
+                "<0.4.1"
             ],
-            "v": "<6.1.0"
-        }
-    ],
-    "plone.app.content": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "plone.app.content 3.3.1 includes security hotfix 20160830 for folder factories redirection.",
-            "cve": "PVE-2021-26000",
-            "id": "pyup.io-26000",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15211",
+            "id": "pyup.io-40498",
             "specs": [
-                "<3.3.1"
+                "<0.4.1"
             ],
-            "v": "<3.3.1"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "Plone.app.content 3.8.1 integrate the Plone20200121 hotfix to prevent XSS in title - see: https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher",
-            "cve": "CVE-2020-7937",
-            "id": "pyup.io-38030",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15194",
+            "id": "pyup.io-43990",
             "specs": [
-                "<3.8.1"
+                "<0.4.1"
             ],
-            "v": "<3.8.1"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "Plone.app.content 4.0.0a3 includes fixes for:\r\n-Stored XSS in folder contents.\r\nhttps://plone.org/security/hotfix/20210518/stored-xss-in-folder-contents\r\n-Stored XSS from user fullname and possibly other places where \"getVocabulary\" is called. This is an alternative to the \"plone.app.users\" workaround from the \"PloneHotfix20210518\" fullname fix.\r\nhttps://plone.org/security/hotfix/20210518/stored-xss-from-user-fullname\r\nSee CVE-2021-35959.",
-            "cve": "CVE-2021-35959",
-            "id": "pyup.io-41256",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15214",
+            "id": "pyup.io-43991",
             "specs": [
-                "<4.0.0a3"
+                "<0.4.1"
             ],
-            "v": "<4.0.0a3"
-        }
-    ],
-    "plone.app.contentmenu": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone.app.contentmenu  1.1.7 escapes the title of the defaultpage in the DisplayMenu. This fixes a potential XSS vulnerability.\r\nhttps://github.com/plone/plone.app.contentmenu/commit/6d7d5d51c12c82fc0eeaded0841fc57d2258e9af",
-            "cve": "PVE-2021-26001",
-            "id": "pyup.io-26001",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15358",
+            "id": "pyup.io-43992",
             "specs": [
-                "<1.1.7"
+                "<0.4.1"
             ],
-            "v": "<1.1.7"
-        }
-    ],
-    "plone.app.contenttypes": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone.app.contenttypes 1.2.15 fixes a possible cross site scripting (XSS) attack in lead image caption.\r\nhttps://github.com/plone/plone.app.contenttypes/commit/16f2c31cada65f7c969e4d314c70d39d1db01f17",
-            "cve": "PVE-2021-26002",
-            "id": "pyup.io-26002",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15192",
+            "id": "pyup.io-43994",
             "specs": [
-                "<1.2.15"
+                "<0.4.1"
             ],
-            "v": "<1.2.15"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "A privilege escalation issue in plone.app.contenttypes in Plone 4.3 through 5.2.1 allows users to PUT (overwrite) some content without needing write permission. See: CVE-2020-7941.",
-            "cve": "CVE-2020-7941",
-            "id": "pyup.io-37887",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15193",
+            "id": "pyup.io-43995",
             "specs": [
-                "<2.1.6"
+                "<0.4.1"
             ],
-            "v": "<2.1.6"
-        }
-    ],
-    "plone.app.dexterity": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "The modeleditor in plone.app.dexterity 2.6.8 no longer resolves entities, and it removes processing instructions. This increases the security.",
-            "cve": "PVE-2021-39143",
-            "id": "pyup.io-39143",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15196",
+            "id": "pyup.io-43996",
             "specs": [
-                "<2.6.8"
+                "<0.4.1"
             ],
-            "v": "<2.6.8"
-        }
-    ],
-    "plone.app.discussion": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone.app.discussion 2.4.14 fixes a possible cross site scripting (XSS) attack on moderate comments page.\r\nhttps://github.com/plone/plone.app.discussion/commit/e1dbaef82a801c58576057564ab3689dba983c15",
-            "cve": "PVE-2021-26003",
-            "id": "pyup.io-26003",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15201",
+            "id": "pyup.io-44000",
             "specs": [
-                "<2.4.14"
+                "<0.4.1"
             ],
-            "v": "<2.4.14"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "plone.app.discussion 2.4.18 includes security hotfix 20160830 for redirects.",
-            "cve": "PVE-2021-26004",
-            "id": "pyup.io-26004",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15213",
+            "id": "pyup.io-44001",
             "specs": [
-                "<2.4.18"
+                "<0.4.1"
             ],
-            "v": "<2.4.18"
-        }
-    ],
-    "plone.app.event": [
+            "v": "<0.4.1"
+        },
         {
-            "advisory": "Plone.app.event 3.0 fixes a possible cross site scripting (XSS) attack in location field.\r\nhttps://github.com/plone/plone.app.event/pull/233",
-            "cve": "PVE-2021-26005",
-            "id": "pyup.io-26005",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15210",
+            "id": "pyup.io-44002",
             "specs": [
-                "<3.0"
+                "<0.4.1"
             ],
-            "v": "<3.0"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "Plone.app.event 3.2.10 gives a validation error in the ical importer when a 'file://' URL is used (this could be a line of attack for a hacker).",
-            "cve": "PVE-2021-39140",
-            "id": "pyup.io-39140",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15212",
+            "id": "pyup.io-43988",
             "specs": [
-                "<3.2.10"
+                "<0.4.1"
             ],
-            "v": "<3.2.10"
+            "v": "<0.4.1"
         },
         {
-            "advisory": "Plone.app.event 4.0.0a4 includes a fix for a server-side-request-forgery vulnerability. Now, \"file:\" protocol is not allowed in iCal url. Previously, only \"file://\" was disallowed, but this left room for relative paths.\r\nhttps://plone.org/security/hotfix/20210518/server-side-request-forgery-via-event-ical-url",
-            "cve": "PVE-2021-41254",
-            "id": "pyup.io-41254",
+            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to v2.3.1 to include security fixes.",
+            "cve": "CVE-2020-15197",
+            "id": "pyup.io-43989",
             "specs": [
-                "<4.0.0a4"
+                "<0.4.1"
             ],
-            "v": "<4.0.0a4"
+            "v": "<0.4.1"
         }
     ],
-    "plone.app.layout": [
+    "psutil": [
         {
-            "advisory": "Plone.app.layout 2.5.1 adds CSRF tokens automatically for contentview urls.",
-            "cve": "PVE-2021-41705",
-            "id": "pyup.io-41705",
+            "advisory": "psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object. See CVE-2019-18874.",
+            "cve": "CVE-2019-18874",
+            "id": "pyup.io-37765",
             "specs": [
-                "<2.5.1"
+                "<=5.6.5"
             ],
-            "v": "<2.5.1"
-        },
+            "v": "<=5.6.5"
+        }
+    ],
+    "psycopg": [
         {
-            "advisory": "Plone.app.layout 3.4.1 integrates the Plone20200121 hotfix to prevent XSS in title - see: https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher.",
-            "cve": "CVE-2020-7937",
-            "id": "pyup.io-38031",
+            "advisory": "Psycopg 3.0.4 updates its dependency 'libpq' to at least v14.1 to include a  security fix.",
+            "cve": "CVE-2021-23214",
+            "id": "pyup.io-42693",
             "specs": [
-                "<3.4.1"
+                "<3.0.4"
             ],
-            "v": "<3.4.1"
-        },
+            "v": "<3.0.4"
+        }
+    ],
+    "ptah": [
         {
-            "advisory": "Plone.app.layout 4.0.0a2 includes fixes for information-exposure vulnerabilities:\r\n-Show document_byline to public if \"display_publication_date_in_byline\" in site controlpanel is active\r\n-Only show author if \"allow_anon_views_about\" in security controlpanel is active\r\n-Show \"modification_date\" if not published or \"modification_date\" is greater that \"effective_date\"",
-            "cve": "PVE-2021-41704",
-            "id": "pyup.io-41704",
+            "advisory": "ptah before 0.3.3 is vulnerable to a undisclosed attack.",
+            "cve": "PVE-2021-26028",
+            "id": "pyup.io-26028",
             "specs": [
-                "<4.0.0a2"
+                "<0.3.3"
             ],
-            "v": "<4.0.0a2"
+            "v": "<0.3.3"
         }
     ],
-    "plone.app.linkintegrity": [
+    "puccini": [
         {
-            "advisory": "Plone 2.5 through 2.5.4 and 3.0 through 3.0.2 allows remote attackers to execute arbitrary Python code via network data containing pickled objects for the (1) statusmessages or (2) linkintegrity module, which the module unpickles and executes.",
-            "cve": "CVE-2007-5741",
-            "id": "pyup.io-42336",
+            "advisory": "Puccini 0.3 improves file output security.",
+            "cve": "PVE-2021-40026",
+            "id": "pyup.io-40026",
             "specs": [
-                "<1.0.2"
+                "<0.3"
             ],
-            "v": "<1.0.2"
+            "v": "<0.3"
+        }
+    ],
+    "pulpcore": [
+        {
+            "advisory": "Pulpcore 3.11.0 adds the 'ALLOWED_CONTENT_CHECKSUMS' setting to remove 'md5' and 'sha1' since they are not secure. Now, by default, the 'ALLOWED_CONTENT_CHECKSUMS' contain 'sha224', 'sha256', 'sha384', and 'sha512'.",
+            "cve": "PVE-2021-40315",
+            "id": "pyup.io-40315",
+            "specs": [
+                "<3.11.0"
+            ],
+            "v": "<3.11.0"
         },
         {
-            "advisory": "plone.app.linkintegrity 1.0.2 fixed security issue due to using pickles (see CVE-2007-5741).",
-            "cve": "CVE-2014-8991",
-            "id": "pyup.io-26006",
+            "advisory": "Pulpcore version 3.14.6 stops using insecure hash function blake2s for calculating 64 bit lock identifier from uuid.",
+            "cve": "PVE-2021-41801",
+            "id": "pyup.io-41801",
             "specs": [
-                "<1.0.2"
+                "<3.14.6"
             ],
-            "v": "<1.0.2"
-        }
-    ],
-    "plone.dexterity": [
+            "v": "<3.14.6"
+        },
         {
-            "advisory": "plone.dexterity 2.3.0 fixes a security issue. Attribute access to schema fields can be protected. This worked for direct schemas, but was not implemented for permissions coming from behaviors.",
-            "cve": "PVE-2021-26007",
-            "id": "pyup.io-26007",
+            "advisory": "Pulpcore 3.15.0 stops using the insecure hash function blake2s for calculating 64-bit lock identifier from uuid.\r\nhttps://pulp.plan.io/issues/9249",
+            "cve": "PVE-2021-41262",
+            "id": "pyup.io-41262",
             "specs": [
-                "<2.3.0"
+                "<3.15.0"
             ],
-            "v": "<2.3.0"
+            "v": "<3.15.0"
         }
     ],
-    "plone.formwidget.contenttree": [
+    "pulumi-kubernetes": [
         {
-            "advisory": "plone.formwidget.contenttree 1.0a3 fixes an issues with the security validator to work properly on add views and other views using namespace traversal.",
-            "cve": "PVE-2021-26008",
-            "id": "pyup.io-26008",
+            "advisory": "Pulumi-kubernetes 2.6.0 updates its dependency 'pyyaml' minimum version to v5.3.1 to include security fixes.",
+            "cve": "CVE-2019-20477",
+            "id": "pyup.io-38772",
             "specs": [
-                "<1.0a3"
+                "<2.6.0"
             ],
-            "v": "<1.0a3"
+            "v": "<2.6.0"
         }
     ],
-    "plone.memoize": [
+    "puput": [
         {
-            "advisory": "Plone.memoize 1.0.3 no longeruses hash when making cache keys. This is to avoid cache collisions, and to avoid a potential security problem where an attacker could manually craft collisions. Also, the use of hash() is no longer recommending in tests.",
-            "cve": "PVE-2021-37107",
-            "id": "pyup.io-37107",
+            "advisory": "Puput 1.0.4 updates the Django version to greater than 2.1.6 to fix security issues.",
+            "cve": "CVE-2019-3498",
+            "id": "pyup.io-43662",
             "specs": [
-                "<1.0.3"
+                "<1.0.4"
             ],
-            "v": "<1.0.3"
-        }
-    ],
-    "plone.mockup": [
+            "v": "<1.0.4"
+        },
         {
-            "advisory": "Plone.mockup before 2.1.3 is vulnerable to a XSS attack in structure and relateditem pattern.\r\nhttps://github.com/plone/mockup/pull/627",
-            "cve": "PVE-2021-26009",
-            "id": "pyup.io-26009",
+            "advisory": "Puput 1.0.4 updates the Django version to greater than 2.1.6 to fix security issues.",
+            "cve": "CVE-2019-6975",
+            "id": "pyup.io-37153",
             "specs": [
-                "<2.1.3"
+                "<1.0.4"
             ],
-            "v": "<2.1.3"
-        }
-    ],
-    "plone.namedfile": [
+            "v": "<1.0.4"
+        },
         {
-            "advisory": "Plone.namedfile 5.5.0 prevents stored XSS from file upload (svg, html) by implementing an allowlist of trusted mimetypes.\r\nhttps://github.com/plone/plone.namedfile/commit/37b9b7f29b0f804df622db9502abae28f3eccf38\r\nhttps://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots",
-            "cve": "CVE-2021-33507",
-            "id": "pyup.io-43737",
+            "advisory": "Puput 1.0.4 updates the Django version to greater than 2.1.6 to fix security issues.",
+            "cve": "CVE-2018-14574",
+            "id": "pyup.io-43663",
             "specs": [
-                "<5.5.0"
+                "<1.0.4"
             ],
-            "v": "<5.5.0"
-        }
-    ],
-    "plone.openid": [
+            "v": "<1.0.4"
+        },
         {
-            "advisory": "plone.openid before 2.0.2 is not using the system number generator, even if it is available.",
-            "cve": "PVE-2021-26010",
-            "id": "pyup.io-26010",
+            "advisory": "Puput 1.0.4 updates the Django version to greater than 2.1.6 to fix security issues.",
+            "cve": "CVE-2018-7537",
+            "id": "pyup.io-43664",
             "specs": [
-                "<2.0.2"
+                "<1.0.4"
             ],
-            "v": "<2.0.2"
+            "v": "<1.0.4"
         }
     ],
-    "plone.portlet.static": [
+    "pupyl": [
         {
-            "advisory": "Plone.portlet.static 1.2 starts to ensure that text output is passed through the 'safe-html' transform to protect against malicious text.",
-            "cve": "PVE-2021-40232",
-            "id": "pyup.io-40232",
+            "advisory": "Pupyl 0.10.4 includes a security update regarding its dependencies. No details are provided.",
+            "cve": "PVE-2021-39208",
+            "id": "pyup.io-39208",
             "specs": [
-                "<1.2"
+                "<0.10.4"
             ],
-            "v": "<1.2"
-        }
-    ],
-    "plone.recipe.varnish": [
+            "v": "<0.10.4"
+        },
         {
-            "advisory": "Plone.recipe.varnish 6.0.0b1 updates to Varnish 6.0.6 LTS security release.",
-            "cve": "PVE-2021-37942",
-            "id": "pyup.io-37942",
+            "advisory": "Pupyl 0.10.5 updated its dependencies version for security reasons.",
+            "cve": "PVE-2021-39392",
+            "id": "pyup.io-39392",
             "specs": [
-                "<6.0.0b1"
+                "<0.10.5"
             ],
-            "v": "<6.0.0b1"
-        }
-    ],
-    "plone.session": [
+            "v": "<0.10.5"
+        },
         {
-            "advisory": "Plone.session 3.6.2 hardens the default timeout of session. This solves Plone security internal issue 126 (severity low, non-critical). Also, the session timeout is now the same as in mod_auth_tkt: 2h. This follows the recommendation of the German BSI (federal office for security in the information technology) - see <https://www.bsi.bund.de/SharedDocs/Downloads/DE/BSI/Internetsicherheit/isi_web_server_checkliste_Plone.pdf>.  For existing sites this can be adjusted at <https://HOST/acl_users/session/manage_propertiesForm>. The Plone Security Team follows the BSI and recommends administrators to change the setting in their existing Plone sites.",
-            "cve": "PVE-2021-38207",
-            "id": "pyup.io-38207",
+            "advisory": "Pupyl before 0.10.6 includes Tensorflow 2.3.1 which has security issues (see issue 73) and should therefore be upgraded to 2.4.0. However, the last version of Tensorflow has issues on its compilation (see Tensorflow issue 45744), and hence must be downgraded to ensure that the library still works.",
+            "cve": "PVE-2021-39400",
+            "id": "pyup.io-39400",
             "specs": [
-                "<3.6.2"
+                "<0.10.6"
             ],
-            "v": "<3.6.2"
-        }
-    ],
-    "plone.supermodel": [
+            "v": "<0.10.6"
+        },
         {
-            "advisory": "Plone.supermodel 1.6.3 no longer resolves entities in the xml parser. It also removes processing instructions. These are both security enhancements.",
-            "cve": "PVE-2021-39141",
-            "id": "pyup.io-39141",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29527",
+            "id": "pyup.io-43910",
             "specs": [
-                "<1.6.3"
+                "<0.11.1"
             ],
-            "v": "<1.6.3"
-        }
-    ],
-    "plone.z3cform": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Plone.z3cform 0.5.9 fixes a security problem with the ++widget++ namespace [optilude].",
-            "cve": "PVE-2021-37035",
-            "id": "pyup.io-37035",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29531",
+            "id": "pyup.io-43918",
             "specs": [
-                "<0.5.9"
+                "<0.11.1"
             ],
-            "v": "<0.5.9"
-        }
-    ],
-    "plotly": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Plotly 1.12.6 includes Plotly.js v1.16.2, which fixes a potential XSS vulnerability in 'text' fields.\r\nhttps://github.com/plotly/plotly.js/pull/736\r\nhttps://plotly.com/chart-studio-help/security-advisories/2016-08-08-plotlyjs-xss-advisory/",
-            "cve": "CVE-2017-1000006",
-            "id": "pyup.io-37053",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29602",
+            "id": "pyup.io-43921",
             "specs": [
-                "<1.12.6"
+                "<0.11.1"
             ],
-            "v": "<1.12.6"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Plotly 1.5.1 updates insecure dev dependencies `ecstatic` and `uglify-js`.",
-            "cve": "PVE-2021-38545",
-            "id": "pyup.io-38545",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29542",
+            "id": "pyup.io-43927",
             "specs": [
-                "<1.5.1"
+                "<0.11.1"
             ],
-            "v": "<1.5.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Plotly 1.54.4 bumps `ecstatic`, `gl-selet-static`, `gl-plot2d` & `gl-plot3d` and drops `cwise` to simplify build process & address security warnings [4929, 4930, 4934].",
-            "cve": "PVE-2021-38454",
-            "id": "pyup.io-38454",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29541",
+            "id": "pyup.io-43928",
             "specs": [
-                "<1.54.4"
+                "<0.11.1"
             ],
-            "v": "<1.54.4"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Plotly 2.0.7 includes Plotly.js 1.25.0, which contains a fix for an XSS vulnerability in a trace name on hover.\r\nhttps://github.com/plotly/plotly.js/pull/1307",
-            "cve": "PVE-2021-37052",
-            "id": "pyup.io-37052",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29609",
+            "id": "pyup.io-43929",
             "specs": [
-                "<2.0.7"
+                "<0.11.1"
             ],
-            "v": "<2.0.7"
-        }
-    ],
-    "plugwise": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Plugwise 0.8.2 improves the security by switching from lxml to defusedxml.",
-            "cve": "PVE-2021-39026",
-            "id": "pyup.io-39026",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29554",
+            "id": "pyup.io-43942",
             "specs": [
-                "<0.8.2"
+                "<0.11.1"
             ],
-            "v": "<0.8.2"
-        }
-    ],
-    "plumi.app": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "plumi.app 4.2 includes a security hotfix related to  LinguaPlone & plone.app.discussion.",
-            "cve": "PVE-2021-26011",
-            "id": "pyup.io-26011",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29577",
+            "id": "pyup.io-43967",
             "specs": [
-                "<4.2"
+                "<0.11.1"
             ],
-            "v": "<4.2"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "plumi.app before 4.2.1 uses a insecure transitive dependency (plone<4.0.7).",
-            "cve": "PVE-2021-26012",
-            "id": "pyup.io-26012",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2020-8169",
+            "id": "pyup.io-43864",
             "specs": [
-                "<4.2.1"
+                "<0.11.1"
             ],
-            "v": "<4.2.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "plumi.app 4.2.2 patches a serious security vulnerability/",
-            "cve": "PVE-2021-26013",
-            "id": "pyup.io-26013",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29532",
+            "id": "pyup.io-43865",
             "specs": [
-                "<4.2.2"
+                "<0.11.1"
             ],
-            "v": "<4.2.2"
-        }
-    ],
-    "plumpy": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Plumpy 0.20.0 updates its dependency \"Pyyaml\" to a secure version (>=5.4).",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-41835",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29543",
+            "id": "pyup.io-43867",
             "specs": [
-                "<0.20.0"
+                "<0.11.1"
             ],
-            "v": "<0.20.0"
-        }
-    ],
-    "plusminus": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Plusminus 0.3.0 has been hardened against some possible attacks, using deep expression nesting or formula references.",
-            "cve": "PVE-2021-38323",
-            "id": "pyup.io-38323",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29547",
+            "id": "pyup.io-43868",
             "specs": [
-                "<0.3.0"
+                "<0.11.1"
             ],
-            "v": "<0.3.0"
-        }
-    ],
-    "pm4py": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Pm4py 2.2.13.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-43358",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29534",
+            "id": "pyup.io-43870",
             "specs": [
-                "<2.2.13.1"
+                "<0.11.1"
             ],
-            "v": "<2.2.13.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pm4py 2.2.13.1 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-42161",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29587",
+            "id": "pyup.io-43872",
             "specs": [
-                "<2.2.13.1"
+                "<0.11.1"
             ],
-            "v": "<2.2.13.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pm4py 2.2.17.1 includes a fix for a command injection vulnerability in Data Petri Nets.\r\nhttps://github.com/pm4py/pm4py-core/commit/512c071e4990cb2f2fda523e223007256c0ec62e",
-            "cve": "PVE-2021-43434",
-            "id": "pyup.io-43434",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29566",
+            "id": "pyup.io-43874",
             "specs": [
-                "<2.2.17.1"
+                "<0.11.1"
             ],
-            "v": "<2.2.17.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pm4py 2.2.4 updates its dependency 'lxml' to v4.6.3 to include a security fix.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-42160",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29563",
+            "id": "pyup.io-43875",
             "specs": [
-                "<2.2.4"
+                "<0.11.1"
             ],
-            "v": "<2.2.4"
-        }
-    ],
-    "pmr2.oauth": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "pmr2.oauth before 0.4.2 is vulnerable to CSRF attacks.",
-            "cve": "PVE-2021-26014",
-            "id": "pyup.io-26014",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29560",
+            "id": "pyup.io-43876",
             "specs": [
-                "<0.4.2"
+                "<0.11.1"
             ],
-            "v": "<0.4.2"
-        }
-    ],
-    "podder-task-base": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "podder-task-base 0.4.0 changes: Update version of SQLAlchemy, Jinja for security reason",
-            "cve": "PVE-2021-37260",
-            "id": "pyup.io-37260",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29545",
+            "id": "pyup.io-43878",
             "specs": [
-                "<0.4.0"
+                "<0.11.1"
             ],
-            "v": "<0.4.0"
-        }
-    ],
-    "pokedex.py": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Pokedex.py 1.1.2 updates 'requests' package to version >=2.20.0 to fix an information exposure vulnerability.",
-            "cve": "CVE-2018-18074",
-            "id": "pyup.io-36593",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29537",
+            "id": "pyup.io-43879",
             "specs": [
-                "<1.1.2"
+                "<0.11.1"
             ],
-            "v": "<1.1.2"
-        }
-    ],
-    "polemarch": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "polemarch 1.2.1 change: Update `bootstrap` and `moment.js` for security reasons.",
-            "cve": "PVE-2021-37229",
-            "id": "pyup.io-37229",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29567",
+            "id": "pyup.io-43881",
             "specs": [
-                "<1.2.1"
+                "<0.11.1"
             ],
-            "v": "<1.2.1"
-        }
-    ],
-    "pollbot": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Pollbot is open source software which \"frees its human masters from the toilsome task of polling for the state of things during the Firefox release process.\" In Pollbot before version 1.4.4 there is an open redirection vulnerability in the path of \"https://pollbot.services.mozilla.com/\". An attacker can redirect anyone to malicious sites. To Reproduce type in this URL: \"https://pollbot.services.mozilla.com//evil.com/\". Affected versions will redirect to that website when you inject a payload like \"//evil.com/\". This is fixed in version 1.4.4.",
-            "cve": "CVE-2021-21354",
-            "id": "pyup.io-42300",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29589",
+            "id": "pyup.io-43882",
             "specs": [
-                "<1.4.4"
+                "<0.11.1"
             ],
-            "v": "<1.4.4"
-        }
-    ],
-    "polyaxon": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Polyaxon 0.4.1 updates dependencies exposing security vulnerabilities.",
-            "cve": "PVE-2021-38029",
-            "id": "pyup.io-38029",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29512",
+            "id": "pyup.io-43883",
             "specs": [
-                "<0.4.1"
+                "<0.11.1"
             ],
-            "v": "<0.4.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Polyaxon 0.4.3 update some packages that have some security and deprecation problems.",
-            "cve": "PVE-2021-38028",
-            "id": "pyup.io-38028",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29533",
+            "id": "pyup.io-43884",
             "specs": [
-                "<0.4.3"
+                "<0.11.1"
             ],
-            "v": "<0.4.3"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Polyaxon 0.5.1 updates lodash: vulnerability issue.",
-            "cve": "PVE-2021-38025",
-            "id": "pyup.io-38025",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29548",
+            "id": "pyup.io-43886",
             "specs": [
-                "<0.5.1"
+                "<0.11.1"
             ],
-            "v": "<0.5.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Polyaxon 0.5.5 updates dependencies with security release.",
-            "cve": "PVE-2021-38023",
-            "id": "pyup.io-38023",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29536",
+            "id": "pyup.io-43887",
             "specs": [
-                "<0.5.5"
+                "<0.11.1"
             ],
-            "v": "<0.5.5"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Polyaxon 0.6.0 fixes some unspecified security issues.",
-            "cve": "PVE-2021-38022",
-            "id": "pyup.io-38022",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29608",
+            "id": "pyup.io-43890",
             "specs": [
-                "<0.6.0"
+                "<0.11.1"
             ],
-            "v": "<0.6.0"
-        }
-    ],
-    "polyswarm-client": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Polyswarm-client 2.11.7 updates the 'aiohttp' dependency to a non-vulnerable version.",
-            "cve": "PVE-2021-40126",
-            "id": "pyup.io-40126",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29551",
+            "id": "pyup.io-43891",
             "specs": [
-                "<2.11.7"
+                "<0.11.1"
             ],
-            "v": "<2.11.7"
-        }
-    ],
-    "poorwsgi": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "poorwsgi 1.0.2 includes several security related enhancements related to secret key generation.",
-            "cve": "PVE-2021-26015",
-            "id": "pyup.io-26015",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29513",
+            "id": "pyup.io-43892",
             "specs": [
-                "<1.0.2"
+                "<0.11.1"
             ],
-            "v": "<1.0.2"
-        }
-    ],
-    "pootle": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "pootle before 2.8.0rc5 is vulnerable to several undisclosed security vulnerabilites.",
-            "cve": "PVE-2021-34211",
-            "id": "pyup.io-34211",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29578",
+            "id": "pyup.io-43895",
             "specs": [
-                "<2.8.0rc5"
+                "<0.11.1"
             ],
-            "v": "<2.8.0rc5"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "pootle before 2.8.0rc6 has multiple, undisclosed, security vulnerabilites that were found during an audit.",
-            "cve": "PVE-2021-34790",
-            "id": "pyup.io-34790",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29581",
+            "id": "pyup.io-43898",
             "specs": [
-                "<2.8.0rc6"
+                "<0.11.1"
             ],
-            "v": "<2.8.0rc6"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pootle 2.7.3 prevents the leak of user data.\r\nhttps://github.com/translate/pootle/commit/07839d4abe1663f890e28a6b2cc28b59148b184b",
-            "cve": "PVE-2021-42747",
-            "id": "pyup.io-42747",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29584",
+            "id": "pyup.io-43900",
             "specs": [
-                ">=2.7.0,<2.7.3"
+                "<0.11.1"
             ],
-            "v": ">=2.7.0,<2.7.3"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pootle before 2.7.3 is vulnerable to XSS.\r\nhttps://github.com/translate/pootle/commit/d36f91a9a3c022251d927a439a7566e57127367f\r\nhttps://github.com/translate/pootle/commit/82e6cb6c9b9468090d0b0cee81e706ee175d1e36\r\nhttps://github.com/translate/pootle/commit/7d5a80c3fdd9cf70ccb7a6966e964566c0f764ff",
-            "cve": "PVE-2021-34201",
-            "id": "pyup.io-34201",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29594",
+            "id": "pyup.io-43909",
             "specs": [
-                ">=2.7.0,<2.7.3"
+                "<0.11.1"
             ],
-            "v": ">=2.7.0,<2.7.3"
-        }
-    ],
-    "portray": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Portray 1.6.0 updates the minimum version of the 'mkdocs-material' to 7.0.0 to address a security concerns in earlier versions.",
-            "cve": "PVE-2021-40138",
-            "id": "pyup.io-40138",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29596",
+            "id": "pyup.io-43911",
             "specs": [
-                "<1.6.0"
+                "<0.11.1"
             ],
-            "v": "<1.6.0"
-        }
-    ],
-    "postfix-mta-sts-resolver": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "In postfix-mta-sts-resolver before 0.5.1, All users can receive incorrect response from daemon under rare conditions, rendering downgrade of effective STS policy.",
-            "cve": "CVE-2019-16791",
-            "id": "pyup.io-42264",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29528",
+            "id": "pyup.io-43912",
             "specs": [
-                "<0.5.1"
+                "<0.11.1"
             ],
-            "v": "<0.5.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Postfix-mta-sts-resolver 0.6.1 hardens the container security.",
-            "cve": "PVE-2021-37461",
-            "id": "pyup.io-37461",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29593",
+            "id": "pyup.io-43913",
             "specs": [
-                "<0.6.1"
+                "<0.11.1"
             ],
-            "v": "<0.6.1"
-        }
-    ],
-    "postorius": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5. An attacker (logged into any account) can send a crafted POST request to unsubscribe any user from a mailing list, also revealing whether that address was subscribed in the first place.",
-            "cve": "CVE-2021-40347",
-            "id": "pyup.io-42321",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29598",
+            "id": "pyup.io-43917",
             "specs": [
-                "<1.3.5"
+                "<0.11.1"
             ],
-            "v": "<1.3.5"
-        }
-    ],
-    "posty": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Posty version 2.1.0 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/nickpegg/posty/commit/d2f3fbd15cc685c425aaa3edc4a113c4218674ef",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41365",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29599",
+            "id": "pyup.io-43919",
             "specs": [
-                "<2.1.0"
+                "<0.11.1"
             ],
-            "v": "<2.1.0"
-        }
-    ],
-    "ppgan": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Ppgan version 0.1.3 includes a security patch for the function 'init' in 'ppgan/apps/first_order_predictor.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/PaddlePaddle/PaddleGAN/commit/b4f066016ba664b84a55d7894e554db771995187#diff-ea93fd79db0cbeaf277ce407386f1a8a5b7446fd0955294d922165b739eb2e52",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41366",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29600",
+            "id": "pyup.io-43920",
             "specs": [
-                "<0.1.3"
+                "<0.11.1"
             ],
-            "v": "<0.1.3"
-        }
-    ],
-    "pre-commit": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Pre-commit 1.10.4 replaces 'yaml.load' with safe alternative to avoid a remote code execution vulnerability.\r\nhttps://github.com/pre-commit/pre-commit/commit/6853f4aa4c8d7e411839bacc66876baea443186a",
-            "cve": "CVE-2017-18342",
-            "id": "pyup.io-42949",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29604",
+            "id": "pyup.io-43922",
             "specs": [
-                "<1.10.4"
+                "<0.11.1"
             ],
-            "v": "<1.10.4"
-        }
-    ],
-    "predictionio": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Predictionio 0.12.1 updates dependencies to include security fixes.",
-            "cve": "PVE-2021-41882",
-            "id": "pyup.io-41882",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29597",
+            "id": "pyup.io-43914",
             "specs": [
-                "<0.12.1"
+                "<0.11.1"
             ],
-            "v": "<0.12.1"
-        }
-    ],
-    "prefect": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Prefect 0.12.6 removes password from Postgres tasks' initialization methods for security.",
-            "cve": "PVE-2021-38663",
-            "id": "pyup.io-38663",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29530",
+            "id": "pyup.io-43915",
             "specs": [
-                "<0.12.6"
+                "<0.11.1"
             ],
-            "v": "<0.12.6"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Prefect 0.15.8 includes a Prefect Server update that bumps an upstream dependency to fix a security vulnerability. See CVE-2021-41249.",
-            "cve": "CVE-2021-41249",
-            "id": "pyup.io-42552",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29529",
+            "id": "pyup.io-43916",
             "specs": [
-                "<0.15.8"
+                "<0.11.1"
             ],
-            "v": "<0.15.8"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Prefect 0.15.8 includes a version of Prefect UI which updates a dependency (npm:graphiql) to include a security fix.",
-            "cve": "CVE-2021-41248",
-            "id": "pyup.io-42952",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes.",
+            "cve": "CVE-2021-29539",
+            "id": "pyup.io-40931",
             "specs": [
-                "<0.15.8"
+                "<0.11.1"
             ],
-            "v": "<0.15.8"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Prefect 0.5.1 bumps `distributed` to 1.26.1 for enhanced security features - [878].",
-            "cve": "PVE-2021-37020",
-            "id": "pyup.io-37020",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29523",
+            "id": "pyup.io-43856",
             "specs": [
-                "<0.5.1"
+                "<0.11.1"
             ],
-            "v": "<0.5.1"
-        }
-    ],
-    "press": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Press version 0.5.8 includes a security patch for the function 'configuration_from_yaml' in 'press/configuration/util.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/jr0d/press/commit/c641f54ed39d1c3a335cd967954760ede9454052#diff-482d133cd7fc1e6dde3facc3af875192a5f8397fa3054ff21956c05e1138f26f",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41367",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29524",
+            "id": "pyup.io-43860",
             "specs": [
-                "<0.5.8"
+                "<0.11.1"
             ],
-            "v": "<0.5.8"
-        }
-    ],
-    "pretaweb.healthcheck": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "pretaweb.healthcheck before 1.0 is vulnerable to DoS attacks.",
-            "cve": "PVE-2021-26016",
-            "id": "pyup.io-26016",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29520",
+            "id": "pyup.io-43861",
             "specs": [
-                "<1.0"
+                "<0.11.1"
             ],
-            "v": "<1.0"
-        }
-    ],
-    "priority": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.",
-            "cve": "CVE-2016-6580",
-            "id": "pyup.io-42335",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29564",
+            "id": "pyup.io-43862",
             "specs": [
-                "<1.2.0"
+                "<0.11.1"
             ],
-            "v": "<1.2.0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "priority before 1.2.0 is vulnerable to a denial of service attack whereby a remote peer can cause a user to insert an unbounded number of streams into the priority tree, eventually consuming all available memory.",
-            "cve": "PVE-2021-26017",
-            "id": "pyup.io-26017",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29521",
+            "id": "pyup.io-43863",
             "specs": [
-                "<1.2.0"
+                "<0.11.1"
             ],
-            "v": "<1.2.0"
-        }
-    ],
-    "prisma-cloud-pipeline": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Prisma-cloud-pipeline 0.1.3 updates pyyaml to v5.4.1 to include a security fix.",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-39686",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29601",
+            "id": "pyup.io-43923",
             "specs": [
-                "<0.1.3"
+                "<0.11.1"
             ],
-            "v": "<0.1.3"
-        }
-    ],
-    "privacyidea": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Privacyidea 3.4.1 uses a secure way to compare strings to avoid theoretical side channel attacks.",
-            "cve": "PVE-2021-39341",
-            "id": "pyup.io-39341",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29605",
+            "id": "pyup.io-43924",
             "specs": [
-                "<3.4.1"
+                "<0.11.1"
             ],
-            "v": "<3.4.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Privacyidea 3.6 includes more secure configuration defaults.",
-            "cve": "PVE-2021-40970",
-            "id": "pyup.io-40970",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29603",
+            "id": "pyup.io-43925",
             "specs": [
-                "<3.6"
+                "<0.11.1"
             ],
-            "v": "<3.6"
-        }
-    ],
-    "products-btreefolder2": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products-btreefolder2 version 2.13.4 includes a security declaration for 'BTreeFolder2Base.hasObject' method.",
-            "cve": "PVE-2021-42029",
-            "id": "pyup.io-42029",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29606",
+            "id": "pyup.io-43926",
             "specs": [
-                "<2.13.4"
+                "<0.11.1"
             ],
-            "v": "<2.13.4"
-        }
-    ],
-    "products-cmfcore": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products-cmfcore 2.1.0beta2 adds POST-only protections to security critical methods. See: CVE-2007-0240.",
-            "cve": "CVE-2007-0240",
-            "id": "pyup.io-36125",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29616",
+            "id": "pyup.io-43866",
             "specs": [
-                "<2.1.0beta2"
+                "<0.11.1"
             ],
-            "v": "<2.1.0beta2"
-        }
-    ],
-    "products-ploneformgen": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products-ploneformgen 1.7.19 and 1.8.1 include a fix for a XSS vulnerability that could be exploited by users with the ability to create forms.\r\nhttps://github.com/smcmahon/Products.PloneFormGen/commit/b9590e5573660ee6b8d151430ca2b459f05388ca",
-            "cve": "PVE-2021-35878",
-            "id": "pyup.io-35878",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29544",
+            "id": "pyup.io-43869",
             "specs": [
-                "<1.8.1"
+                "<0.11.1"
             ],
-            "v": "<1.8.1"
-        }
-    ],
-    "products-plonepas": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products-plonepas 3.9 fixes the cookie plugin's login handler to not trust the username from the request. Instead, now it's used the login name of the currently authenticated user. This fixes CVE-2009-0662.",
-            "cve": "CVE-2009-0662",
-            "id": "pyup.io-35982",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29610",
+            "id": "pyup.io-43871",
             "specs": [
-                "<3.9"
+                "<0.11.1"
             ],
-            "v": "<3.9"
-        }
-    ],
-    "products-zopetree": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products-zopetree 1.3 fixes a security hole in the tree state decompressing mechanism. Previous versions were vulnerable to a denial of service attack using large tree states.",
-            "cve": "PVE-2021-37726",
-            "id": "pyup.io-37726",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29568",
+            "id": "pyup.io-43873",
             "specs": [
-                "<1.3"
+                "<0.11.1"
             ],
-            "v": "<1.3"
-        }
-    ],
-    "products.cmfcontentpanels": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "products.cmfcontentpanels before 1.4.1 has two not disclosed security issues.",
-            "cve": "PVE-2021-26020",
-            "id": "pyup.io-26020",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29550",
+            "id": "pyup.io-43877",
             "specs": [
-                "<1.4.1"
+                "<0.11.1"
             ],
-            "v": "<1.4.1"
-        }
-    ],
-    "products.cmfcore": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Cross-site scripting (XSS) vulnerability in Zope 2.10.2 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors in a HTTP GET request. See: CVE-2007-0240.",
-            "cve": "CVE-2007-0240",
-            "id": "pyup.io-35820",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29514",
+            "id": "pyup.io-43880",
             "specs": [
-                "<2.1.0beta2"
+                "<0.11.1"
             ],
-            "v": "<2.1.0beta2"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.cmfcore 2.3.0beta tightens the security for anonymous test user.",
-            "cve": "PVE-2021-35818",
-            "id": "pyup.io-35818",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29535",
+            "id": "pyup.io-43885",
             "specs": [
-                "<2.3.0beta"
+                "<0.11.1"
             ],
-            "v": "<2.3.0beta"
-        }
-    ],
-    "products.cmfplone": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products.cmfplone versions 4.3.20, 5.1.7, 5.2.5 and 6.0.0a1.dev0 integrate a fix for CVE-2020-7936: An open redirect on the login form (and possibly other places) in Plone 4.0 through 5.2.1 allows an attacker to craft a link to a Plone Site that, when followed, and possibly after login, will redirect to an attacker's site.",
-            "cve": "CVE-2020-7936",
-            "id": "pyup.io-41842",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29607",
+            "id": "pyup.io-43930",
             "specs": [
-                "<4.3.20",
-                ">4.3.20,<5.1.7",
-                ">5.1.7,<5.2.5",
-                ">5.2.5,<6.0.0a1.dev0"
+                "<0.11.1"
             ],
-            "v": "<4.3.20,>4.3.20,<5.1.7,>5.1.7,<5.2.5,>5.2.5,<6.0.0a1.dev0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.cmfplone versions 4.3.20, 5.1.7, 5.2.5 and 6.0.0a1.dev0 integrate a fix for CVE-2020-7940: Missing password strength checks on some forms in Plone 4.3 through 5.2.0 allow users to set weak passwords, leading to easier cracking.",
-            "cve": "CVE-2020-7940",
-            "id": "pyup.io-41959",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29611",
+            "id": "pyup.io-43931",
             "specs": [
-                "<4.3.20",
-                ">4.3.20,<5.1.7",
-                ">5.1.7,<5.2.5",
-                ">5.2.5,<6.0.0a1.dev0"
+                "<0.11.1"
             ],
-            "v": "<4.3.20,>4.3.20,<5.1.7,>5.1.7,<5.2.5,>5.2.5,<6.0.0a1.dev0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "In Products.CMFPlone before 5.1b1, it's possible to access private content via str.format in through-the-web templates and scripts.",
-            "cve": "PVE-2021-32997",
-            "id": "pyup.io-32997",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29538",
+            "id": "pyup.io-43888",
             "specs": [
-                "<5.1b1"
+                "<0.11.1"
             ],
-            "v": "<5.1b1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.cmfplone 5.2.2 contains Products.isurlinportal 1.1.0 with a minor security hardening fix.",
-            "cve": "PVE-2021-38701",
-            "id": "pyup.io-38701",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29612",
+            "id": "pyup.io-43932",
             "specs": [
-                "<5.2.2"
+                "<0.11.1"
             ],
-            "v": "<5.2.2"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.cmfplone 5.2.2rc1 fixes that isURLInPortal could be tricked into accepting malicious links.",
-            "cve": "PVE-2021-39021",
-            "id": "pyup.io-39021",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29546",
+            "id": "pyup.io-43933",
             "specs": [
-                "<5.2.2rc1"
+                "<0.11.1"
             ],
-            "v": "<5.2.2rc1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.cmfplone versions 5.2.5 and 6.0.0a1.dev0 include a fix for CVE-2021-32633. The vulnerability was present in its dependency \"Zope\".\r\nhttps://plone.org/security/hotfix/20210518/remote-code-execution-via-traversal-in-expressions",
-            "cve": "CVE-2021-32633",
-            "id": "pyup.io-41960",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29540",
+            "id": "pyup.io-43889",
             "specs": [
-                ">5.2.5,<6.0.0a1.dev0",
-                "<5.2.5"
+                "<0.11.1"
             ],
-            "v": ">5.2.5,<6.0.0a1.dev0,<5.2.5"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.cmfplone versions 5.2.5 and 6.0.0a1.dev0 integrates a fix for CVE-2021-33507: Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.\r\nhttps://plone.org/security/hotfix/20210518/reflected-xss-in-various-spots",
-            "cve": "CVE-2021-33507",
-            "id": "pyup.io-41961",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29580",
+            "id": "pyup.io-43894",
             "specs": [
-                ">5.2.5,<6.0.0a1.dev0",
-                "<5.2.5"
+                "<0.11.1"
             ],
-            "v": ">5.2.5,<6.0.0a1.dev0,<5.2.5"
-        }
-    ],
-    "products.cmfquickinstallertool": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products.cmfquickinstallertool before 3.0.14 is vulnerable to several cross site scripting (XSS) attacks.\r\nhttps://github.com/plone/Products.CMFQuickInstallerTool/commit/1cd430b74353ac023493e2dd19613a2e390c451d",
-            "cve": "CVE-2016-7138",
-            "id": "pyup.io-26021",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29613",
+            "id": "pyup.io-43934",
             "specs": [
-                "<3.0.14"
+                "<0.11.1"
             ],
-            "v": "<3.0.14"
-        }
-    ],
-    "products.cmfuid": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products.cmfuid before 2.1.0beta2 has a vulnerability because it includes the Zope dependency version <2.10.2, which has an injection vulnerability. See: CVE-2007-0240.",
-            "cve": "CVE-2007-0240",
-            "id": "pyup.io-36300",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29615",
+            "id": "pyup.io-43935",
             "specs": [
-                "<2.1.0beta2"
+                "<0.11.1"
             ],
-            "v": "<2.1.0beta2"
-        }
-    ],
-    "products.dcworkflow": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products.dcworkflow 2.1.0beta2 adds POST-only protections to security critical methods. See: CVE-2007-0240.",
-            "cve": "CVE-2007-0240",
-            "id": "pyup.io-38035",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29579",
+            "id": "pyup.io-43896",
             "specs": [
-                "<2.1.0beta2"
+                "<0.11.1"
             ],
-            "v": "<2.1.0beta2"
-        }
-    ],
-    "products.genericsetup": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products.GenericSetup is a mini-framework for expressing the configured state of a Zope Site as a set of filesystem artifacts. In Products.GenericSetup before version 2.1.1 there is an information disclosure vulnerability - anonymous visitors may view log and snapshot files generated by the Generic Setup Tool. The problem has been fixed in version 2.1.1. Depending on how you have installed Products.GenericSetup, you should change the buildout version pin to 2.1.1 and re-run the buildout, or if you used pip simply do pip install `\"Products.GenericSetup>=2.1.1\"`.",
-            "cve": "CVE-2021-21360",
-            "id": "pyup.io-39685",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29582",
+            "id": "pyup.io-43899",
             "specs": [
-                "<2.1.1"
+                "<0.11.1"
             ],
-            "v": "<2.1.1"
-        }
-    ],
-    "products.isurlinportal": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products.isurlinportal 1.2.0 includes a fix for security issue: Treat urls like ``https:example.org`` without slashes as outside the portal. Some browsers would redirect to example.org, some would redirect to a non-existing local page.",
-            "cve": "PVE-2021-41086",
-            "id": "pyup.io-41086",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29583",
+            "id": "pyup.io-43901",
             "specs": [
-                "<1.2.0"
+                "<0.11.1"
             ],
-            "v": "<1.2.0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.isurlinportal version 1.2.0 includes a fix for CVE-2021-32806: Versions of products.isurlinportal prior to 1.2.0 have an open redirect vulnerability. Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like \"https://example.org\" is not in the portal. The url \"https:example.org\" without slashes is considered to be in the portal. When redirecting, some browsers go to \"https://example.org\", others give an error.\r\nAttackers may use this to redirect victims to their site, especially as part of a phishing attack.\r\nhttps://github.com/plone/Products.isurlinportal/security/advisories/GHSA-q3m9-9fj2-mfwr\r\nhttps://github.com/plone/Products.isurlinportal/commit/d4fd34990d18adf05a10dc5e2bb4b066798280ba",
-            "cve": "CVE-2021-32806",
-            "id": "pyup.io-41068",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29585",
+            "id": "pyup.io-43902",
             "specs": [
-                "<1.2.0"
+                "<0.11.1"
             ],
-            "v": "<1.2.0"
-        }
-    ],
-    "products.ldapuserfolder": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges.",
-            "cve": "PVE-2021-33148",
-            "id": "pyup.io-33148",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29549",
+            "id": "pyup.io-43936",
             "specs": [
-                "<2.19"
+                "<0.11.1"
             ],
-            "v": "<2.19"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.ldapuserfolder version 2.20 includes a fix for CVE-2010-2944: The authenticate function in LDAPUserFolder/LDAPUserFolder.py in zope-ldapuserfolder 2.9-1 does not verify the password for the emergency account, which allows remote attackers to gain privileges.\r\nhttps://github.com/dataflake/Products.LDAPUserFolder/commit/246257dbe5f73a6fd3c3e597814038977004cdd7",
-            "cve": "CVE-2010-2944",
-            "id": "pyup.io-26023",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29618",
+            "id": "pyup.io-43937",
             "specs": [
-                "<2.20"
+                "<0.11.1"
             ],
-            "v": "<2.20"
-        }
-    ],
-    "products.ploneformgen": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products.ploneformgen 1.7.19 and 1.8.1 include a fix for a XSS vulnerability that could be exploited by users with the ability to create forms.\r\nhttps://github.com/smcmahon/Products.PloneFormGen/commit/b9590e5573660ee6b8d151430ca2b459f05388ca",
-            "cve": "PVE-2021-26024",
-            "id": "pyup.io-26024",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29617",
+            "id": "pyup.io-43938",
             "specs": [
-                "<1.7.19",
-                ">=1.8.0.alpha1,<1.8.1"
+                "<0.11.1"
             ],
-            "v": "<1.7.19,>=1.8.0.alpha1,<1.8.1"
-        }
-    ],
-    "products.plonepas": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "The PlonePAS product 3.x before 3.9 and 3.2.x before 3.2.2, a product for Plone, does not properly handle the login form, which allows remote authenticated users to acquire the identity of an arbitrary user via unspecified vectors.",
-            "cve": "CVE-2009-0662",
-            "id": "pyup.io-33149",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29553",
+            "id": "pyup.io-43939",
             "specs": [
-                ">3.2.2,<3.9"
+                "<0.11.1"
             ],
-            "v": ">3.2.2,<3.9"
-        }
-    ],
-    "products.pluggableauthservice": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin. The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do `pip install \"Products.PluggableAuthService>=2.6.0\"`.",
-            "cve": "CVE-2021-21336",
-            "id": "pyup.io-39681",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29552",
+            "id": "pyup.io-43940",
             "specs": [
-                "<2.6.0"
+                "<0.11.1"
             ],
-            "v": "<2.6.0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.PluggableAuthService is a pluggable Zope authentication and authorization framework. In Products.PluggableAuthService before version 2.6.0 there is an open redirect vulnerability. A maliciously crafted link to the login form and login functionality could redirect the browser to a different website. The problem has been fixed in version 2.6.1. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to `2.6.1` and re-run the buildout, or if you used `pip` simply do `pip install \"Products.PluggableAuthService>=2.6.1\".",
-            "cve": "CVE-2021-21337",
-            "id": "pyup.io-39682",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29619",
+            "id": "pyup.io-43941",
             "specs": [
-                "<2.6.0"
+                "<0.11.1"
             ],
-            "v": "<2.6.0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.",
-            "cve": "CVE-2021-33507",
-            "id": "pyup.io-39695",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2020-8177",
+            "id": "pyup.io-43943",
             "specs": [
-                "<2.6.2"
+                "<0.11.1"
             ],
-            "v": "<2.6.2"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Products.pluggableauthservice 2.6.3 fixes CSRF token access for tigher TAL path expression security in Zope 5.2.1.",
-            "cve": "PVE-2021-40631",
-            "id": "pyup.io-40631",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29555",
+            "id": "pyup.io-43944",
             "specs": [
-                "<2.6.3"
+                "<0.11.1"
             ],
-            "v": "<2.6.3"
-        }
-    ],
-    "products.poi": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "products.poi before 2.2.3 allows anonymous users to see issues inside private folders.",
-            "cve": "PVE-2021-26027",
-            "id": "pyup.io-26027",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29557",
+            "id": "pyup.io-43945",
             "specs": [
-                "<2.2.3"
+                "<0.11.1"
             ],
-            "v": "<2.2.3"
-        }
-    ],
-    "project-manager": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Project-manager version 0.2.0 includes security patches for several functions. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/kpj/project_manager/commit/07aef0e023f07563ae9141674e1de3508e178358#diff-03ec8dd0ad6683512ebfb1545fbf01618075f2118c80cc4878cd76ff5bf26aeb",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-41371",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29586",
+            "id": "pyup.io-43903",
             "specs": [
-                "<0.2.0"
+                "<0.11.1"
             ],
-            "v": "<0.2.0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Project-manager 0.2.0 is vulnerable to CVE-2020-14343 due to using  \"yaml.full_load()\" and a potentially vulnerable version of its dependency \"pyyaml\". See CVE-2020-14343.\r\nhttps://github.com/kpj/project_manager/commit/07aef0e023f07563ae9141674e1de3508e178358",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-41756",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29588",
+            "id": "pyup.io-43904",
             "specs": [
-                "==0.2.0"
+                "<0.11.1"
             ],
-            "v": "==0.2.0"
-        }
-    ],
-    "projen": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Projen 0.3.10 inlcudes a fix for a security issue with standard-version 8.0.0.",
-            "cve": "PVE-2021-39417",
-            "id": "pyup.io-39417",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2020-8284",
+            "id": "pyup.io-43946",
             "specs": [
-                "<0.3.10"
+                "<0.11.1"
             ],
-            "v": "<0.3.10"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Projen 0.7.0 addresses a security issue with standard-version 8.0.0.",
-            "cve": "PVE-2021-39416",
-            "id": "pyup.io-39416",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2020-8231",
+            "id": "pyup.io-43947",
             "specs": [
-                "<0.7.0"
+                "<0.11.1"
             ],
-            "v": "<0.7.0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Projen 0.8.0 addresses a security issue with standard-version 8.0.0.",
-            "cve": "PVE-2021-39415",
-            "id": "pyup.io-39415",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29590",
+            "id": "pyup.io-43905",
             "specs": [
-                "<0.8.0"
+                "<0.11.1"
             ],
-            "v": "<0.8.0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Projen 0.9.0 addresses a security issue with standard-version 8.0.0.",
-            "cve": "PVE-2021-39414",
-            "id": "pyup.io-39414",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29556",
+            "id": "pyup.io-43948",
             "specs": [
-                "<0.9.0"
+                "<0.11.1"
             ],
-            "v": "<0.9.0"
-        }
-    ],
-    "proxy.py": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "before_upstream_connection in AuthPlugin in http/proxy/auth.py in proxy.py before 2.3.1 accepts incorrect Proxy-Authorization header data because of a boolean confusion (and versus or).",
-            "cve": "CVE-2021-3116",
-            "id": "pyup.io-42312",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29558",
+            "id": "pyup.io-43949",
             "specs": [
-                "<2.3.1"
+                "<0.11.1"
             ],
-            "v": "<2.3.1"
-        }
-    ],
-    "psd-tools": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "An issue was discovered in psd-tools before 1.9.4. The Cython implementation of RLE decoding did not check for malicious data.",
-            "cve": "CVE-2020-10571",
-            "id": "pyup.io-42270",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29559",
+            "id": "pyup.io-43950",
             "specs": [
-                "<1.9.4"
+                "<0.11.1"
             ],
-            "v": "<1.9.4"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
-            "cve": "CVE-2019-19911",
-            "id": "pyup.io-38525",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2020-8286",
+            "id": "pyup.io-43951",
             "specs": [
-                "<=1.9.18"
+                "<0.11.1"
             ],
-            "v": "<=1.9.18"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
-            "cve": "CVE-2020-5310",
-            "id": "pyup.io-43468",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29565",
+            "id": "pyup.io-43952",
             "specs": [
-                "<=1.9.18"
+                "<0.11.1"
             ],
-            "v": "<=1.9.18"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
-            "cve": "CVE-2020-5311",
-            "id": "pyup.io-43469",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29592",
+            "id": "pyup.io-43906",
             "specs": [
-                "<=1.9.18"
+                "<0.11.1"
             ],
-            "v": "<=1.9.18"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
-            "cve": "CVE-2020-5312",
-            "id": "pyup.io-43470",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29591",
+            "id": "pyup.io-43907",
             "specs": [
-                "<=1.9.18"
+                "<0.11.1"
             ],
-            "v": "<=1.9.18"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Psd-tools 1.9.18 includes a version of 'pillow' vulnerable to several CVEs.",
-            "cve": "CVE-2020-5313",
-            "id": "pyup.io-43471",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29595",
+            "id": "pyup.io-43908",
             "specs": [
-                "<=1.9.18"
+                "<0.11.1"
             ],
-            "v": "<=1.9.18"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Psd-tools 1.9.4 fixes a security issue related to compression in 1.8.37 - 1.9.3.",
-            "cve": "PVE-2021-37654",
-            "id": "pyup.io-37654",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29518",
+            "id": "pyup.io-43953",
             "specs": [
-                ">=1.8.37,<=1.9.3"
+                "<0.11.1"
             ],
-            "v": ">=1.8.37,<=1.9.3"
-        }
-    ],
-    "psd-tools3": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Psd-tools3 1.9.1 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-42025",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29526",
+            "id": "pyup.io-43954",
             "specs": [
-                "<1.9.1"
+                "<0.11.1"
             ],
-            "v": "<1.9.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Psd-tools3 1.9.1 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-43548",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29516",
+            "id": "pyup.io-43955",
             "specs": [
-                "<1.9.1"
+                "<0.11.1"
             ],
-            "v": "<1.9.1"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Psd-tools3 1.9.1 updates its dependency \"pillow\" to v8.3.2 to include security fixes.",
-            "cve": "CVE-2021-34552",
-            "id": "pyup.io-43549",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29517",
+            "id": "pyup.io-43956",
             "specs": [
-                "<1.9.1"
+                "<0.11.1"
             ],
-            "v": "<1.9.1"
-        }
-    ],
-    "psiz": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Psiz 0.4.1 updates the 'TensorFlow' requirement to address a vulnerability in 2.3.0.",
-            "cve": "PVE-2021-40498",
-            "id": "pyup.io-40498",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29569",
+            "id": "pyup.io-43957",
             "specs": [
-                "<0.4.1"
+                "<0.11.1"
             ],
-            "v": "<0.4.1"
-        }
-    ],
-    "psutil": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "psutil (aka python-psutil) through 5.6.5 can have a double free. This occurs because of refcount mishandling within a while or for loop that converts system data into a Python object. See CVE-2019-18874.",
-            "cve": "CVE-2019-18874",
-            "id": "pyup.io-37765",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29562",
+            "id": "pyup.io-43958",
             "specs": [
-                "<=5.6.5"
+                "<0.11.1"
             ],
-            "v": "<=5.6.5"
-        }
-    ],
-    "psycopg": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Psycopg 3.0.4 updates its dependency 'libpq' to at least v14.1 to include a  security fix.",
-            "cve": "CVE-2021-23214",
-            "id": "pyup.io-42693",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29561",
+            "id": "pyup.io-43959",
             "specs": [
-                "<3.0.4"
+                "<0.11.1"
             ],
-            "v": "<3.0.4"
-        }
-    ],
-    "ptah": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "ptah before 0.3.3 is vulnerable to a undisclosed attack.",
-            "cve": "PVE-2021-26028",
-            "id": "pyup.io-26028",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29570",
+            "id": "pyup.io-43960",
             "specs": [
-                "<0.3.3"
+                "<0.11.1"
             ],
-            "v": "<0.3.3"
-        }
-    ],
-    "puccini": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Puccini 0.3 improves file output security.",
-            "cve": "PVE-2021-40026",
-            "id": "pyup.io-40026",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29575",
+            "id": "pyup.io-43961",
             "specs": [
-                "<0.3"
+                "<0.11.1"
             ],
-            "v": "<0.3"
-        }
-    ],
-    "pulpcore": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Pulpcore 3.11.0 adds the 'ALLOWED_CONTENT_CHECKSUMS' setting to remove 'md5' and 'sha1' since they are not secure. Now, by default, the 'ALLOWED_CONTENT_CHECKSUMS' contain 'sha224', 'sha256', 'sha384', and 'sha512'.",
-            "cve": "PVE-2021-40315",
-            "id": "pyup.io-40315",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29572",
+            "id": "pyup.io-43893",
             "specs": [
-                "<3.11.0"
+                "<0.11.1"
             ],
-            "v": "<3.11.0"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pulpcore version 3.14.6 stops using insecure hash function blake2s for calculating 64 bit lock identifier from uuid.",
-            "cve": "PVE-2021-41801",
-            "id": "pyup.io-41801",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29573",
+            "id": "pyup.io-43962",
             "specs": [
-                "<3.14.6"
+                "<0.11.1"
             ],
-            "v": "<3.14.6"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pulpcore 3.15.0 stops using the insecure hash function blake2s for calculating 64-bit lock identifier from uuid.\r\nhttps://pulp.plan.io/issues/9249",
-            "cve": "PVE-2021-41262",
-            "id": "pyup.io-41262",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29515",
+            "id": "pyup.io-43963",
             "specs": [
-                "<3.15.0"
+                "<0.11.1"
             ],
-            "v": "<3.15.0"
-        }
-    ],
-    "pulumi-kubernetes": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Pulumi-kubernetes 2.6.0 includes a fix for CVE-2019-20477: PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.",
-            "cve": "CVE-2019-20477",
-            "id": "pyup.io-38772",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29574",
+            "id": "pyup.io-43964",
             "specs": [
-                "<2.6.0"
+                "<0.11.1"
             ],
-            "v": "<2.6.0"
-        }
-    ],
-    "puput": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Puput 1.0.4 updates the Django version to greater than 2.1.6 to fix security issues.",
-            "cve": "CVE-2019-3498",
-            "id": "pyup.io-43662",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29576",
+            "id": "pyup.io-43965",
             "specs": [
-                "<1.0.4"
+                "<0.11.1"
             ],
-            "v": "<1.0.4"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Puput 1.0.4 updates the Django version to greater than 2.1.6 to fix security issues.",
-            "cve": "CVE-2018-14574",
-            "id": "pyup.io-43663",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29571",
+            "id": "pyup.io-43966",
             "specs": [
-                "<1.0.4"
+                "<0.11.1"
             ],
-            "v": "<1.0.4"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Puput 1.0.4 updates the Django version to greater than 2.1.6 to fix security issues.",
-            "cve": "CVE-2018-7537",
-            "id": "pyup.io-43664",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29614",
+            "id": "pyup.io-43968",
             "specs": [
-                "<1.0.4"
+                "<0.11.1"
             ],
-            "v": "<1.0.4"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Puput 1.0.4 updates the Django version to greater than 2.1.6 to fix security issues.",
-            "cve": "CVE-2019-6975",
-            "id": "pyup.io-37153",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2020-8285",
+            "id": "pyup.io-43969",
             "specs": [
-                "<1.0.4"
+                "<0.11.1"
             ],
-            "v": "<1.0.4"
-        }
-    ],
-    "pupyl": [
+            "v": "<0.11.1"
+        },
         {
-            "advisory": "Pupyl 0.10.4 includes a security update regarding its dependencies. No details are provided.",
-            "cve": "PVE-2021-39208",
-            "id": "pyup.io-39208",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-37686",
+            "id": "pyup.io-43970",
             "specs": [
-                "<0.10.4"
+                "<0.11.1"
             ],
-            "v": "<0.10.4"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pupyl 0.10.5 updated its dependencies version for security reasons.",
-            "cve": "PVE-2021-39392",
-            "id": "pyup.io-39392",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29525",
+            "id": "pyup.io-43857",
             "specs": [
-                "<0.10.5"
+                "<0.11.1"
             ],
-            "v": "<0.10.5"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pupyl before 0.10.6 includes Tensorflow 2.3.1 which has security issues (see issue 73) and should therefore be upgraded to 2.4.0. However, the last version of Tensorflow has issues on its compilation (see Tensorflow issue 45744), and hence must be downgraded to ensure that the library still works.",
-            "cve": "PVE-2021-39400",
-            "id": "pyup.io-39400",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29519",
+            "id": "pyup.io-43858",
             "specs": [
-                "<0.10.6"
+                "<0.11.1"
             ],
-            "v": "<0.10.6"
+            "v": "<0.11.1"
         },
         {
-            "advisory": "Pupyl 0.11.1 updates the 'Tensorflow' underlying dependency to the latest version due to a security flaw in versions previous to 2.5.0.",
-            "cve": "PVE-2021-40931",
-            "id": "pyup.io-40931",
+            "advisory": "Pupyl 0.11.1 updates 'Tensorflow' to v2.5.0 to include security fixes",
+            "cve": "CVE-2021-29522",
+            "id": "pyup.io-43859",
             "specs": [
                 "<0.11.1"
             ],
@@ -27412,8 +33116,8 @@
     "py42": [
         {
             "advisory": "Py42 drops support for Python versions 2.7 and 3.5, that no longer receive security updates.",
-            "cve": "CVE-2021-3177",
-            "id": "pyup.io-43359",
+            "cve": "CVE-2021-23336",
+            "id": "pyup.io-42125",
             "specs": [
                 "<1.17.0"
             ],
@@ -27421,8 +33125,8 @@
         },
         {
             "advisory": "Py42 drops support for Python versions 2.7 and 3.5, that no longer receive security updates.",
-            "cve": "CVE-2019-20907",
-            "id": "pyup.io-43360",
+            "cve": "CVE-2021-3737",
+            "id": "pyup.io-43362",
             "specs": [
                 "<1.17.0"
             ],
@@ -27430,8 +33134,8 @@
         },
         {
             "advisory": "Py42 drops support for Python versions 2.7 and 3.5, that no longer receive security updates.",
-            "cve": "CVE-2020-27619",
-            "id": "pyup.io-43361",
+            "cve": "CVE-2021-3177",
+            "id": "pyup.io-43359",
             "specs": [
                 "<1.17.0"
             ],
@@ -27439,8 +33143,8 @@
         },
         {
             "advisory": "Py42 drops support for Python versions 2.7 and 3.5, that no longer receive security updates.",
-            "cve": "CVE-2021-3737",
-            "id": "pyup.io-43362",
+            "cve": "CVE-2019-20907",
+            "id": "pyup.io-43360",
             "specs": [
                 "<1.17.0"
             ],
@@ -27448,8 +33152,8 @@
         },
         {
             "advisory": "Py42 drops support for Python versions 2.7 and 3.5, that no longer receive security updates.",
-            "cve": "CVE-2021-23336",
-            "id": "pyup.io-42125",
+            "cve": "CVE-2020-27619",
+            "id": "pyup.io-43361",
             "specs": [
                 "<1.17.0"
             ],
@@ -27465,6 +33169,17 @@
             "v": "<1.5.1"
         }
     ],
+    "py7zr": [
+        {
+            "advisory": "Py7zr 0.17.3 protects against directory traversal attacks by checking file paths in ArchiveFile.\r\nhttps://github.com/miurahr/py7zr/commit/2cb066688b05ee7427f236fd35f5598112e9d501",
+            "cve": "PVE-2022-44652",
+            "id": "pyup.io-44652",
+            "specs": [
+                "<0.17.3"
+            ],
+            "v": "<0.17.3"
+        }
+    ],
     "pyamf": [
         {
             "advisory": "pyamf 0.8 fixes a security issue and now wrappes all xml parsing in ``defusedxml`` to protect against any XML entity attacks. See https://www.owasp.org/index.php/XML_External_Entity_(XXE)_Processing for more details. Thanks to Nicolas Gr\u00e9goire (Agarri_FR) for the report.",
@@ -28055,15 +33770,6 @@
             ],
             "v": "<1.0.0"
         },
-        {
-            "advisory": "pyjwt before 1.0.0  allows to bypass signature verification by setting the alg header to None.",
-            "cve": "PVE-2021-26040",
-            "id": "pyup.io-26040",
-            "specs": [
-                "<1.0.0"
-            ],
-            "v": "<1.0.0"
-        },
         {
             "advisory": "In PyJWT 1.5.0 and below the `invalid_strings` check in `HMACAlgorithm.prepare_key` does not account for all PEM encoded public keys. Specifically, the PKCS1 PEM encoded format would be allowed because it is prefaced with the string `-----BEGIN RSA PUBLIC KEY-----` which is not accounted for. This enables symmetric/asymmetric key confusion attacks against users using the PKCS1 PEM encoded public keys, which would allow an attacker to craft JWTs from scratch.",
             "cve": "PVE-2021-35014",
@@ -28230,17 +33936,17 @@
     "pylsr": [
         {
             "advisory": "Pylsr 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-41733",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-41299",
             "specs": [
                 "<2021"
             ],
             "v": "<2021"
         },
         {
-            "advisory": "Pylsr 2021 updates its dependency \"pillow\" to a secure version. See: CVE-2020-35653.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-41734",
+            "advisory": "Pylsr 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-41733",
             "specs": [
                 "<2021"
             ],
@@ -28248,17 +33954,17 @@
         },
         {
             "advisory": "Pylsr 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-41737",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-41736",
             "specs": [
                 "<2021"
             ],
             "v": "<2021"
         },
         {
-            "advisory": "Pylsr 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-41735",
+            "advisory": "Pylsr 2021 updates its dependency \"pillow\" to a secure version. See: CVE-2020-35653.",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-41734",
             "specs": [
                 "<2021"
             ],
@@ -28266,8 +33972,8 @@
         },
         {
             "advisory": "Pylsr 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-41299",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-41735",
             "specs": [
                 "<2021"
             ],
@@ -28275,8 +33981,8 @@
         },
         {
             "advisory": "Pylsr 2021 updates its dependency \"pillow\" to a version >= 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-41736",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-41737",
             "specs": [
                 "<2021"
             ],
@@ -28547,17 +34253,8 @@
     "pyprt": [
         {
             "advisory": "Pyprt 1.4.0 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28678",
-            "id": "pyup.io-43019",
-            "specs": [
-                "<1.4.0"
-            ],
-            "v": "<1.4.0"
-        },
-        {
-            "advisory": "Pyprt 1.4.0 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-25288",
-            "id": "pyup.io-43017",
+            "cve": "CVE-2021-25287",
+            "id": "pyup.io-43018",
             "specs": [
                 "<1.4.0"
             ],
@@ -28565,8 +34262,8 @@
         },
         {
             "advisory": "Pyprt 1.4.0 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-25287",
-            "id": "pyup.io-43018",
+            "cve": "CVE-2021-28678",
+            "id": "pyup.io-43019",
             "specs": [
                 "<1.4.0"
             ],
@@ -28600,13 +34297,76 @@
             "v": "<1.4.0"
         },
         {
-            "advisory": "An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.",
+            "advisory": "Pyprt 1.4.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
             "cve": "CVE-2021-33503",
             "id": "pyup.io-41220",
             "specs": [
                 "<1.4.0"
             ],
             "v": "<1.4.0"
+        },
+        {
+            "advisory": "Pyprt 1.4.0 updates its dependency 'pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-25288",
+            "id": "pyup.io-43017",
+            "specs": [
+                "<1.4.0"
+            ],
+            "v": "<1.4.0"
+        },
+        {
+            "advisory": "Pyprt 1.5.0 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-44553",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Pyprt 1.5.0 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-34552",
+            "id": "pyup.io-44490",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Pyprt 1.5.0 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-44554",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Pyprt 1.5.0 updates its dependency 'babel' to v2.9.1 to include a security fix.",
+            "cve": "CVE-2021-20095",
+            "id": "pyup.io-44555",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Pyprt 1.5.0 updates its dependency 'jupyterlab' to v3.0.17 to include a security fix.",
+            "cve": "CVE-2021-32797",
+            "id": "pyup.io-44556",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Pyprt 1.5.0 updates its dependency 'notebook' to v6.4.1 to include a security fix.",
+            "cve": "CVE-2021-32798",
+            "id": "pyup.io-44557",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
         }
     ],
     "pyqlib": [
@@ -28770,15 +34530,6 @@
         }
     ],
     "pyro4": [
-        {
-            "advisory": "Pyro4 version 4.62 adds support for SSL/TLS.",
-            "cve": "PVE-2021-41895",
-            "id": "pyup.io-41895",
-            "specs": [
-                "<4.62"
-            ],
-            "v": "<4.62"
-        },
         {
             "advisory": "Pyro4 version 4.72 deprecates the -k command line option to supply a HMAC encryption key for the name server, nsc, echoserver, flameserver and httpgateway tools (and prints a warning if used). That's because the key used is plainly visible. For proper security, use Pyro's 2-way SSL feature. Alternatively, you can set the HMAC key in the (new) environment variable PYRO_HMAC_KEY if you have to use it before launching the aforementioned tools.",
             "cve": "PVE-2021-41894",
@@ -28947,7 +34698,7 @@
     ],
     "pyserini": [
         {
-            "advisory": "Pyserini 0.11.0.0 includes a version of 'log4j' affected by critical and severe vulnerabilities.",
+            "advisory": "Pyserini 0.11.0.0 and prior includes a version of Anserini affected by critical and severe vulnerabilities, related to log4j.",
             "cve": "CVE-2021-44228",
             "id": "pyup.io-43606",
             "specs": [
@@ -28956,7 +34707,16 @@
             "v": "<=0.11.0.0"
         },
         {
-            "advisory": "Pyserini 0.11.0.0 includes a version of 'log4j' affected by critical and severe vulnerabilities.",
+            "advisory": "Pyserini 0.11.0.0 and prior includes a version of Anserini affected by critical and severe vulnerabilities, related to log4j.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44462",
+            "specs": [
+                "<=0.11.0.0"
+            ],
+            "v": "<=0.11.0.0"
+        },
+        {
+            "advisory": "Pyserini 0.11.0.0 and prior includes a version of Anserini affected by critical and severe vulnerabilities, related to log4j.",
             "cve": "CVE-2021-45105",
             "id": "pyup.io-43608",
             "specs": [
@@ -28965,7 +34725,7 @@
             "v": "<=0.11.0.0"
         },
         {
-            "advisory": "Pyserini 0.11.0.0 includes a version of 'log4j' affected by critical and severe vulnerabilities.",
+            "advisory": "Pyserini 0.11.0.0 and prior includes a version of Anserini affected by critical and severe vulnerabilities, related to log4j.",
             "cve": "CVE-2021-45046",
             "id": "pyup.io-43607",
             "specs": [
@@ -29010,8 +34770,8 @@
     "pysstv": [
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25290",
-            "id": "pyup.io-43555",
+            "cve": "CVE-2021-25289",
+            "id": "pyup.io-40228",
             "specs": [
                 "<0.5"
             ],
@@ -29019,17 +34779,17 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25293",
-            "id": "pyup.io-43558",
+            "cve": "CVE-2021-25290",
+            "id": "pyup.io-43555",
             "specs": [
                 "<0.5"
             ],
             "v": "<0.5"
         },
         {
-            "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-43564",
+            "advisory": "Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
+            "cve": "CVE-2020-15999",
+            "id": "pyup.io-43565",
             "specs": [
                 "<0.5"
             ],
@@ -29037,8 +34797,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-15999",
-            "id": "pyup.io-43565",
+            "cve": "CVE-2021-25291",
+            "id": "pyup.io-43556",
             "specs": [
                 "<0.5"
             ],
@@ -29046,8 +34806,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35653",
-            "id": "pyup.io-43559",
+            "cve": "CVE-2021-25292",
+            "id": "pyup.io-43557",
             "specs": [
                 "<0.5"
             ],
@@ -29055,8 +34815,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35654",
-            "id": "pyup.io-43560",
+            "cve": "CVE-2021-25293",
+            "id": "pyup.io-43558",
             "specs": [
                 "<0.5"
             ],
@@ -29064,8 +34824,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-35655",
-            "id": "pyup.io-43561",
+            "cve": "CVE-2020-35653",
+            "id": "pyup.io-43559",
             "specs": [
                 "<0.5"
             ],
@@ -29073,8 +34833,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-43562",
+            "cve": "CVE-2020-35654",
+            "id": "pyup.io-43560",
             "specs": [
                 "<0.5"
             ],
@@ -29082,8 +34842,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-43563",
+            "cve": "CVE-2020-35655",
+            "id": "pyup.io-43561",
             "specs": [
                 "<0.5"
             ],
@@ -29091,8 +34851,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-11538",
-            "id": "pyup.io-43566",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-43562",
             "specs": [
                 "<0.5"
             ],
@@ -29100,8 +34860,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2020-10994",
-            "id": "pyup.io-43567",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-43563",
             "specs": [
                 "<0.5"
             ],
@@ -29109,8 +34869,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25291",
-            "id": "pyup.io-43556",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-43564",
             "specs": [
                 "<0.5"
             ],
@@ -29118,8 +34878,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25292",
-            "id": "pyup.io-43557",
+            "cve": "CVE-2020-11538",
+            "id": "pyup.io-43566",
             "specs": [
                 "<0.5"
             ],
@@ -29127,8 +34887,8 @@
         },
         {
             "advisory": "Pysstv 0.5 updates its dependency 'pillow' from 4.3.0 to 8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25289",
-            "id": "pyup.io-40228",
+            "cve": "CVE-2020-10994",
+            "id": "pyup.io-43567",
             "specs": [
                 "<0.5"
             ],
@@ -29144,18 +34904,18 @@
             "v": "<0.5.2"
         },
         {
-            "advisory": "Pysstv version 0.5.2 updates its dependency \"Pillow\" to include a fix for CVE-2021-28676.",
-            "cve": "CVE-2021-28676",
-            "id": "pyup.io-41957",
+            "advisory": "Pysstv version 0.5.2 updates its dependency \"Pillow\" to include a fix for CVE-2021-28675.",
+            "cve": "CVE-2021-28675",
+            "id": "pyup.io-41956",
             "specs": [
                 "<0.5.2"
             ],
             "v": "<0.5.2"
         },
         {
-            "advisory": "Pysstv version 0.5.2 updates its dependency \"Pillow\" to include a fix for CVE-2021-28675.",
-            "cve": "CVE-2021-28675",
-            "id": "pyup.io-41956",
+            "advisory": "Pysstv version 0.5.2 updates its dependency \"Pillow\" to include a fix for CVE-2021-28676.",
+            "cve": "CVE-2021-28676",
+            "id": "pyup.io-41957",
             "specs": [
                 "<0.5.2"
             ],
@@ -29169,6 +34929,78 @@
                 "<0.5.2"
             ],
             "v": "<0.5.2"
+        },
+        {
+            "advisory": "Pysstv 0.5.3 updates its dependency 'Pillow' to v8.3.2 to include security fixes.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-44529",
+            "specs": [
+                "<0.5.3"
+            ],
+            "v": "<0.5.3"
+        },
+        {
+            "advisory": "Pysstv 0.5.3 updates its dependency 'Pillow' to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-44520",
+            "specs": [
+                "<0.5.3"
+            ],
+            "v": "<0.5.3"
+        },
+        {
+            "advisory": "Pysstv 0.5.3 updates its dependency 'Pillow' to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-34552",
+            "id": "pyup.io-44528",
+            "specs": [
+                "<0.5.3"
+            ],
+            "v": "<0.5.3"
+        },
+        {
+            "advisory": "Pysstv 0.5.4 updates its dependency 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2022-44525",
+            "id": "pyup.io-44530",
+            "specs": [
+                "<0.5.4"
+            ],
+            "v": "<0.5.4"
+        },
+        {
+            "advisory": "Pysstv 0.5.4 updates its dependency 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2022-44524",
+            "id": "pyup.io-44519",
+            "specs": [
+                "<0.5.4"
+            ],
+            "v": "<0.5.4"
+        },
+        {
+            "advisory": "Pysstv 0.5.4 updates its dependency 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22817",
+            "id": "pyup.io-44531",
+            "specs": [
+                "<0.5.4"
+            ],
+            "v": "<0.5.4"
+        },
+        {
+            "advisory": "Pysstv 0.5.4 updates its dependency 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22816",
+            "id": "pyup.io-44532",
+            "specs": [
+                "<0.5.4"
+            ],
+            "v": "<0.5.4"
+        },
+        {
+            "advisory": "Pysstv 0.5.4 updates its dependency 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22815",
+            "id": "pyup.io-44533",
+            "specs": [
+                "<0.5.4"
+            ],
+            "v": "<0.5.4"
         }
     ],
     "pystache": [
@@ -29194,8 +35026,8 @@
         },
         {
             "advisory": "Pysys-java 0.1 and prior includes a version of 'log4j-core' affected by critical and severe vulnerabilities.\r\nhttps://github.com/ben-spiller/pysysjava/pull/14",
-            "cve": "CVE-2021-45046",
-            "id": "pyup.io-43601",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44461",
             "specs": [
                 "<=0.1"
             ],
@@ -29209,11 +35041,20 @@
                 "<=0.1"
             ],
             "v": "<=0.1"
+        },
+        {
+            "advisory": "Pysys-java 0.1 and prior includes a version of 'log4j-core' affected by critical and severe vulnerabilities.\r\nhttps://github.com/ben-spiller/pysysjava/pull/14",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-43601",
+            "specs": [
+                "<=0.1"
+            ],
+            "v": "<=0.1"
         }
     ],
     "pytablewriter": [
         {
-            "advisory": "Pytablewriter 0.47.0 adding support to escape formula injection. See: PVE-2021-41000.",
+            "advisory": "Pytablewriter 0.47.0 adding support to escape formula injection. See: PVE-2021-41000.\r\nhttps://github.com/thombashi/pytablewriter/issues/20",
             "cve": "PVE-2021-41000",
             "id": "pyup.io-41000",
             "specs": [
@@ -29576,8 +35417,8 @@
         },
         {
             "advisory": "Python versions 2.7.14, 3.3.7, 3.4.7, 3.5.4 and 3.6.2 update modules/expat to libexpat 2.2.1 to include security fixes.\r\nhttps://bugs.python.org/issue29591",
-            "cve": "CVE-2016-0718",
-            "id": "pyup.io-42404",
+            "cve": "CVE-2016-4472",
+            "id": "pyup.io-42405",
             "specs": [
                 "<2.7.14",
                 ">=3.0.0a0,<3.3.7",
@@ -29589,8 +35430,8 @@
         },
         {
             "advisory": "Python versions 2.7.14, 3.3.7, 3.4.7, 3.5.4 and 3.6.2 update modules/expat to libexpat 2.2.1 to include security fixes.\r\nhttps://bugs.python.org/issue29591",
-            "cve": "CVE-2016-4472",
-            "id": "pyup.io-42405",
+            "cve": "CVE-2016-5300",
+            "id": "pyup.io-42406",
             "specs": [
                 "<2.7.14",
                 ">=3.0.0a0,<3.3.7",
@@ -29602,8 +35443,8 @@
         },
         {
             "advisory": "Python versions 2.7.14, 3.3.7, 3.4.7, 3.5.4 and 3.6.2 update modules/expat to libexpat 2.2.1 to include security fixes.\r\nhttps://bugs.python.org/issue29591",
-            "cve": "CVE-2016-5300",
-            "id": "pyup.io-42406",
+            "cve": "CVE-2012-6702",
+            "id": "pyup.io-42407",
             "specs": [
                 "<2.7.14",
                 ">=3.0.0a0,<3.3.7",
@@ -29615,8 +35456,8 @@
         },
         {
             "advisory": "Python versions 2.7.14, 3.3.7, 3.4.7, 3.5.4 and 3.6.2 update modules/expat to libexpat 2.2.1 to include security fixes.\r\nhttps://bugs.python.org/issue29591",
-            "cve": "CVE-2012-6702",
-            "id": "pyup.io-42407",
+            "cve": "CVE-2016-0718",
+            "id": "pyup.io-42404",
             "specs": [
                 "<2.7.14",
                 ">=3.0.0a0,<3.3.7",
@@ -29879,9 +35720,9 @@
             "v": "<2.7.17,>=3.0.0a0,<3.5.8,>=3.6.0a0,<3.6.10,>=3.7.0a0,<3.7.5"
         },
         {
-            "advisory": "Python versions 2.7.17, 3.5.8, 3.6.9 and 3.7.4 include a fix for CVE-2019-9740: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.\r\nhttps://bugs.python.org/issue36276",
-            "cve": "CVE-2019-9740",
-            "id": "pyup.io-38479",
+            "advisory": "Python versions 2.7.17, 3.5.8, 3.6.9 and 3.7.4 include a fix for CVE-2019-9947: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.\r\nhttps://bugs.python.org/issue35906",
+            "cve": "CVE-2019-9947",
+            "id": "pyup.io-36984",
             "specs": [
                 "<2.7.17",
                 ">=3.0.0a0,<3.5.8",
@@ -29891,9 +35732,9 @@
             "v": "<2.7.17,>=3.0.0a0,<3.5.8,>=3.6.0a0,<3.6.9,>=3.7.0a0,<3.7.4"
         },
         {
-            "advisory": "Python versions 2.7.17, 3.5.8, 3.6.9 and 3.7.4 include a fix for CVE-2019-9947: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the path component of a URL that lacks a ? character) followed by an HTTP header or a Redis command. This is similar to the CVE-2019-9740 query string issue.\r\nhttps://bugs.python.org/issue35906",
-            "cve": "CVE-2019-9947",
-            "id": "pyup.io-36984",
+            "advisory": "Python versions 2.7.17, 3.5.8, 3.6.9 and 3.7.4 include a fix for CVE-2019-9740: An issue was discovered in urllib2 in Python 2.x through 2.7.16 and urllib in Python 3.x through 3.7.3. CRLF injection is possible if the attacker controls a url parameter, as demonstrated by the first argument to urllib.request.urlopen with \\r\\n (specifically in the query string after a ? character) followed by an HTTP header or a Redis command.\r\nhttps://bugs.python.org/issue36276",
+            "cve": "CVE-2019-9740",
+            "id": "pyup.io-38479",
             "specs": [
                 "<2.7.17",
                 ">=3.0.0a0,<3.5.8",
@@ -30049,19 +35890,6 @@
             ],
             "v": "<3.4.0"
         },
-        {
-            "advisory": "Python versions 3.5.10, 3.6.11, 3.7.7, 3.8.2 and 3.9.0a6 include a fix for CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.\r\nhttps://bugs.python.org/issue39503",
-            "cve": "CVE-2020-8492",
-            "id": "pyup.io-37792",
-            "specs": [
-                "<3.5.10",
-                ">=3.6.0a0,<3.6.11",
-                ">=3.7.0a0,<3.7.7",
-                ">=3.8.0a0,<3.8.2",
-                ">=3.9.0a0,<3.9.0a6"
-            ],
-            "v": "<3.5.10,>=3.6.0a0,<3.6.11,>=3.7.0a0,<3.7.7,>=3.8.0a0,<3.8.2,>=3.9.0a0,<3.9.0a6"
-        },
         {
             "advisory": "Python versions 3.9.0a6, 3.8.4, 3.7.8, 3.6.11, and 3.5.10 disallow CR or LF in email.headerregistry.Address arguments to guard against header injection attacks.\r\nhttps://bugs.python.org/issue39073",
             "cve": "PVE-2021-42386",
@@ -30076,7 +35904,7 @@
             "v": "<3.5.10,>=3.6.0a0,<3.6.11,>=3.7.0a0,<3.7.8,>=3.8.0a0,<3.8.4,>=3.9.0a0,<3.9.0a6"
         },
         {
-            "advisory": "http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.",
+            "advisory": "Python versions 3.5.10, 3.6.12, 3.7.9, 3.8.5 and 3.9.0b5 include a fix for CVE-2020-26116: Http.client in Python 3.x before 3.5.10, 3.6.x before 3.6.12, 3.7.x before 3.7.9, and 3.8.x before 3.8.5 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of HTTPConnection.request.\r\nhttps://bugs.python.org/issue39603\r\nhttps://python-security.readthedocs.io/vuln/http-header-injection-method.html",
             "cve": "CVE-2020-26116",
             "id": "pyup.io-38826",
             "specs": [
@@ -30088,6 +35916,18 @@
             ],
             "v": "<3.5.10,>=3.6.0a0,<3.6.12,>=3.7.0a0,<3.7.9,>=3.8.0a0,<3.8.5,>=3.9.0a0,<3.9.0b5"
         },
+        {
+            "advisory": "Python 3.5,10, 3.6.15, 3.7.9 and 3.8.4 include a fix for CVE-2019-20907: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.\r\nhttps://bugs.python.org/issue39017",
+            "cve": "CVE-2019-20907",
+            "id": "pyup.io-38570",
+            "specs": [
+                "<3.5.10",
+                ">=3.6.0a0,<3.6.15",
+                ">=3.7.0a0,<3.7.9",
+                ">=3.8.0a0,<3.8.4"
+            ],
+            "v": "<3.5.10,>=3.6.0a0,<3.6.15,>=3.7.0a0,<3.7.9,>=3.8.0a0,<3.8.4"
+        },
         {
             "advisory": "Python versions 3.5.10rc1, 3.6.12, 3.7.9, 3.8.4 and 3.9.0b4 include a fix for CVE-2020-14422: Lib/ipaddress.py in Python through 3.8.3 improperly computes hash values in the IPv4Interface and IPv6Interface classes, which might allow a remote attacker to cause a denial of service if an application is affected by the performance of a dictionary containing IPv4Interface or IPv6Interface objects, and this attacker can cause many dictionary entries to be created.\r\nhttps://bugs.python.org/issue41004",
             "cve": "CVE-2020-14422",
@@ -30123,18 +35963,6 @@
             ],
             "v": "<3.6.10,>=3.7.0a0,<3.7.6,>=3.8.0a0,<3.8.1"
         },
-        {
-            "advisory": "Python versions 3.6.13, 3.7.10, 3.8.8 and 3.9.2 include a fix for CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.\r\nhttps://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html\r\nhttps://bugs.python.org/issue42938",
-            "cve": "CVE-2021-3177",
-            "id": "pyup.io-39465",
-            "specs": [
-                "<3.6.13",
-                ">=3.7.0,<3.7.10",
-                ">=3.8.0,<3.8.8",
-                ">=3.9.0,<3.9.2"
-            ],
-            "v": "<3.6.13,>=3.7.0,<3.7.10,>=3.8.0,<3.8.8,>=3.9.0,<3.9.2"
-        },
         {
             "advisory": "Python versions 3.6.13, 3.7.10, 3.8.7, 3.9.2 and 3.10.0a4 use CRYPTO_memcmp() for compare_digest to try harder to be constant-time.\r\nhttps://bugs.python.org/issue40791",
             "cve": "PVE-2021-42385",
@@ -30220,15 +36048,6 @@
             ],
             "v": "<3.6.8,>=3.7.0a0,<3.7.2"
         },
-        {
-            "advisory": "Python 3.8.4 includes a fix for CVE-2019-20907: In Lib/tarfile.py in Python through 3.8.3, an attacker is able to craft a TAR archive leading to an infinite loop when opened by tarfile.open, because _proc_pax lacks header validation.\r\nhttps://bugs.python.org/issue39017",
-            "cve": "CVE-2019-20907",
-            "id": "pyup.io-38570",
-            "specs": [
-                "<3.8.4"
-            ],
-            "v": "<3.8.4"
-        },
         {
             "advisory": "The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a \"Sweet32\" attack.",
             "cve": "CVE-2016-2183",
@@ -30273,9 +36092,10 @@
             "cve": "CVE-2011-4944",
             "id": "pyup.io-26074",
             "specs": [
-                ">=2.6,<3.3"
+                ">=2.6.0a0,<2.7.3",
+                ">=3.0.0a0,<3.3"
             ],
-            "v": ">=2.6,<3.3"
+            "v": ">=2.6.0a0,<2.7.3,>=3.0.0a0,<3.3"
         },
         {
             "advisory": "Python before 2.6.8, 2.7.x before 2.7.3, 3.x before 3.1.5, and 3.2.x before 3.2.3 computes hash values without restricting the ability to trigger hash collisions predictably, which allows context-dependent attackers to cause a denial of service (CPU consumption) via crafted input to an application that maintains a hash table. See CVE-2012-1150.",
@@ -30390,7 +36210,21 @@
             "v": ">=3.6.0,<3.6.13,>=3.7.0,<3.7.10,>=3.8.0,<3.8.9,>=3.9.0,<3.9.3,>=3.10.0,<3.10.0a7"
         },
         {
-            "advisory": "The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.",
+            "advisory": "Python versions 3.5.10, 3.6.11, 3.7.7, 3.8.2 and 3.9.0a6 include a fix for CVE-2020-8492: Python 2.7 through 2.7.17, 3.5 through 3.5.9, 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1 allows an HTTP server to conduct Regular Expression Denial of Service (ReDoS) attacks against a client because of urllib.request.AbstractBasicAuthHandler catastrophic backtracking.\r\nhttps://bugs.python.org/issue39503\r\nhttps://python-security.readthedocs.io/vuln/urllib-basic-auth-regex.html",
+            "cve": "CVE-2020-8492",
+            "id": "pyup.io-37792",
+            "specs": [
+                ">=3.6.0a0,<3.6.11",
+                ">=3.7.0a0,<3.7.7",
+                ">=3.8.0a0,<3.8.2",
+                ">=3.9.0a0,<3.9.0a6",
+                "<2.7.17",
+                ">=3.0.0a0,<3.5.10"
+            ],
+            "v": ">=3.6.0a0,<3.6.11,>=3.7.0a0,<3.7.7,>=3.8.0a0,<3.8.2,>=3.9.0a0,<3.9.0a6,<2.7.17,>=3.0.0a0,<3.5.10"
+        },
+        {
+            "advisory": "Python versions 3.6.13, 3.7.10, 3.8.8 and 3.9.2 include a fix for CVE-2021-23336: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.\r\nhttps://bugs.python.org/issue42967\r\nhttps://github.com/python/cpython/pull/24297",
             "cve": "CVE-2021-23336",
             "id": "pyup.io-39619",
             "specs": [
@@ -30401,6 +36235,18 @@
             ],
             "v": ">=3.7.0,<3.7.10,>=3.8.0,<3.8.8,>=3.9.0,<3.9.2,<3.6.13"
         },
+        {
+            "advisory": "Python versions 3.6.13, 3.7.10, 3.8.8 and 3.9.2 include a fix for CVE-2021-3177: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.\r\nhttps://python-security.readthedocs.io/vuln/ctypes-buffer-overflow-pycarg_repr.html\r\nhttps://bugs.python.org/issue42938",
+            "cve": "CVE-2021-3177",
+            "id": "pyup.io-39465",
+            "specs": [
+                ">=3.7.0,<3.7.10",
+                ">=3.8.0,<3.8.8",
+                ">=3.9.0,<3.9.2",
+                ">=3.0.0a0,<3.6.13"
+            ],
+            "v": ">=3.7.0,<3.7.10,>=3.8.0,<3.8.8,>=3.9.0,<3.9.2,>=3.0.0a0,<3.6.13"
+        },
         {
             "advisory": "Python version 3.7.0b3 hardens ssl module against CVE-2018-8970.\r\nhttps://bugs.python.org/issue33136",
             "cve": "CVE-2018-8970",
@@ -30634,15 +36480,6 @@
             ],
             "v": "<0.2.198"
         },
-        {
-            "advisory": "Python-framework 0.2.214 includes security optimizations related to security management.\r\nhttps://github.com/SamuelJansen/python_framework/commit/04c38b50e75c8ef0a5a07d039e336b6965ba7e13",
-            "cve": "PVE-2021-42711",
-            "id": "pyup.io-42711",
-            "specs": [
-                "<0.2.214"
-            ],
-            "v": "<0.2.214"
-        },
         {
             "advisory": "Python-framework 0.2.5 includes a security update. No more information was provided.",
             "cve": "PVE-2021-41776",
@@ -30655,7 +36492,7 @@
     ],
     "python-gnupg": [
         {
-            "advisory": "python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted. Related to a \"CWE-20: Improper Input Validation\" issue affecting the affect functionality component.",
+            "advisory": "Python-gnupg 0.4.3 includes a fix for CVE-2019-6690: Python-gnupg 0.4.3 allows context-dependent attackers to trick gnupg to decrypt other ciphertext than intended. To perform the attack, the passphrase to gnupg must be controlled by the adversary and the ciphertext should be trusted.",
             "cve": "CVE-2019-6690",
             "id": "pyup.io-36964",
             "specs": [
@@ -30855,17 +36692,6 @@
             "v": "<0.6.12"
         }
     ],
-    "python-pycraft": [
-        {
-            "advisory": "Python-pycraft 0.8 doesn't attempts to get an internet connection in game, due to privacy, performance and security concerns.",
-            "cve": "PVE-2021-42479",
-            "id": "pyup.io-42479",
-            "specs": [
-                "<0.8"
-            ],
-            "v": "<0.8"
-        }
-    ],
     "python-saml": [
         {
             "advisory": "python-saml before 2.1.6 is vulnerable to Signature Wrapping attacks.",
@@ -31085,8 +36911,8 @@
         },
         {
             "advisory": "Pytorch-lightning 1.6.0 updates its dependency 'pyyaml' to v5.4 and uses yaml.safe_load() to fix code execution vulnerabilities.",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-43752",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-43581",
             "specs": [
                 "<1.6.0"
             ],
@@ -31094,8 +36920,8 @@
         },
         {
             "advisory": "Pytorch-lightning 1.6.0 updates its dependency 'pyyaml' to v5.4 and uses yaml.safe_load() to fix code execution vulnerabilities.",
-            "cve": "CVE-2020-1747",
-            "id": "pyup.io-43581",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-43752",
             "specs": [
                 "<1.6.0"
             ],
@@ -31221,54 +37047,54 @@
             "v": "<0.13.0"
         },
         {
-            "advisory": "Pywbem 0.14.3 updates its dependency 'requests' to v2.20.1 to include a security fix.",
+            "advisory": "Pywbem version 0.14.3 increases the version of requests (from 2.19.1 to 2.20.1) to include a security fix. Note that this dependency is only needed for development purposes.",
             "cve": "CVE-2018-18074",
-            "id": "pyup.io-37517",
+            "id": "pyup.io-38444",
             "specs": [
                 "<0.14.3"
             ],
             "v": "<0.14.3"
         },
         {
-            "advisory": "Pywbem 0.14.3 updates its dependency 'urllib3' to v1.23 to include a security fix.",
-            "cve": "CVE-2018-20060",
-            "id": "pyup.io-42685",
+            "advisory": "Pywbem 0.14.3 increases the version of bleach (from 2.1.0 to 2.1.4) to include a security fix. Note that this dependency is only needed for development purposes.",
+            "cve": "CVE-2018-7753",
+            "id": "pyup.io-42720",
             "specs": [
                 "<0.14.3"
             ],
             "v": "<0.14.3"
         },
         {
-            "advisory": "Pywbem 0.14.3 updates its dependency 'bleach' to v2.1.4 to include a security fix.",
-            "cve": "CVE-2018-7753",
-            "id": "pyup.io-42686",
+            "advisory": "Pywbem 0.14.3 increases the version of urllib3 (from 1.22 to 1.23) to include a security fix. Note that this dependency is only needed for development purposes.",
+            "cve": "CVE-2018-20060",
+            "id": "pyup.io-42719",
             "specs": [
                 "<0.14.3"
             ],
             "v": "<0.14.3"
         },
         {
-            "advisory": "Pywbem version 0.14.3 increases the version of requests (from 2.19.1 to 2.20.1) to include a security fix. Note that this dependency is only needed for development purposes.",
+            "advisory": "Pywbem 0.14.3 updates its dependency 'requests' to v2.20.1 to include a security fix.",
             "cve": "CVE-2018-18074",
-            "id": "pyup.io-38444",
+            "id": "pyup.io-37517",
             "specs": [
                 "<0.14.3"
             ],
             "v": "<0.14.3"
         },
         {
-            "advisory": "Pywbem 0.14.3 increases the version of bleach (from 2.1.0 to 2.1.4) to include a security fix. Note that this dependency is only needed for development purposes.",
-            "cve": "CVE-2018-7753",
-            "id": "pyup.io-42720",
+            "advisory": "Pywbem 0.14.3 updates its dependency 'urllib3' to v1.23 to include a security fix.",
+            "cve": "CVE-2018-20060",
+            "id": "pyup.io-42685",
             "specs": [
                 "<0.14.3"
             ],
             "v": "<0.14.3"
         },
         {
-            "advisory": "Pywbem 0.14.3 increases the version of urllib3 (from 1.22 to 1.23) to include a security fix. Note that this dependency is only needed for development purposes.",
-            "cve": "CVE-2018-20060",
-            "id": "pyup.io-42719",
+            "advisory": "Pywbem 0.14.3 updates its dependency 'bleach' to v2.1.4 to include a security fix.",
+            "cve": "CVE-2018-7753",
+            "id": "pyup.io-42686",
             "specs": [
                 "<0.14.3"
             ],
@@ -31475,7 +37301,7 @@
             "v": "<5.4"
         },
         {
-            "advisory": "PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.",
+            "advisory": "PyYAML 5.1 through 5.1.2 has insufficient restrictions on the load and load_all functions because of a class deserialization issue, e.g., Popen is a class in the subprocess module. See CVE-2019-20477. NOTE: this issue exists because of an incomplete fix for CVE-2017-18342.",
             "cve": "CVE-2019-20477",
             "id": "pyup.io-38639",
             "specs": [
@@ -31486,9 +37312,9 @@
     ],
     "qctrl-open-controls": [
         {
-            "advisory": "Qctrl-open-controls 8.5.0 updates its dependency 'pillow' to v8.4.0 to include security fixes.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-42694",
+            "advisory": "Qctrl-open-controls 8.5.0 updates its dependency 'pillow' to v8.4.0 to include a fix for an Out-Of-Bound read vulnerability.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-42817",
             "specs": [
                 "<8.5.0"
             ],
@@ -31504,9 +37330,9 @@
             "v": "<8.5.0"
         },
         {
-            "advisory": "Qctrl-open-controls 8.5.0 updates its dependency 'pillow' to v8.4.0 to include a fix for an Out-Of-Bound read vulnerability.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-42817",
+            "advisory": "Qctrl-open-controls 8.5.0 updates its dependency 'pillow' to v8.4.0 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-42694",
             "specs": [
                 "<8.5.0"
             ],
@@ -31588,18 +37414,18 @@
             "v": "<2.9.14"
         },
         {
-            "advisory": "Quilt 2.9.14 updates Flask version to v.0.12.3 to include security fixes.",
-            "cve": "CVE-2018-1000656",
-            "id": "pyup.io-43011",
+            "advisory": "Quilt 2.9.14 updates urllib3 version to v.1.24 to include a security patch.",
+            "cve": "CVE-2018-20060",
+            "id": "pyup.io-36749",
             "specs": [
                 "<2.9.14"
             ],
             "v": "<2.9.14"
         },
         {
-            "advisory": "Quilt 2.9.14 updates urllib3 version to v.1.24 to include a security patch.",
-            "cve": "CVE-2018-20060",
-            "id": "pyup.io-36749",
+            "advisory": "Quilt 2.9.14 updates Flask version to v.0.12.3 to include security fixes.",
+            "cve": "CVE-2018-1000656",
+            "id": "pyup.io-43011",
             "specs": [
                 "<2.9.14"
             ],
@@ -31697,7 +37523,7 @@
             "v": "<1.11.1"
         },
         {
-            "advisory": "The Windows and macOS releases of Qutebrowser 1.14.1 ship Qt 5.15.2, which is based on Chromium 83.0.4103.122 with security fixes up to 86.0.4240.183. This includes CVE-2020-15999 in the bundled freetype library, which is known to be exploited in the wild.",
+            "advisory": "Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.",
             "cve": "CVE-2020-15999",
             "id": "pyup.io-39227",
             "specs": [
@@ -31816,8 +37642,8 @@
     ],
     "radicale": [
         {
-            "advisory": "radicale before 1.1.2 is vulnerable to bruteforce attacks when using the htpasswd authentication method.",
-            "cve": "PVE-2021-33323",
+            "advisory": "Radicale before 1.1.2 is vulnerable to bruteforce attacks when using the htpasswd authentication method. See CVE-2017-8342.",
+            "cve": "CVE-2017-8342",
             "id": "pyup.io-33323",
             "specs": [
                 "<1.1.2"
@@ -31917,8 +37743,242 @@
             "v": "<2.8.10"
         },
         {
-            "advisory": "Rasa 2.8.5 updates tensorflow to 2.3.4 to address security vulnerabilities.",
-            "cve": "PVE-2021-41286",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-22897",
+            "id": "pyup.io-44004",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-22876",
+            "id": "pyup.io-44005",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37645",
+            "id": "pyup.io-44006",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37687",
+            "id": "pyup.io-44007",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37685",
+            "id": "pyup.io-44008",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37644",
+            "id": "pyup.io-44010",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37672",
+            "id": "pyup.io-44012",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37670",
+            "id": "pyup.io-44013",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37677",
+            "id": "pyup.io-44014",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37673",
+            "id": "pyup.io-44016",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37674",
+            "id": "pyup.io-44018",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37663",
+            "id": "pyup.io-44019",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37681",
+            "id": "pyup.io-44021",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37691",
+            "id": "pyup.io-44022",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37637",
+            "id": "pyup.io-44023",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37657",
+            "id": "pyup.io-44026",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37690",
+            "id": "pyup.io-44020",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37682",
+            "id": "pyup.io-44028",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37650",
+            "id": "pyup.io-44035",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37688",
+            "id": "pyup.io-44036",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37651",
+            "id": "pyup.io-44040",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37684",
+            "id": "pyup.io-44041",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37658",
+            "id": "pyup.io-44043",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37664",
+            "id": "pyup.io-44045",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37666",
+            "id": "pyup.io-44033",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37656",
+            "id": "pyup.io-44048",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37686",
             "id": "pyup.io-41286",
             "specs": [
                 "<2.8.5"
@@ -31926,126 +37986,297 @@
             "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41203",
-            "id": "pyup.io-42642",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37680",
+            "id": "pyup.io-44058",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41200",
-            "id": "pyup.io-42643",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-22901",
+            "id": "pyup.io-44003",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41217",
-            "id": "pyup.io-42644",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37655",
+            "id": "pyup.io-44009",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41214",
-            "id": "pyup.io-42645",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37669",
+            "id": "pyup.io-44011",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41219",
-            "id": "pyup.io-42646",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37679",
+            "id": "pyup.io-44015",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41199",
-            "id": "pyup.io-42437",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37665",
+            "id": "pyup.io-44017",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41196",
-            "id": "pyup.io-42641",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37661",
+            "id": "pyup.io-44024",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41226",
-            "id": "pyup.io-42647",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37660",
+            "id": "pyup.io-44025",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41227",
-            "id": "pyup.io-42648",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37653",
+            "id": "pyup.io-44027",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41225",
-            "id": "pyup.io-42649",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37646",
+            "id": "pyup.io-44029",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41221",
-            "id": "pyup.io-42650",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37641",
+            "id": "pyup.io-44030",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41204",
-            "id": "pyup.io-42652",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37662",
+            "id": "pyup.io-44031",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
         },
         {
-            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41228",
-            "id": "pyup.io-42653",
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37659",
+            "id": "pyup.io-44034",
             "specs": [
-                "<2.8.9"
+                "<2.8.5"
             ],
-            "v": "<2.8.9"
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37676",
+            "id": "pyup.io-44037",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37675",
+            "id": "pyup.io-44038",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37643",
+            "id": "pyup.io-44039",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37667",
+            "id": "pyup.io-44042",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37647",
+            "id": "pyup.io-44044",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37649",
+            "id": "pyup.io-44046",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37652",
+            "id": "pyup.io-44032",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37654",
+            "id": "pyup.io-44049",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37639",
+            "id": "pyup.io-44050",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37635",
+            "id": "pyup.io-44047",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-22898",
+            "id": "pyup.io-44051",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37638",
+            "id": "pyup.io-44052",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37636",
+            "id": "pyup.io-44053",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37642",
+            "id": "pyup.io-44054",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37683",
+            "id": "pyup.io-44055",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37689",
+            "id": "pyup.io-44056",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37648",
+            "id": "pyup.io-44057",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37671",
+            "id": "pyup.io-44059",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
+        },
+        {
+            "advisory": "Rasa 2.8.5 updates tensorflow to v2.3.4 to address security vulnerabilities.",
+            "cve": "CVE-2021-37678",
+            "id": "pyup.io-44060",
+            "specs": [
+                "<2.8.5"
+            ],
+            "v": "<2.8.5"
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41222",
-            "id": "pyup.io-42654",
+            "cve": "CVE-2021-41199",
+            "id": "pyup.io-42437",
             "specs": [
                 "<2.8.9"
             ],
@@ -32053,8 +38284,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41218",
-            "id": "pyup.io-42656",
+            "cve": "CVE-2021-41227",
+            "id": "pyup.io-42648",
             "specs": [
                 "<2.8.9"
             ],
@@ -32062,8 +38293,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41216",
-            "id": "pyup.io-42657",
+            "cve": "CVE-2021-41225",
+            "id": "pyup.io-42649",
             "specs": [
                 "<2.8.9"
             ],
@@ -32071,8 +38302,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41215",
-            "id": "pyup.io-42658",
+            "cve": "CVE-2021-41221",
+            "id": "pyup.io-42650",
             "specs": [
                 "<2.8.9"
             ],
@@ -32080,8 +38311,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41208",
-            "id": "pyup.io-42659",
+            "cve": "CVE-2021-41209",
+            "id": "pyup.io-42651",
             "specs": [
                 "<2.8.9"
             ],
@@ -32089,8 +38320,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41206",
-            "id": "pyup.io-42660",
+            "cve": "CVE-2021-41222",
+            "id": "pyup.io-42654",
             "specs": [
                 "<2.8.9"
             ],
@@ -32098,8 +38329,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41205",
-            "id": "pyup.io-42661",
+            "cve": "CVE-2021-41224",
+            "id": "pyup.io-42655",
             "specs": [
                 "<2.8.9"
             ],
@@ -32107,8 +38338,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41212",
-            "id": "pyup.io-42662",
+            "cve": "CVE-2021-41215",
+            "id": "pyup.io-42658",
             "specs": [
                 "<2.8.9"
             ],
@@ -32116,8 +38347,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41210",
-            "id": "pyup.io-42663",
+            "cve": "CVE-2021-41218",
+            "id": "pyup.io-42656",
             "specs": [
                 "<2.8.9"
             ],
@@ -32125,8 +38356,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41207",
-            "id": "pyup.io-42664",
+            "cve": "CVE-2021-41206",
+            "id": "pyup.io-42660",
             "specs": [
                 "<2.8.9"
             ],
@@ -32134,8 +38365,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41202",
-            "id": "pyup.io-42665",
+            "cve": "CVE-2021-41210",
+            "id": "pyup.io-42663",
             "specs": [
                 "<2.8.9"
             ],
@@ -32188,8 +38419,8 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41224",
-            "id": "pyup.io-42655",
+            "cve": "CVE-2021-41205",
+            "id": "pyup.io-42661",
             "specs": [
                 "<2.8.9"
             ],
@@ -32197,8 +38428,80 @@
         },
         {
             "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
-            "cve": "CVE-2021-41209",
-            "id": "pyup.io-42651",
+            "cve": "CVE-2021-41212",
+            "id": "pyup.io-42662",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41214",
+            "id": "pyup.io-42645",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41226",
+            "id": "pyup.io-42647",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41204",
+            "id": "pyup.io-42652",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41228",
+            "id": "pyup.io-42653",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41216",
+            "id": "pyup.io-42657",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41208",
+            "id": "pyup.io-42659",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41207",
+            "id": "pyup.io-42664",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41202",
+            "id": "pyup.io-42665",
             "specs": [
                 "<2.8.9"
             ],
@@ -32214,13 +38517,49 @@
             "v": "<2.8.9"
         },
         {
-            "advisory": "Rasa 3.0.0 drops support for Python 3.6, as it is arriving to end of life on Dec 23rd 2021.\r\nhttps://github.com/rasahq/rasa/issues/8569",
-            "cve": "PVE-2021-42804",
-            "id": "pyup.io-42804",
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41196",
+            "id": "pyup.io-42641",
             "specs": [
-                "<3.0.0"
+                "<2.8.9"
             ],
-            "v": "<3.0.0"
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41203",
+            "id": "pyup.io-42642",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41200",
+            "id": "pyup.io-42643",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41217",
+            "id": "pyup.io-42644",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
+        },
+        {
+            "advisory": "Rasa 2.8.9 updates its dependency 'tensorflow' to v2.6 to include several security fixes.\r\nhttps://github.com/RasaHQ/rasa/commit/c57dbd466dc153126f1486aafb60b8f19fb911e4",
+            "cve": "CVE-2021-41219",
+            "id": "pyup.io-42646",
+            "specs": [
+                "<2.8.9"
+            ],
+            "v": "<2.8.9"
         },
         {
             "advisory": "Rasa 3.0.0 updates its dependency 'websockets' to v9.1 to include a security fix.\r\nhttps://github.com/RasaHQ/rasa-sdk/issues/500",
@@ -32230,6 +38569,15 @@
                 "<3.0.0"
             ],
             "v": "<3.0.0"
+        },
+        {
+            "advisory": "Rasa 3.0.0 drops support for Python 3.6, as it is arriving to end of life on Dec 23rd 2021.\r\nhttps://github.com/rasahq/rasa/issues/8569",
+            "cve": "PVE-2021-42804",
+            "id": "pyup.io-42804",
+            "specs": [
+                "<3.0.0"
+            ],
+            "v": "<3.0.0"
         }
     ],
     "rasa-sdk": [
@@ -32283,13 +38631,60 @@
             "v": "<1.9.1"
         },
         {
-            "advisory": "Ray 1.9.1 and prior include a version of 'log4j' affected by severe vulnerabilities.",
+            "advisory": "Ray 1.9.2 updates its dependency 'log4j' to v2.17.0 to fix a severe vulnerability.",
             "cve": "CVE-2021-45105",
             "id": "pyup.io-43437",
             "specs": [
-                "<=1.9.1"
+                "<1.9.2"
+            ],
+            "v": "<1.9.2"
+        },
+        {
+            "advisory": "Ray 1.9.2 and prior include a version of 'log4j' affected by severe vulnerabilities.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44466",
+            "specs": [
+                "<=1.9.2"
             ],
-            "v": "<=1.9.1"
+            "v": "<=1.9.2"
+        }
+    ],
+    "ray-on-aml": [
+        {
+            "advisory": "Ray-on-aml 0.0.4 updates its dependency 'ray' to v1.9.1 to include security fixes.",
+            "cve": "CVE-2021-44228",
+            "id": "pyup.io-43977",
+            "specs": [
+                "<0.0.4"
+            ],
+            "v": "<0.0.4"
+        },
+        {
+            "advisory": "Ray-on-aml 0.0.4 updates its dependency 'ray' to v1.9.1 to include security fixes.",
+            "cve": "CVE-2021-45046",
+            "id": "pyup.io-44476",
+            "specs": [
+                "<0.0.4"
+            ],
+            "v": "<0.0.4"
+        },
+        {
+            "advisory": "Ray-on-aml 0.0.6 and prior includes a version of 'ray' affected by log4j vulnerabilities.",
+            "cve": "CVE-2021-45105",
+            "id": "pyup.io-44477",
+            "specs": [
+                "<=0.0.6"
+            ],
+            "v": "<=0.0.6"
+        },
+        {
+            "advisory": "Ray-on-aml 0.0.6 and prior includes a version of 'ray' affected by log4j vulnerabilities.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44478",
+            "specs": [
+                "<=0.0.6"
+            ],
+            "v": "<=0.0.6"
         }
     ],
     "raylib": [
@@ -32451,8 +38846,17 @@
     ],
     "rejected": [
         {
-            "advisory": "Rejected 3.20.7 updates its dependency 'pyyaml' to include security fixes.",
-            "cve": "PVE-2021-42627",
+            "advisory": "Rejected 3.20.7 updates its dependency 'pyyaml' to v5.3.1 to include security fixes.\r\nhttps://github.com/gmr/rejected/commit/3d0d600f2fec041d84f0255af51c8b46ea98815b",
+            "cve": "CVE-2019-20477",
+            "id": "pyup.io-44584",
+            "specs": [
+                "<3.20.7"
+            ],
+            "v": "<3.20.7"
+        },
+        {
+            "advisory": "Rejected 3.20.7 updates its dependency 'pyyaml' to v5.3.1 to include security fixes.\r\nhttps://github.com/gmr/rejected/commit/3d0d600f2fec041d84f0255af51c8b46ea98815b",
+            "cve": "CVE-2020-1747",
             "id": "pyup.io-42627",
             "specs": [
                 "<3.20.7"
@@ -32604,7 +39008,7 @@
             "v": "<=3.5.26"
         },
         {
-            "advisory": "All versions of package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation) Steps to reproduce by Karan Bamal: 1. Download and install the latest package of reportlab 2. Go to demos -> odyssey -> dodyssey 3. In the text file odyssey.txt that needs to be converted to pdf inject <img src=\"http://127.0.0.1:5000\" valign=\"top\"/> 4. Create a nc listener nc -lp 5000 5. Run python3 dodyssey.py 6. You will get a hit on your nc showing we have successfully proceded to send a server side request 7. dodyssey.py will show error since there is no img file on the url, but we are able to do SSRF",
+            "advisory": "All versions of the package reportlab are vulnerable to Server-side Request Forgery (SSRF) via img tags. In order to reduce risk, use trustedSchemes & trustedHosts (see in Reportlab's documentation).\r\nhttps://www.reportlab.com/docs/reportlab-userguide.pdf",
             "cve": "CVE-2020-28463",
             "id": "pyup.io-39642",
             "specs": [
@@ -32792,8 +39196,8 @@
     ],
     "rmapy": [
         {
-            "advisory": "Rmapy 0.2.4 bumps jinja2 from version 2.10.1 to 2.11.3 to improve its security.",
-            "cve": "PVE-2021-40057",
+            "advisory": "Rmapy 0.2.4 updates Jinja2 to v2.11.3 to include a security fix.",
+            "cve": "CVE-2020-28493",
             "id": "pyup.io-40057",
             "specs": [
                 "<0.2.4"
@@ -32801,17 +39205,6 @@
             "v": "<0.2.4"
         }
     ],
-    "rnalysis": [
-        {
-            "advisory": "Rnalysis 1.3.6 fixes a security vulnerability in the developer test environment.",
-            "cve": "PVE-2021-40801",
-            "id": "pyup.io-40801",
-            "specs": [
-                "<1.3.6"
-            ],
-            "v": "<1.3.6"
-        }
-    ],
     "rnc": [
         {
             "advisory": "Rnc 0.6.5 includes updated requirements versions to address security vulnerabilities.",
@@ -32845,6 +39238,62 @@
             "v": "<0.9.0"
         }
     ],
+    "rolls-blockchain": [
+        {
+            "advisory": "Rolls-blockchain 1.0beta14 adds peers gossiping to partially protect from eclipse attacks.\r\nhttps://github.com/strandedathome/rolls-blockchain/commit/5b17e1cf237247c767173c7c6f08ba70a22449b3",
+            "cve": "PVE-2022-44616",
+            "id": "pyup.io-44616",
+            "specs": [
+                "<1.0beta14"
+            ],
+            "v": "<1.0beta14"
+        },
+        {
+            "advisory": "Rolls-blockchain 1.0beta6 updates its dependency 'pyyaml' to v5.3.1 to include a security fix.",
+            "cve": "CVE-2020-1747",
+            "id": "pyup.io-44620",
+            "specs": [
+                "<1.0beta6"
+            ],
+            "v": "<1.0beta6"
+        },
+        {
+            "advisory": "Rolls-blockchain 1.0rc5 updates its dependency 'aiohttp' to v3.7.4 to include a security fix.",
+            "cve": "CVE-2021-21330",
+            "id": "pyup.io-44614",
+            "specs": [
+                "<1.0rc5"
+            ],
+            "v": "<1.0rc5"
+        },
+        {
+            "advisory": "Rolls-blockchain 1.0rc6 implements rate limiting for full node to better defend against DDOS attacks.",
+            "cve": null,
+            "id": "pyup.io-44641",
+            "specs": [
+                "<1.0rc6"
+            ],
+            "v": "<1.0rc6"
+        },
+        {
+            "advisory": "Rolls-blockchain 1.0rc6 changes 'rolls keys add' to take secret words a prompt on the command line or stdin instead of command line arguments to avoid leaking them in logs.",
+            "cve": "PVE-2022-44613",
+            "id": "pyup.io-44613",
+            "specs": [
+                "<1.0rc6"
+            ],
+            "v": "<1.0rc6"
+        },
+        {
+            "advisory": "Rolls-blockchain 1.1.3 mitigates 1-3 byte dust attacks.",
+            "cve": "PVE-2022-44612",
+            "id": "pyup.io-44612",
+            "specs": [
+                "<1.1.3"
+            ],
+            "v": "<1.1.3"
+        }
+    ],
     "rope": [
         {
             "advisory": "base/oi/doa.py in the Rope library in CPython (aka Python) allows remote attackers to execute arbitrary code by leveraging an unsafe call to pickle.load.",
@@ -33120,6 +39569,15 @@
                 "<0.7.0"
             ],
             "v": "<0.7.0"
+        },
+        {
+            "advisory": "Rubrix 0.8.0 avoids an infinite loop when dataset is loading.\r\nhttps://github.com/recognai/rubrix/commit/ac0b90cc2fab604a1bdde34b624c71fb0790dd0a",
+            "cve": "PVE-2022-44504",
+            "id": "pyup.io-44504",
+            "specs": [
+                "<0.8.0"
+            ],
+            "v": "<0.8.0"
         }
     ],
     "ruffruffs": [
@@ -33142,6 +39600,15 @@
                 "<1.16.0"
             ],
             "v": "<1.16.0"
+        },
+        {
+            "advisory": "Runway 2.5.0 updates its dependency 'pipenv' to v2022.1.8 to include a security fix.",
+            "cve": "CVE-2022-21668",
+            "id": "pyup.io-44558",
+            "specs": [
+                "<2.5.0"
+            ],
+            "v": "<2.5.0"
         }
     ],
     "s3scanner": [
@@ -33210,9 +39677,9 @@
     ],
     "salt": [
         {
-            "advisory": "An issue was discovered in through SaltStack Salt before 3002.5. The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
-            "cve": "CVE-2021-25282",
-            "id": "pyup.io-41947",
+            "advisory": "In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
+            "cve": "CVE-2020-35662",
+            "id": "pyup.io-41945",
             "specs": [
                 "<2015.8.10",
                 ">=2015.8.11,<2015.8.13",
@@ -33233,9 +39700,9 @@
             "v": "<2015.8.10,>=2015.8.11,<2015.8.13,>=2016.3.0rc0,<2016.3.4,==2016.3.5,==2016.3.7,>=2016.3.9,<2016.11.3,==2016.11.4,>=2016.11.7,<2016.11.10,>=2017.5.0,<2017.7.8,>=2018.2.0,<=2018.3.5,>=2019.2.0rc0,<2019.2.5,>=2019.2.6,<2019.2.8,>=3000.0.0rc0,<3000.6,>=3001rc1,<3001.4,>=3002rc0,<3002.5"
         },
         {
-            "advisory": "In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
-            "cve": "CVE-2020-35662",
-            "id": "pyup.io-41945",
+            "advisory": "An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
+            "cve": "CVE-2021-3148",
+            "id": "pyup.io-41951",
             "specs": [
                 "<2015.8.10",
                 ">=2015.8.11,<2015.8.13",
@@ -33279,9 +39746,9 @@
             "v": "<2015.8.10,>=2015.8.11,<2015.8.13,>=2016.3.0rc0,<2016.3.4,==2016.3.5,==2016.3.7,>=2016.3.9,<2016.11.3,==2016.11.4,>=2016.11.7,<2016.11.10,>=2017.5.0,<2017.7.8,>=2018.2.0,<=2018.3.5,>=2019.2.0rc0,<2019.2.5,>=2019.2.6,<2019.2.8,>=3000.0.0rc0,<3000.6,>=3001rc1,<3001.4,>=3002rc0,<3002.5"
         },
         {
-            "advisory": "An issue was discovered in SaltStack Salt before 3002.5. Sending crafted web requests to the Salt API can result in salt.utils.thin.gen_thin() command injection because of different handling of single versus double quotes. This is related to salt/utils/thin.py. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
-            "cve": "CVE-2021-3148",
-            "id": "pyup.io-41951",
+            "advisory": "An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
+            "cve": "CVE-2021-25283",
+            "id": "pyup.io-41948",
             "specs": [
                 "<2015.8.10",
                 ">=2015.8.11,<2015.8.13",
@@ -33348,9 +39815,9 @@
             "v": "<2015.8.10,>=2015.8.11,<2015.8.13,>=2016.3.0rc0,<2016.3.4,==2016.3.5,==2016.3.7,>=2016.3.9,<2016.11.3,==2016.11.4,>=2016.11.7,<2016.11.10,>=2017.5.0,<2017.7.8,>=2018.2.0,<=2018.3.5,>=2019.2.0rc0,<2019.2.5,>=2019.2.6,<2019.2.8,>=3000.0.0rc0,<3000.6,>=3001rc1,<3001.4,>=3002rc0,<3002.5"
         },
         {
-            "advisory": "An issue was discovered in through SaltStack Salt before 3002.5. The jinja renderer does not protect against server side template injection attacks. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
-            "cve": "CVE-2021-25283",
-            "id": "pyup.io-41948",
+            "advisory": "An issue was discovered in through SaltStack Salt before 3002.5 identified as CVE-2021-25284: salt.modules.cmdmod can log credentials to the info or error log level.\r\nhttps://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
+            "cve": "CVE-2021-25284",
+            "id": "pyup.io-41949",
             "specs": [
                 "<2015.8.10",
                 ">=2015.8.11,<2015.8.13",
@@ -33371,9 +39838,9 @@
             "v": "<2015.8.10,>=2015.8.11,<2015.8.13,>=2016.3.0rc0,<2016.3.4,==2016.3.5,==2016.3.7,>=2016.3.9,<2016.11.3,==2016.11.4,>=2016.11.7,<2016.11.10,>=2017.5.0,<2017.7.8,>=2018.2.0,<=2018.3.5,>=2019.2.0rc0,<2019.2.5,>=2019.2.6,<2019.2.8,>=3000.0.0rc0,<3000.6,>=3001rc1,<3001.4,>=3002rc0,<3002.5"
         },
         {
-            "advisory": "Salt versions 3002.2, 3001.4, 3000.6, 2019.2.8, 2019.2.5, 2018.3.5, 2017.7.8, 2016.11.10, 2016.11.6, 2016.11.5, 2016.11.3, 2016.3.8, 2016.3.6, 2016.3.4, 2015.8.13 and 2015.8.10 include a fix for CVE-2021-3197: An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.\r\nhttps://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
-            "cve": "CVE-2021-3197",
-            "id": "pyup.io-41952",
+            "advisory": "An issue was discovered in through SaltStack Salt before 3002.5, identified as CVE-2021-25282: The salt.wheel.pillar_roots.write method is vulnerable to directory traversal. Several Salt versions were patched. https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25",
+            "cve": "CVE-2021-25282",
+            "id": "pyup.io-41947",
             "specs": [
                 "<2015.8.10",
                 ">=2015.8.11,<2015.8.13",
@@ -33394,9 +39861,9 @@
             "v": "<2015.8.10,>=2015.8.11,<2015.8.13,>=2016.3.0rc0,<2016.3.4,==2016.3.5,==2016.3.7,>=2016.3.9,<2016.11.3,==2016.11.4,>=2016.11.7,<2016.11.10,>=2017.5.0,<2017.7.8,>=2018.2.0,<=2018.3.5,>=2019.2.0rc0,<2019.2.5,>=2019.2.6,<2019.2.8,>=3000.0.0rc0,<3000.6,>=3001rc1,<3001.4,>=3002rc0,<3002.5"
         },
         {
-            "advisory": "An issue was discovered in through SaltStack Salt before 3002.5. Salt.modules.cmdmod can log credentials to the info or error log level. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
-            "cve": "CVE-2021-25284",
-            "id": "pyup.io-41949",
+            "advisory": "An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory. Several Salt versions were patched. \r\nhttps://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25",
+            "cve": "CVE-2020-28243",
+            "id": "pyup.io-41929",
             "specs": [
                 "<2015.8.10",
                 ">=2015.8.11,<2015.8.13",
@@ -33417,9 +39884,9 @@
             "v": "<2015.8.10,>=2015.8.11,<2015.8.13,>=2016.3.0rc0,<2016.3.4,==2016.3.5,==2016.3.7,>=2016.3.9,<2016.11.3,==2016.11.4,>=2016.11.7,<2016.11.10,>=2017.5.0,<2017.7.8,>=2018.2.0,<=2018.3.5,>=2019.2.0rc0,<2019.2.5,>=2019.2.6,<2019.2.8,>=3000.0.0rc0,<3000.6,>=3001rc1,<3001.4,>=3002rc0,<3002.5"
         },
         {
-            "advisory": "An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory. Several Salt versions were patched. See: https://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
-            "cve": "CVE-2020-28243",
-            "id": "pyup.io-41929",
+            "advisory": "Salt versions 3002.2, 3001.4, 3000.6, 2019.2.8, 2019.2.5, 2018.3.5, 2017.7.8, 2016.11.10, 2016.11.6, 2016.11.5, 2016.11.3, 2016.3.8, 2016.3.6, 2016.3.4, 2015.8.13 and 2015.8.10 include a fix for CVE-2021-3197: An issue was discovered in SaltStack Salt before 3002.5. The salt-api's ssh client is vulnerable to a shell injection by including ProxyCommand in an argument, or via ssh_options provided in an API request.\r\nhttps://saltproject.io/security_announcements/active-saltstack-cve-release-2021-feb-25/",
+            "cve": "CVE-2021-3197",
+            "id": "pyup.io-41952",
             "specs": [
                 "<2015.8.10",
                 ">=2015.8.11,<2015.8.13",
@@ -33497,7 +39964,7 @@
             "v": "<=3002"
         },
         {
-            "advisory": "An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. See: CVE-2020-16846.",
+            "advisory": "An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection. See CVE-2020-16846.",
             "cve": "CVE-2020-16846",
             "id": "pyup.io-39159",
             "specs": [
@@ -33614,8 +40081,8 @@
         },
         {
             "advisory": "Sanic-security 0.8.0 updates its dependency \"pillow\" to v8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25292",
-            "id": "pyup.io-42111",
+            "cve": "CVE-2021-25291",
+            "id": "pyup.io-42110",
             "specs": [
                 "<0.8.0"
             ],
@@ -33623,8 +40090,8 @@
         },
         {
             "advisory": "Sanic-security 0.8.0 updates its dependency \"pillow\" to v8.1.1 to include security fixes.",
-            "cve": "CVE-2021-25291",
-            "id": "pyup.io-42110",
+            "cve": "CVE-2021-25292",
+            "id": "pyup.io-42111",
             "specs": [
                 "<0.8.0"
             ],
@@ -33764,7 +40231,7 @@
     ],
     "schemachange": [
         {
-            "advisory": "Schemachange 3.3.2 configures Jinja to escape inputs to templates (using autoescape=True). This helps protect rendered templates against XSS and other vulnerabilities.",
+            "advisory": "Schemachange 3.3.2 configures Jinja to escape inputs to templates (using autoescape=True). This helps protect rendered templates against XSS and other vulnerabilities.\r\nhttps://github.com/Snowflake-Labs/schemachange/commit/f006a4c550365f872fad396e87b797114eb1dc5d",
             "cve": "PVE-2021-42518",
             "id": "pyup.io-42518",
             "specs": [
@@ -33829,13 +40296,49 @@
     ],
     "scvae": [
         {
-            "advisory": "scvae 2.1.1 updates TensorFlow because of a security vulnerability.",
-            "cve": "PVE-2021-37932",
+            "advisory": "Scvae 2.1.1 updates TensorFlow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-19646",
             "id": "pyup.io-37932",
             "specs": [
                 "<2.1.1"
             ],
             "v": "<2.1.1"
+        },
+        {
+            "advisory": "Scvae 2.1.1 updates TensorFlow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-5481",
+            "id": "pyup.io-43824",
+            "specs": [
+                "<2.1.1"
+            ],
+            "v": "<2.1.1"
+        },
+        {
+            "advisory": "Scvae 2.1.1 updates TensorFlow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-16168",
+            "id": "pyup.io-43825",
+            "specs": [
+                "<2.1.1"
+            ],
+            "v": "<2.1.1"
+        },
+        {
+            "advisory": "Scvae 2.1.1 updates TensorFlow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2020-5215",
+            "id": "pyup.io-43826",
+            "specs": [
+                "<2.1.1"
+            ],
+            "v": "<2.1.1"
+        },
+        {
+            "advisory": "Scvae 2.1.1 updates TensorFlow to v1.15.2 to include security fixes.",
+            "cve": "CVE-2019-5482",
+            "id": "pyup.io-43827",
+            "specs": [
+                "<2.1.1"
+            ],
+            "v": "<2.1.1"
         }
     ],
     "sdc-cryptography": [
@@ -34034,8 +40537,8 @@
         },
         {
             "advisory": "Seldon-core 0.4.2 updates Java dependency 'jackson' to v2.10.0 to include a security fix.",
-            "cve": "CVE-2019-16942",
-            "id": "pyup.io-42741",
+            "cve": "CVE-2019-16943",
+            "id": "pyup.io-42740",
             "specs": [
                 "<0.4.2"
             ],
@@ -34043,8 +40546,8 @@
         },
         {
             "advisory": "Seldon-core 0.4.2 updates Java dependency 'jackson' to v2.10.0 to include a security fix.",
-            "cve": "CVE-2019-16943",
-            "id": "pyup.io-42740",
+            "cve": "CVE-2019-16942",
+            "id": "pyup.io-42741",
             "specs": [
                 "<0.4.2"
             ],
@@ -34238,27 +40741,27 @@
     ],
     "sentry": [
         {
-            "advisory": "Sentry 10.0.0 includes a security update for its dependency \"webpack-dev-server\".",
-            "cve": "CVE-2018-14732",
-            "id": "pyup.io-41972",
+            "advisory": "Sentry 10.0.0 includes a security update for its dependency \"set-value\".",
+            "cve": "CVE-2019-10747",
+            "id": "pyup.io-41973",
             "specs": [
                 "<10.0.0"
             ],
             "v": "<10.0.0"
         },
         {
-            "advisory": "Sentry 10.0.0 includes a security update for its dependency \"mixin-deep\".",
-            "cve": "CVE-2019-10746",
-            "id": "pyup.io-41974",
+            "advisory": "Sentry 10.0.0 includes a security update for its dependency \"webpack-dev-server\".",
+            "cve": "CVE-2018-14732",
+            "id": "pyup.io-41972",
             "specs": [
                 "<10.0.0"
             ],
             "v": "<10.0.0"
         },
         {
-            "advisory": "Sentry 10.0.0 includes a security update for its dependency \"set-value\".",
-            "cve": "CVE-2019-10747",
-            "id": "pyup.io-41973",
+            "advisory": "Sentry 10.0.0 includes a security update for its dependency \"mixin-deep\".",
+            "cve": "CVE-2019-10746",
+            "id": "pyup.io-41974",
             "specs": [
                 "<10.0.0"
             ],
@@ -34275,8 +40778,8 @@
         },
         {
             "advisory": "Sentry 20.6.0 updates its dependency \"pillow\" to include security fixes.",
-            "cve": "CVE-2020-5313",
-            "id": "pyup.io-41976",
+            "cve": "CVE-2020-5312",
+            "id": "pyup.io-41977",
             "specs": [
                 "<20.6.0"
             ],
@@ -34284,8 +40787,8 @@
         },
         {
             "advisory": "Sentry 20.6.0 updates its dependency \"pillow\" to include security fixes.",
-            "cve": "CVE-2020-5310",
-            "id": "pyup.io-41979",
+            "cve": "CVE-2020-5311",
+            "id": "pyup.io-41978",
             "specs": [
                 "<20.6.0"
             ],
@@ -34293,8 +40796,8 @@
         },
         {
             "advisory": "Sentry 20.6.0 updates its dependency \"pillow\" to include security fixes.",
-            "cve": "CVE-2020-5312",
-            "id": "pyup.io-41977",
+            "cve": "CVE-2020-5310",
+            "id": "pyup.io-41979",
             "specs": [
                 "<20.6.0"
             ],
@@ -34302,8 +40805,8 @@
         },
         {
             "advisory": "Sentry 20.6.0 updates its dependency \"pillow\" to include security fixes.",
-            "cve": "CVE-2020-5311",
-            "id": "pyup.io-41978",
+            "cve": "CVE-2019-19911",
+            "id": "pyup.io-41980",
             "specs": [
                 "<20.6.0"
             ],
@@ -34311,13 +40814,22 @@
         },
         {
             "advisory": "Sentry 20.6.0 updates its dependency \"pillow\" to include security fixes.",
-            "cve": "CVE-2019-19911",
-            "id": "pyup.io-41980",
+            "cve": "CVE-2020-5313",
+            "id": "pyup.io-41976",
             "specs": [
                 "<20.6.0"
             ],
             "v": "<20.6.0"
         },
+        {
+            "advisory": "Sentry 21.11.0 validates that the issue alert owner is a member of the organization.\r\nhttps://github.com/getsentry/sentry/pull/29962",
+            "cve": "PVE-2022-44565",
+            "id": "pyup.io-44565",
+            "specs": [
+                "<21.11.0"
+            ],
+            "v": "<21.11.0"
+        },
         {
             "advisory": "Sentry 21.2.0 updates its dependency \"websocket-extensions\" to a secure version.",
             "cve": "CVE-2020-7662",
@@ -34337,18 +40849,18 @@
             "v": "<21.2.0"
         },
         {
-            "advisory": "Sentry 21.3.1 updates its dependency \"pyyaml\" to include a security fix.",
-            "cve": "CVE-2020-14343",
-            "id": "pyup.io-41982",
+            "advisory": "Sentry 21.3.1 updates its dependency 'lxml' to v4.6.3 to include a security fix.",
+            "cve": "CVE-2021-28957",
+            "id": "pyup.io-41981",
             "specs": [
                 "<21.3.1"
             ],
             "v": "<21.3.1"
         },
         {
-            "advisory": "Sentry 21.3.1 updates its dependency 'lxml' to v4.6.3 to include a security fix.",
-            "cve": "CVE-2021-28957",
-            "id": "pyup.io-41981",
+            "advisory": "Sentry 21.3.1 updates its dependency \"pyyaml\" to include a security fix.",
+            "cve": "CVE-2020-14343",
+            "id": "pyup.io-41982",
             "specs": [
                 "<21.3.1"
             ],
@@ -34356,8 +40868,8 @@
         },
         {
             "advisory": "Sentry 21.6.0 updates its dependency \"pillow\" to version 8.2.0 to include several security fixes.",
-            "cve": "CVE-2021-28678",
-            "id": "pyup.io-41986",
+            "cve": "CVE-2021-28677",
+            "id": "pyup.io-41989",
             "specs": [
                 "<21.6.0"
             ],
@@ -34365,8 +40877,8 @@
         },
         {
             "advisory": "Sentry 21.6.0 updates its dependency \"pillow\" to version 8.2.0 to include several security fixes.",
-            "cve": "CVE-2021-28675",
-            "id": "pyup.io-41987",
+            "cve": "CVE-2021-28678",
+            "id": "pyup.io-41986",
             "specs": [
                 "<21.6.0"
             ],
@@ -34374,8 +40886,8 @@
         },
         {
             "advisory": "Sentry 21.6.0 updates its dependency \"pillow\" to version 8.2.0 to include several security fixes.",
-            "cve": "CVE-2021-28676",
-            "id": "pyup.io-41988",
+            "cve": "CVE-2021-28675",
+            "id": "pyup.io-41987",
             "specs": [
                 "<21.6.0"
             ],
@@ -34383,8 +40895,8 @@
         },
         {
             "advisory": "Sentry 21.6.0 updates its dependency \"pillow\" to version 8.2.0 to include several security fixes.",
-            "cve": "CVE-2021-28677",
-            "id": "pyup.io-41989",
+            "cve": "CVE-2021-28676",
+            "id": "pyup.io-41988",
             "specs": [
                 "<21.6.0"
             ],
@@ -34410,8 +40922,8 @@
         },
         {
             "advisory": "Sentry 21.9.0 updates its dependency 'Django' to v2.2.24 to include security fixes.",
-            "cve": "CVE-2021-33203",
-            "id": "pyup.io-43364",
+            "cve": "CVE-2021-33571",
+            "id": "pyup.io-41985",
             "specs": [
                 "<21.9.0"
             ],
@@ -34419,8 +40931,8 @@
         },
         {
             "advisory": "Sentry 21.9.0 updates its dependency 'Django' to v2.2.24 to include security fixes.",
-            "cve": "CVE-2021-33571",
-            "id": "pyup.io-41985",
+            "cve": "CVE-2021-33203",
+            "id": "pyup.io-43364",
             "specs": [
                 "<21.9.0"
             ],
@@ -34664,7 +41176,7 @@
     ],
     "sftp-cloudfs": [
         {
-            "advisory": "sftp-cloudfs before 0.13.1 is using an insecure transitive dependency (ftp-cloudfs<=0.26.1).",
+            "advisory": "sftp-cloudfs before 0.13.1 is using an insecure transitive dependency (ftp-cloudfs<=0.26.1).\r\nhttps://github.com/Memset/sftpcloudfs/commit/a1d8855c576fc3830880e2f200acd205be772da6\r\nhttps://github.com/Memset/sftpcloudfs/issues/13#issuecomment-40093908",
             "cve": "PVE-2021-26135",
             "id": "pyup.io-26135",
             "specs": [
@@ -34810,22 +41322,283 @@
     ],
     "sleap": [
         {
-            "advisory": "Sleap 1.0.10a4 updates TensorFlow 2.1.2 for security reasons.",
-            "cve": "PVE-2021-39680",
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15208",
+            "id": "pyup.io-43798",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15209",
+            "id": "pyup.io-43799",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15204",
+            "id": "pyup.io-43794",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15211",
             "id": "pyup.io-39680",
             "specs": [
-                "<1.0.10a4"
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15205",
+            "id": "pyup.io-43795",
+            "specs": [
+                "<1.0.10"
             ],
-            "v": "<1.0.10a4"
+            "v": "<1.0.10"
         },
         {
-            "advisory": "Sleap 1.0.10a updates TensorFlow 2.1.2 for security reasons.",
-            "cve": "PVE-2021-39679",
-            "id": "pyup.io-39679",
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15202",
+            "id": "pyup.io-43796",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15206",
+            "id": "pyup.io-43797",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15195",
+            "id": "pyup.io-43800",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15207",
+            "id": "pyup.io-43801",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15190",
+            "id": "pyup.io-43802",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15203",
+            "id": "pyup.io-43803",
             "specs": [
-                "<1.0.10a5"
+                "<1.0.10"
             ],
-            "v": "<1.0.10a5"
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-13630",
+            "id": "pyup.io-43804",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15358",
+            "id": "pyup.io-43805",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-11656",
+            "id": "pyup.io-43806",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-11655",
+            "id": "pyup.io-43807",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-13434",
+            "id": "pyup.io-43808",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-13435",
+            "id": "pyup.io-43809",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-13871",
+            "id": "pyup.io-43810",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-13631",
+            "id": "pyup.io-43811",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-9327",
+            "id": "pyup.io-43812",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2020-15210",
+            "id": "pyup.io-43813",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2019-15601",
+            "id": "pyup.io-43814",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2018-19664",
+            "id": "pyup.io-43815",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2018-17190",
+            "id": "pyup.io-43816",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2019-19645",
+            "id": "pyup.io-43817",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2019-19244",
+            "id": "pyup.io-43818",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2019-19880",
+            "id": "pyup.io-43819",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2018-20330",
+            "id": "pyup.io-43820",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2019-10099",
+            "id": "pyup.io-43821",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2018-11770",
+            "id": "pyup.io-43822",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
+        },
+        {
+            "advisory": "Sleap 1.0.10 updates TensorFlow to v2.1.2 for security reasons.",
+            "cve": "CVE-2019-13960",
+            "id": "pyup.io-43823",
+            "specs": [
+                "<1.0.10"
+            ],
+            "v": "<1.0.10"
         }
     ],
     "smbprotocol": [
@@ -34873,26 +41646,26 @@
     "smqtk-detection": [
         {
             "advisory": "Smqtk-detection 0.17.0 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-42901",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-43345",
             "specs": [
                 "<0.17.0"
             ],
             "v": "<0.17.0"
         },
         {
-            "advisory": "Smqtk-detection 0.17.0 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "advisory": "Smqtk-detection 0.17.0 updates its dependency 'pillow' to v8.3.2 to include an OOB vulnerability fix.",
             "cve": "PVE-2021-41277",
-            "id": "pyup.io-43345",
+            "id": "pyup.io-42931",
             "specs": [
                 "<0.17.0"
             ],
             "v": "<0.17.0"
         },
         {
-            "advisory": "Smqtk-detection 0.17.0 updates its dependency 'pillow' to v8.3.2 to include an OOB vulnerability fix.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-42931",
+            "advisory": "Smqtk-detection 0.17.0 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-42901",
             "specs": [
                 "<0.17.0"
             ],
@@ -35122,6 +41895,17 @@
             "v": "<0.1.1"
         }
     ],
+    "speach": [
+        {
+            "advisory": "Speach 0.1a13 uses 'defusedxml' automatically instead of Python's default parser to avoid XML injection.\r\nhttps://github.com/neocl/speach/commit/b992031fa2c0acc7924cd2442d9f77da1cfdf4a3",
+            "cve": "PVE-2022-44552",
+            "id": "pyup.io-44552",
+            "specs": [
+                "<0.1a13"
+            ],
+            "v": "<0.1a13"
+        }
+    ],
     "sphinx": [
         {
             "advisory": "Sphinx 3.0.4 updates jQuery version from 3.4.1 to 3.5.1 for security reasons.",
@@ -35179,13 +41963,13 @@
     ],
     "spinetoolbox": [
         {
-            "advisory": "Spinetoolbox 0.6.0-final.2 requires urllib3 v1.26.5 because of a security vulnerability in earlier versions.",
-            "cve": "PVE-2021-41270",
+            "advisory": "Spinetoolbox 0.6.0 updates its dependency 'urllib3' to v1.26.5 to include a security fix.",
+            "cve": "CVE-2021-33503",
             "id": "pyup.io-41270",
             "specs": [
-                "<0.6.1a0"
+                "<0.6.0"
             ],
-            "v": "<0.6.1a0"
+            "v": "<0.6.0"
         }
     ],
     "spintest": [
@@ -35298,7 +42082,7 @@
     ],
     "sqlalchemy": [
         {
-            "advisory": "SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.",
+            "advisory": "SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter.\r\nhttps://github.com/sqlalchemy/sqlalchemy/issues/4481",
             "cve": "CVE-2019-7164",
             "id": "pyup.io-38497",
             "specs": [
@@ -35308,7 +42092,7 @@
             "v": "<=1.2.17,>=1.3.0b1,<=1.3.0b2"
         },
         {
-            "advisory": "SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.",
+            "advisory": "SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled.\r\nhttps://github.com/sqlalchemy/sqlalchemy/issues/4481#issuecomment-461204518",
             "cve": "CVE-2019-7548",
             "id": "pyup.io-38496",
             "specs": [
@@ -35438,17 +42222,6 @@
             "v": "<3.4.1"
         }
     ],
-    "starcluster": [
-        {
-            "advisory": "starcluster before 0.95.3 opens up the VPC to the internet by default which is a security risk and it requires a special VPC configuration (internet gateway attached to the VPC and a route to the gateway with dest CIDR block 0.0.0.0/0 associated with the VPC subnet).  Configuring this automatically (which does not happen currently) would be a security risk and without this configuration StarCluster cannot connect to the VPC nodes even though they've been assigned a public IP.",
-            "cve": "PVE-2021-26142",
-            "id": "pyup.io-26142",
-            "specs": [
-                "<0.95.3"
-            ],
-            "v": "<0.95.3"
-        }
-    ],
     "stargate": [
         {
             "advisory": "stargate before 0.4 has several undisclosed security vulnerabilities.",
@@ -35504,6 +42277,17 @@
             "v": "<4.1.22"
         }
     ],
+    "storey": [
+        {
+            "advisory": "Storey 0.10.1 updates its dependency 'aiohttp' to v3.7.4 to include a security fix.",
+            "cve": "CVE-2021-21330",
+            "id": "pyup.io-44570",
+            "specs": [
+                "<0.10.1"
+            ],
+            "v": "<0.10.1"
+        }
+    ],
     "stork": [
         {
             "advisory": "Stork 3.0.1 includes re-compiled dependencies to fix a security issue in a pinned dependency.",
@@ -35612,22 +42396,42 @@
             "v": "<6.1.0"
         },
         {
-            "advisory": "Stupidb 6.1.0 and prior uses a version of 'nixpkgs' affected by critical and severe vulnerabilities.",
+            "advisory": "Stupidb 7.0.3 and prior uses a version of 'nixpkgs', containing the package 'signald', which is affected by a medium severity vulnerability.",
             "cve": "CVE-2021-45105",
             "id": "pyup.io-43593",
             "specs": [
-                "<=6.1.0"
+                "<=7.0.3"
             ],
-            "v": "<=6.1.0"
+            "v": "<=7.0.3"
         },
         {
-            "advisory": "Stupidb 6.1.0 and prior uses a version of 'nixpkgs' affected by critical and severe vulnerabilities.",
+            "advisory": "Stupidb 7.0.3 and prior uses a version of 'nixpkgs', containing the package 'signald', which is affected by a medium severity vulnerability.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44457",
+            "specs": [
+                "<=7.0.3"
+            ],
+            "v": "<=7.0.3"
+        },
+        {
+            "advisory": "Stupidb 7.0.3 and prior uses a version of 'nixpkgs', containing the package 'signald', which is affected by a medium severity vulnerability.",
             "cve": "CVE-2021-45046",
             "id": "pyup.io-43592",
             "specs": [
-                "<=6.1.0"
+                "<=7.0.3"
             ],
-            "v": "<=6.1.0"
+            "v": "<=7.0.3"
+        }
+    ],
+    "suap-notifica-govbr": [
+        {
+            "advisory": "Suap-notifica-govbr 4.7.1 updates its dependency 'PyJWT' to v1.5.1 to include a security fix.",
+            "cve": "CVE-2017-11424",
+            "id": "pyup.io-44588",
+            "specs": [
+                "<4.7.1"
+            ],
+            "v": "<4.7.1"
         }
     ],
     "substra": [
@@ -35782,11 +42586,22 @@
             "v": "<=0.9.3"
         }
     ],
+    "svix": [
+        {
+            "advisory": "Svix 0.43.2 updates its JS dependency 'node-fetch' to v2.6.7 to include a security fix.",
+            "cve": "CVE-2022-0235",
+            "id": "pyup.io-44674",
+            "specs": [
+                "<0.43.2"
+            ],
+            "v": "<0.43.2"
+        }
+    ],
     "svmbir": [
         {
             "advisory": "Svmbir 0.2.3 updates its dependency 'Pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-25287",
-            "id": "pyup.io-43519",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-43527",
             "specs": [
                 "<0.2.3"
             ],
@@ -35794,8 +42609,8 @@
         },
         {
             "advisory": "Svmbir 0.2.3 updates its dependency 'Pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-25291",
-            "id": "pyup.io-43522",
+            "cve": "CVE-2021-25288",
+            "id": "pyup.io-43518",
             "specs": [
                 "<0.2.3"
             ],
@@ -35803,8 +42618,8 @@
         },
         {
             "advisory": "Svmbir 0.2.3 updates its dependency 'Pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-43527",
+            "cve": "CVE-2021-28678",
+            "id": "pyup.io-41046",
             "specs": [
                 "<0.2.3"
             ],
@@ -35830,8 +42645,8 @@
         },
         {
             "advisory": "Svmbir 0.2.3 updates its dependency 'Pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-25288",
-            "id": "pyup.io-43518",
+            "cve": "CVE-2021-25287",
+            "id": "pyup.io-43519",
             "specs": [
                 "<0.2.3"
             ],
@@ -35855,6 +42670,15 @@
             ],
             "v": "<0.2.3"
         },
+        {
+            "advisory": "Svmbir 0.2.3 updates its dependency 'Pillow' to v8.2.0 to include security fixes.",
+            "cve": "CVE-2021-25291",
+            "id": "pyup.io-43522",
+            "specs": [
+                "<0.2.3"
+            ],
+            "v": "<0.2.3"
+        },
         {
             "advisory": "Svmbir 0.2.3 updates its dependency 'Pillow' to v8.2.0 to include security fixes.",
             "cve": "CVE-2021-25290",
@@ -35890,15 +42714,6 @@
                 "<0.2.3"
             ],
             "v": "<0.2.3"
-        },
-        {
-            "advisory": "Svmbir 0.2.3 updates its dependency 'Pillow' to v8.2.0 to include security fixes.",
-            "cve": "CVE-2021-28678",
-            "id": "pyup.io-41046",
-            "specs": [
-                "<0.2.3"
-            ],
-            "v": "<0.2.3"
         }
     ],
     "swauth": [
@@ -36126,15 +42941,6 @@
             ],
             "v": "<1.17.0"
         },
-        {
-            "advisory": "In tahoe-lafs 1.17.0, the storage server implementation now respects the 'reserved_space' configuration value when writing lease information and recording corruption advisories. Previously, new leases could be created and written to disk even when the storage server had less remaining space than the configured reserve space value. Now this operation will fail with an exception and the lease will not be created. Similarly, if there is no space available, corruption advisories will be logged but not written to disk.\r\nhttps://tahoe-lafs.org/trac/tahoe-lafs/ticket/3823",
-            "cve": "PVE-2021-43045",
-            "id": "pyup.io-43045",
-            "specs": [
-                "<1.17.0"
-            ],
-            "v": "<1.17.0"
-        },
         {
             "advisory": "In tahoe-lafs 1.17.0, the lease-checker now uses JSON instead of pickle to serialize its state. Tahoe will now refuse to run until you either delete all pickle files or migrate them.\r\nhttps://tahoe-lafs.org/trac/tahoe-lafs/ticket/3825",
             "cve": "PVE-2021-43046",
@@ -36153,6 +42959,15 @@
             ],
             "v": "<1.17.0"
         },
+        {
+            "advisory": "In tahoe-lafs 1.17.0, the storage server implementation now respects the 'reserved_space' configuration value when writing lease information and recording corruption advisories. Previously, new leases could be created and written to disk even when the storage server had less remaining space than the configured reserve space value. Now this operation will fail with an exception and the lease will not be created. Similarly, if there is no space available, corruption advisories will be logged but not written to disk.\r\nhttps://tahoe-lafs.org/trac/tahoe-lafs/ticket/3823",
+            "cve": "PVE-2021-43045",
+            "id": "pyup.io-43045",
+            "specs": [
+                "<1.17.0"
+            ],
+            "v": "<1.17.0"
+        },
         {
             "advisory": "In tahoe-lafs 1.17.0, the SFTP server no longer accepts password-based credentials for authentication. Public/private key-based credentials are now the only supported authentication type. This removes plaintext password storage from the SFTP credentials file. It also removes a possible timing side-channel vulnerability which might have allowed attackers to discover an account's plaintext password.\r\nhttps://tahoe-lafs.org/trac/tahoe-lafs/ticket/3827",
             "cve": "PVE-2021-43047",
@@ -36254,6 +43069,15 @@
         }
     ],
     "taskcluster": [
+        {
+            "advisory": "Taskcluster 24.0.0 includes the necessary CSP headers to avoid clickjacking.\r\nhttps://github.com/taskcluster/taskcluster/commit/99d0b74fb6954367069db8503be51ddf3c11e091",
+            "cve": "PVE-2022-44609",
+            "id": "pyup.io-44609",
+            "specs": [
+                "<24.0.0"
+            ],
+            "v": "<24.0.0"
+        },
         {
             "advisory": "Taskcluster 24.1.3 fixes a possible XSS vulnerability with the lazylog viewer - see: http://bugzil.la/1605933\r\nhttps://github.com/taskcluster/taskcluster/commit/fcbaf7f99a9765936838ac9a90ff5cc7806cb8fc",
             "cve": "PVE-2021-37675",
@@ -36554,17 +43378,17 @@
         },
         {
             "advisory": "Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.",
-            "cve": "CVE-2021-25289",
-            "id": "pyup.io-40133",
+            "cve": "CVE-2021-25291",
+            "id": "pyup.io-43491",
             "specs": [
                 "<12.4.8"
             ],
             "v": "<12.4.8"
         },
         {
-            "advisory": "Tendenci 12.4.8 tightens the security check for the password change page.\r\nhttps://github.com/tendenci/tendenci/commit/4101194640b5d5dc99c01efdfa80c34bdba2b158",
-            "cve": "PVE-2021-40133",
-            "id": "pyup.io-43486",
+            "advisory": "Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.",
+            "cve": "CVE-2021-25293",
+            "id": "pyup.io-43493",
             "specs": [
                 "<12.4.8"
             ],
@@ -36572,17 +43396,17 @@
         },
         {
             "advisory": "Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.",
-            "cve": "CVE-2021-25290",
-            "id": "pyup.io-43487",
+            "cve": "CVE-2021-25289",
+            "id": "pyup.io-40133",
             "specs": [
                 "<12.4.8"
             ],
             "v": "<12.4.8"
         },
         {
-            "advisory": "Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.",
-            "cve": "CVE-2021-27922",
-            "id": "pyup.io-43488",
+            "advisory": "Tendenci 12.4.8 tightens the security check for the password change page.\r\nhttps://github.com/tendenci/tendenci/commit/4101194640b5d5dc99c01efdfa80c34bdba2b158",
+            "cve": "PVE-2021-40133",
+            "id": "pyup.io-43486",
             "specs": [
                 "<12.4.8"
             ],
@@ -36590,8 +43414,8 @@
         },
         {
             "advisory": "Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.",
-            "cve": "CVE-2021-27921",
-            "id": "pyup.io-43489",
+            "cve": "CVE-2021-27922",
+            "id": "pyup.io-43488",
             "specs": [
                 "<12.4.8"
             ],
@@ -36599,8 +43423,8 @@
         },
         {
             "advisory": "Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.",
-            "cve": "CVE-2021-27923",
-            "id": "pyup.io-43490",
+            "cve": "CVE-2021-27921",
+            "id": "pyup.io-43489",
             "specs": [
                 "<12.4.8"
             ],
@@ -36608,8 +43432,8 @@
         },
         {
             "advisory": "Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.",
-            "cve": "CVE-2021-25291",
-            "id": "pyup.io-43491",
+            "cve": "CVE-2021-25290",
+            "id": "pyup.io-43487",
             "specs": [
                 "<12.4.8"
             ],
@@ -36626,8 +43450,8 @@
         },
         {
             "advisory": "Tendenci 12.4.8 updates its dependency 'Pillow' to v8.1.2 to include security fixes.",
-            "cve": "CVE-2021-25293",
-            "id": "pyup.io-43493",
+            "cve": "CVE-2021-27923",
+            "id": "pyup.io-43490",
             "specs": [
                 "<12.4.8"
             ],
@@ -36673,15 +43497,6 @@
             ],
             "v": "<1.10.0"
         },
-        {
-            "advisory": "Tensorflow 1.12.2 fixes a potential security vulnerability where carefully crafted GIF images can produce a null pointer dereference during decoding.",
-            "cve": "PVE-2021-37167",
-            "id": "pyup.io-37167",
-            "specs": [
-                "<1.12.2"
-            ],
-            "v": "<1.12.2"
-        },
         {
             "advisory": "NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file. See CVE-2019-9635.",
             "cve": "CVE-2019-9635",
@@ -36710,9 +43525,9 @@
             "v": "<1.15.0"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"curl\" to handle CVE-2019-15601.",
-            "cve": "CVE-2019-15601",
-            "id": "pyup.io-39820",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"SQLite\" to handle CVE-2019-19645.",
+            "cve": "CVE-2019-19645",
+            "id": "pyup.io-39819",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36721,9 +43536,9 @@
             "v": "<1.15.3,>=2.0.0a0,<2.0.2,>=2.1.0rc0,<2.1.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"libjpeg-turbo\" to handle CVE-2018-19664.",
-            "cve": "CVE-2018-19664",
-            "id": "pyup.io-39821",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"SQLite3\" to handle CVE-2019-19880.",
+            "cve": "CVE-2019-19880",
+            "id": "pyup.io-38460",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36732,9 +43547,9 @@
             "v": "<1.15.3,>=2.0.0a0,<2.0.2,>=2.1.0rc0,<2.1.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"Apache Spark\" to handle CVE-2018-17190.",
-            "cve": "CVE-2018-17190",
-            "id": "pyup.io-39825",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"SQLite3\" to handle CVE-2019-19244.",
+            "cve": "CVE-2019-19244",
+            "id": "pyup.io-39818",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36743,9 +43558,9 @@
             "v": "<1.15.3,>=2.0.0a0,<2.0.2,>=2.1.0rc0,<2.1.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"SQLite\" to handle CVE-2019-19645.",
-            "cve": "CVE-2019-19645",
-            "id": "pyup.io-39819",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"curl\" to handle CVE-2019-15601.",
+            "cve": "CVE-2019-15601",
+            "id": "pyup.io-39820",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36754,9 +43569,9 @@
             "v": "<1.15.3,>=2.0.0a0,<2.0.2,>=2.1.0rc0,<2.1.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"SQLite3\" to handle CVE-2019-19244.",
-            "cve": "CVE-2019-19244",
-            "id": "pyup.io-39818",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"libjpeg-turbo\" to handle CVE-2018-19664.",
+            "cve": "CVE-2018-19664",
+            "id": "pyup.io-39821",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36765,9 +43580,9 @@
             "v": "<1.15.3,>=2.0.0a0,<2.0.2,>=2.1.0rc0,<2.1.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"SQLite3\" to handle CVE-2019-19880.",
-            "cve": "CVE-2019-19880",
-            "id": "pyup.io-38460",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"libjpeg-turbo\" to handle CVE-2018-20330.",
+            "cve": "CVE-2018-20330",
+            "id": "pyup.io-39822",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36776,9 +43591,9 @@
             "v": "<1.15.3,>=2.0.0a0,<2.0.2,>=2.1.0rc0,<2.1.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"libjpeg-turbo\" to handle CVE-2018-20330.",
-            "cve": "CVE-2018-20330",
-            "id": "pyup.io-39822",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"libjpeg-turbo\" to handle CVE-2019-13960.",
+            "cve": "CVE-2019-13960",
+            "id": "pyup.io-39823",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36798,9 +43613,9 @@
             "v": "<1.15.3,>=2.0.0a0,<2.0.2,>=2.1.0rc0,<2.1.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"Apache Spark\" to handle CVE-2018-11770.",
-            "cve": "CVE-2018-11770",
-            "id": "pyup.io-39826",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"Apache Spark\" to handle CVE-2018-17190.",
+            "cve": "CVE-2018-17190",
+            "id": "pyup.io-39825",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36809,9 +43624,9 @@
             "v": "<1.15.3,>=2.0.0a0,<2.0.2,>=2.1.0rc0,<2.1.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"libjpeg-turbo\" to handle CVE-2019-13960.",
-            "cve": "CVE-2019-13960",
-            "id": "pyup.io-39823",
+            "advisory": "Tensorflow versions 1.15.3, 2.0.2 and 2.1.1 updates its dependency \"Apache Spark\" to handle CVE-2018-11770.",
+            "cve": "CVE-2018-11770",
+            "id": "pyup.io-39826",
             "specs": [
                 "<1.15.3",
                 ">=2.0.0a0,<2.0.2",
@@ -36872,9 +43687,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0a0,<2.1.2,>=2.2.0a0,<2.2.1,>=2.3.0a0,<2.3.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 include a fix for CVE-2020-15208: In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a \"DCHECK\" which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue was patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d",
-            "cve": "CVE-2020-15208",
-            "id": "pyup.io-39937",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 include a fix for CVE-2020-15206: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's \"SavedModel\" protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using \"tensorflow-serving\" or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d. However, this was not enough, as #41097 reported a different failure mode. The issue was finally patched in commit df095206f25471e864a8e63a0f1caef53a0e3a6",
+            "cve": "CVE-2020-15206",
+            "id": "pyup.io-39939",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -36885,9 +43700,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0a0,<2.1.2,>=2.2.0a0,<2.2.1,>=2.3.0a0,<2.3.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 include a fix for CVE-2020-15206: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, changing the TensorFlow's \"SavedModel\" protocol buffer and altering the name of required keys results in segfaults and data corruption while loading the model. This can cause a denial of service in products using \"tensorflow-serving\" or other inference-as-a-service installments. Fixed were added in commits f760f88b4267d981e13f4b302c437ae800445968 and fcfef195637c6e365577829c4d67681695956e7d. However, this was not enough, as #41097 reported a different failure mode. The issue was finally patched in commit df095206f25471e864a8e63a0f1caef53a0e3a6",
-            "cve": "CVE-2020-15206",
-            "id": "pyup.io-39939",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, and 2.3.1 include a fix for CVE-2020-15208: In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a \"DCHECK\" which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue was patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d",
+            "cve": "CVE-2020-15208",
+            "id": "pyup.io-39937",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -36963,9 +43778,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0a0,<2.1.2,>=2.2.0a0,<2.2.1,>=2.3.0a0,<2.3.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13630.",
-            "cve": "CVE-2020-13630",
-            "id": "pyup.io-39901",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13871.",
+            "cve": "CVE-2020-13871",
+            "id": "pyup.io-39899",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -36987,9 +43802,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0rc0,<2.1.2,>=2.2.0rc0,<2.2.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-11655.",
-            "cve": "CVE-2020-11655",
-            "id": "pyup.io-39932",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-9327.",
+            "cve": "CVE-2020-9327",
+            "id": "pyup.io-39906",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -36999,9 +43814,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0rc0,<2.1.2,>=2.2.0rc0,<2.2.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13434.",
-            "cve": "CVE-2020-13434",
-            "id": "pyup.io-39903",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-11655.",
+            "cve": "CVE-2020-11655",
+            "id": "pyup.io-39932",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -37011,9 +43826,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0rc0,<2.1.2,>=2.2.0rc0,<2.2.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13435.",
-            "cve": "CVE-2020-13435",
-            "id": "pyup.io-39902",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13631.",
+            "cve": "CVE-2020-13631",
+            "id": "pyup.io-39900",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -37023,9 +43838,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0rc0,<2.1.2,>=2.2.0rc0,<2.2.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13871.",
-            "cve": "CVE-2020-13871",
-            "id": "pyup.io-39899",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13630.",
+            "cve": "CVE-2020-13630",
+            "id": "pyup.io-39901",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -37035,9 +43850,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0rc0,<2.1.2,>=2.2.0rc0,<2.2.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13631.",
-            "cve": "CVE-2020-13631",
-            "id": "pyup.io-39900",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13435.",
+            "cve": "CVE-2020-13435",
+            "id": "pyup.io-39902",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -37047,9 +43862,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0rc0,<2.1.2,>=2.2.0rc0,<2.2.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-9327.",
-            "cve": "CVE-2020-9327",
-            "id": "pyup.io-39906",
+            "advisory": "Tensorflow versions 1.15.4, 2.0.3, 2.1.2 and 2.2.1 updates its dependency \"SQLite\" to handle CVE-2020-13434.",
+            "cve": "CVE-2020-13434",
+            "id": "pyup.io-39903",
             "specs": [
                 "<1.15.4",
                 ">=2.0.0a0,<2.0.3",
@@ -37085,9 +43900,9 @@
             "v": "<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0rc0,<2.1.2,>=2.2.0rc0,<2.2.1,>=2.3.0rc0,<2.3.1"
         },
         {
-            "advisory": "Tensorflow versions 2.3.2, 2.2.2, 2.1.3, 2.0.4 and 1.15.5 update its dependency 'Junit4' to v4.13.1 to include a security fix.",
-            "cve": "CVE-2020-15250",
-            "id": "pyup.io-39724",
+            "advisory": "Tensorflow versions 2.3.2, 2.2.2, 2.1.3, 2.0.4 and 1.15.5 update its dependency \"PCRE\" to fix CVE-2019-20838.",
+            "cve": "CVE-2019-20838",
+            "id": "pyup.io-39406",
             "specs": [
                 "<1.15.5",
                 ">=2.0.0a0,<2.0.4",
@@ -37098,9 +43913,9 @@
             "v": "<1.15.5,>=2.0.0a0,<2.0.4,>=2.1.0rc0,<2.1.3,>=2.2.0rc0,<2.2.2,>=2.3.0rc0,<2.3.2"
         },
         {
-            "advisory": "Tensorflow versions 2.3.2, 2.2.2, 2.1.3, 2.0.4 and 1.15.5 update its dependency \"PCRE\" to fix CVE-2019-20838.",
-            "cve": "CVE-2019-20838",
-            "id": "pyup.io-39406",
+            "advisory": "Tensorflow versions 2.3.2, 2.2.2, 2.1.3, 2.0.4 and 1.15.5 update its dependency 'Junit4' to v4.13.1 to include a security fix.",
+            "cve": "CVE-2020-15250",
+            "id": "pyup.io-39724",
             "specs": [
                 "<1.15.5",
                 ">=2.0.0a0,<2.0.4",
@@ -37111,9 +43926,9 @@
             "v": "<1.15.5,>=2.0.0a0,<2.0.4,>=2.1.0rc0,<2.1.3,>=2.2.0rc0,<2.2.2,>=2.3.0rc0,<2.3.2"
         },
         {
-            "advisory": "Tensorflow versions 2.3.2, 2.2.2, 2.1.3, 2.0.4 and 1.15.5 updates its dependency \"Libjpeg-turbo\" to handle CVE-2020-13790.",
-            "cve": "CVE-2020-13790",
-            "id": "pyup.io-39726",
+            "advisory": "Tensorflow versions 1.15.5, 2.0.4, 2.1.3, 2.2.2 and 2.3.2 updates its dependency \"PCRE\" to handle CVE-2020-14155.",
+            "cve": "CVE-2020-14155",
+            "id": "pyup.io-39725",
             "specs": [
                 "<1.15.5",
                 ">=2.0.0a0,<2.0.4",
@@ -37124,9 +43939,9 @@
             "v": "<1.15.5,>=2.0.0a0,<2.0.4,>=2.1.0rc0,<2.1.3,>=2.2.0rc0,<2.2.2,>=2.3.0rc0,<2.3.2"
         },
         {
-            "advisory": "Tensorflow versions 1.15.5, 2.0.4, 2.1.3, 2.2.2 and 2.3.2 updates its dependency \"PCRE\" to handle CVE-2020-14155.",
-            "cve": "CVE-2020-14155",
-            "id": "pyup.io-39725",
+            "advisory": "Tensorflow versions 2.3.2, 2.2.2, 2.1.3, 2.0.4 and 1.15.5 updates its dependency \"Libjpeg-turbo\" to handle CVE-2020-13790.",
+            "cve": "CVE-2020-13790",
+            "id": "pyup.io-39726",
             "specs": [
                 "<1.15.5",
                 ">=2.0.0a0,<2.0.4",
@@ -37281,20 +44096,9 @@
             "v": "<2.4.4,>=2.5.0rc0,<2.5.2, >=2.6.0rc0,<2.6.1"
         },
         {
-            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 update its dependency 'curl' to v7.78.0 to handle CVE-2021-22924.",
-            "cve": "CVE-2021-22924",
-            "id": "pyup.io-43748",
-            "specs": [
-                "<2.4.4",
-                ">=2.5.0rc0,<2.5.2",
-                ">=2.6.0rc0,<2.6.1"
-            ],
-            "v": "<2.4.4,>=2.5.0rc0,<2.5.2,>=2.6.0rc0,<2.6.1"
-        },
-        {
-            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 update its dependency 'curl' to v7.78.0 to handle CVE-2021-22926.",
-            "cve": "CVE-2021-22926",
-            "id": "pyup.io-43750",
+            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 update its dependency 'curl' to v7.78.0 to handle CVE-2021-22923.",
+            "cve": "CVE-2021-22923",
+            "id": "pyup.io-43747",
             "specs": [
                 "<2.4.4",
                 ">=2.5.0rc0,<2.5.2",
@@ -37303,9 +44107,9 @@
             "v": "<2.4.4,>=2.5.0rc0,<2.5.2,>=2.6.0rc0,<2.6.1"
         },
         {
-            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 update its dependency 'curl' to v7.78.0 to handle CVE-2021-22923.",
-            "cve": "CVE-2021-22923",
-            "id": "pyup.io-43747",
+            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 update its dependency 'curl' to v7.78.0 to handle CVE-2021-22924.",
+            "cve": "CVE-2021-22924",
+            "id": "pyup.io-43748",
             "specs": [
                 "<2.4.4",
                 ">=2.5.0rc0,<2.5.2",
@@ -37314,9 +44118,9 @@
             "v": "<2.4.4,>=2.5.0rc0,<2.5.2,>=2.6.0rc0,<2.6.1"
         },
         {
-            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 update its dependency 'curl' to v7.78.0 to handle CVE-2021-22925.",
-            "cve": "CVE-2021-22925",
-            "id": "pyup.io-43749",
+            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 update its dependency 'curl' to v7.78.0 to handle CVE-2021-22926.",
+            "cve": "CVE-2021-22926",
+            "id": "pyup.io-43750",
             "specs": [
                 "<2.4.4",
                 ">=2.5.0rc0,<2.5.2",
@@ -37457,9 +44261,9 @@
             "v": "<2.4.4,>=2.5.0rc0,<2.5.2,>=2.6.0rc0,<2.6.1"
         },
         {
-            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41213: In affected versions, the code behind 'tf.function' API can be made to deadlock when two 'tf.function' decorated Python functions are mutually recursive. This occurs due to using a non-reentrant 'Lock' Python object. Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive 'tf.function', although this is not a frequent scenario. The fix is included in TensorFlow 2.7.0.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-h67m-xg8f-fxcf\r\nhttps://github.com/tensorflow/tensorflow/commit/afac8158d43691661ad083f6dd9e56f327c1dcb7",
-            "cve": "CVE-2021-41213",
-            "id": "pyup.io-42460",
+            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41209: In affected versions, the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix is included in TensorFlow 2.7.0.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-6hpv-v2rx-c5g6\r\nhttps://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235",
+            "cve": "CVE-2021-41209",
+            "id": "pyup.io-42456",
             "specs": [
                 "<2.4.4",
                 ">=2.5.0rc0,<2.5.2",
@@ -37468,9 +44272,9 @@
             "v": "<2.4.4,>=2.5.0rc0,<2.5.2,>=2.6.0rc0,<2.6.1"
         },
         {
-            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41204: In affected versions, during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix is included in TensorFlow 2.7.0.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-786j-5qwq-r36x\r\nhttps://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d631611211156659",
-            "cve": "CVE-2021-41204",
-            "id": "pyup.io-42451",
+            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41213: In affected versions, the code behind 'tf.function' API can be made to deadlock when two 'tf.function' decorated Python functions are mutually recursive. This occurs due to using a non-reentrant 'Lock' Python object. Loading any model which contains mutually recursive functions is vulnerable. An attacker can cause denial of service by causing users to load such models and calling a recursive 'tf.function', although this is not a frequent scenario. The fix is included in TensorFlow 2.7.0.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-h67m-xg8f-fxcf\r\nhttps://github.com/tensorflow/tensorflow/commit/afac8158d43691661ad083f6dd9e56f327c1dcb7",
+            "cve": "CVE-2021-41213",
+            "id": "pyup.io-42460",
             "specs": [
                 "<2.4.4",
                 ">=2.5.0rc0,<2.5.2",
@@ -37479,9 +44283,9 @@
             "v": "<2.4.4,>=2.5.0rc0,<2.5.2,>=2.6.0rc0,<2.6.1"
         },
         {
-            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41209: In affected versions, the implementations for convolution operators trigger a division by 0 if passed empty filter tensor arguments. The fix is included in TensorFlow 2.7.0.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-6hpv-v2rx-c5g6\r\nhttps://github.com/tensorflow/tensorflow/commit/f2c3931113eaafe9ef558faaddd48e00a6606235",
-            "cve": "CVE-2021-41209",
-            "id": "pyup.io-42456",
+            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 include a fix for CVE-2021-41204: In affected versions, during TensorFlow's Grappler optimizer phase, constant folding might attempt to deep copy a resource tensor. This results in a segfault, as these tensors are supposed to not change. The fix is included in TensorFlow 2.7.0.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-786j-5qwq-r36x\r\nhttps://github.com/tensorflow/tensorflow/commit/7731e8dfbe4a56773be5dc94d631611211156659",
+            "cve": "CVE-2021-41204",
+            "id": "pyup.io-42451",
             "specs": [
                 "<2.4.4",
                 ">=2.5.0rc0,<2.5.2",
@@ -37676,6 +44480,17 @@
             ],
             "v": "<2.4.4,>=2.5.0rc0,<2.5.2,>=2.6.0rc0,<2.6.1"
         },
+        {
+            "advisory": "Tensorflow versions 2.4.4, 2.5.2 and 2.6.1 update its dependency 'curl' to v7.78.0 to handle CVE-2021-22925.",
+            "cve": "CVE-2021-22925",
+            "id": "pyup.io-43749",
+            "specs": [
+                "<2.4.4",
+                ">=2.5.0rc0,<2.5.2",
+                ">=2.6.0rc0,<2.6.1"
+            ],
+            "v": "<2.4.4,>=2.5.0rc0,<2.5.2,>=2.6.0rc0,<2.6.1"
+        },
         {
             "advisory": "Google TensorFlow 1.7 and below is affected by: Buffer Overflow. The impact is: execute arbitrary code (local). See CVE-2018-8825.",
             "cve": "CVE-2018-8825",
@@ -37699,9 +44514,9 @@
             "v": ">=1.15.0rc0,<1.15.4,>=2.0.0a0,<2.0.3,>=2.1.0rc0,<2.1.2,>=2.2.0rc0,<2.2.1,>=2.3.0rc0,<2.3.1"
         },
         {
-            "advisory": "Tensorflow versions 1.15.2 and 2.0.1 updates its dependency \"SQLite\" to handle CVE-2019-19646.",
-            "cve": "CVE-2019-19646",
-            "id": "pyup.io-39537",
+            "advisory": "Tensorflow versions 1.15.2  and 2.0.1 updates its dependency \"curl\" to handle CVE-2019-5481.",
+            "cve": "CVE-2019-5481",
+            "id": "pyup.io-39570",
             "specs": [
                 ">=2.0.0a0,<2.0.1",
                 "<1.15.2"
@@ -37709,9 +44524,9 @@
             "v": ">=2.0.0a0,<2.0.1,<1.15.2"
         },
         {
-            "advisory": "Tensorflow versions 1.15.2  and 2.0.1 updates its dependency \"curl\" to handle CVE-2019-5481.",
-            "cve": "CVE-2019-5481",
-            "id": "pyup.io-39570",
+            "advisory": "Tensorflow versions 1.15.2 and 2.0.1 includes a fix for CVE-2020-5215: In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar tf.float16 value with a scalar string will trigger this issue due to automatic conversions. This can be easily reproduced by tf.constant(\"hello\", tf.float16), if eager execution is enabled.",
+            "cve": "CVE-2020-5215",
+            "id": "pyup.io-37776",
             "specs": [
                 ">=2.0.0a0,<2.0.1",
                 "<1.15.2"
@@ -37729,9 +44544,9 @@
             "v": ">=2.0.0a0,<2.0.1,<1.15.2"
         },
         {
-            "advisory": "Tensorflow versions 1.15.2 and 2.0.1 includes a fix for CVE-2020-5215: In TensorFlow before 1.15.2 and 2.0.1, converting a string (from Python) to a tf.float16 value results in a segmentation fault in eager mode as the format checks for this use case are only in the graph mode. This issue can lead to denial of service in inference/training where a malicious attacker can send a data point which contains a string instead of a tf.float16 value. Similar effects can be obtained by manipulating saved models and checkpoints whereby replacing a scalar tf.float16 value with a scalar string will trigger this issue due to automatic conversions. This can be easily reproduced by tf.constant(\"hello\", tf.float16), if eager execution is enabled.",
-            "cve": "CVE-2020-5215",
-            "id": "pyup.io-37776",
+            "advisory": "Tensorflow versions 1.15.2  and 2.0.1 updates its dependency \"curl\" to handle CVE-2019-5482.",
+            "cve": "CVE-2019-5482",
+            "id": "pyup.io-38039",
             "specs": [
                 ">=2.0.0a0,<2.0.1",
                 "<1.15.2"
@@ -37739,9 +44554,9 @@
             "v": ">=2.0.0a0,<2.0.1,<1.15.2"
         },
         {
-            "advisory": "Tensorflow versions 1.15.2  and 2.0.1 updates its dependency \"curl\" to handle CVE-2019-5482.",
-            "cve": "CVE-2019-5482",
-            "id": "pyup.io-38039",
+            "advisory": "Tensorflow versions 1.15.2 and 2.0.1 updates its dependency \"SQLite\" to handle CVE-2019-19646.",
+            "cve": "CVE-2019-19646",
+            "id": "pyup.io-39537",
             "specs": [
                 ">=2.0.0a0,<2.0.1",
                 "<1.15.2"
@@ -37749,7 +44564,7 @@
             "v": ">=2.0.0a0,<2.0.1,<1.15.2"
         },
         {
-            "advisory": "Due to lack of validation in `tf.raw_ops.SparseDenseCwiseMul`, an attacker can trigger denial of service via `CHECK`-fails or accesses to outside the bounds of heap allocated data. Since the implementation(https://github.com/tensorflow/tensorflow/blob/38178a2f7a681a7835bb0912702a134bfe3b4d84/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L68-L80) only validates the rank of the input arguments but no constraints between dimensions(https://www.tensorflow.org/api_docs/python/tf/raw_ops/SparseDenseCwiseMul), an attacker can abuse them to trigger internal `CHECK` assertions (and cause program termination, denial of service) or to write to memory outside of bounds of heap allocated tensor buffers.",
+            "advisory": "Tensorflow versions 2.1.4, 2.2.3, 2.3.3, 2.4.2 and 2.5.0 include a fix for CVE-2021-29567: Due to lack of validation in 'tf.raw_ops.SparseDenseCwiseMul', an attacker can trigger denial of service via 'CHECK'-fails or accesses to outside the bounds of heap allocated data. Since the implementation (https://github.com/tensorflow/tensorflow/blob/38178a2f7a681a7835bb0912702a134bfe3b4d84/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc#L68-L80), it only validates the rank of the input arguments but no constraints between dimensions (https://www.tensorflow.org/api_docs/python/tf/raw_ops/SparseDenseCwiseMul) and an attacker can abuse them to trigger internal 'CHECK' assertions (and cause program termination, denial of service) or to write to memory outside of bounds of heap allocated tensor buffers.",
             "cve": "CVE-2021-29567",
             "id": "pyup.io-40469",
             "specs": [
@@ -37772,9 +44587,9 @@
             "v": ">=2.2.0rc0,<2.2.1,>=2.3.0rc0,<2.3.1"
         },
         {
-            "advisory": "TensorFlow versions 2.2.1 and 2.3.1 includes a fix for CVE-2020-15214: In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the dimension of output tensor. This results in allocating insufficient memory for the output tensor and in a write outside the bounds of the output array. This usually results in a segmentation fault, but depending on runtime conditions it can provide for a write gadget to be used in future memory corruption-based exploits. The issue was patched in commit 204945b19e44b57906c9344c0d00120eeeae178a. A potential workaround is to add a custom \"Verifier\" to the model loading code to ensure that the segment ids are sorted, although this only handles the case when the segment ids are stored statically in the model. A similar validation could be done if the segment ids are generated at runtime between inference steps. If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.",
-            "cve": "CVE-2020-15214",
-            "id": "pyup.io-39850",
+            "advisory": "Tensorflow versions 2.2.1 and 2.3.1 include a fix for CVE-2020-15192: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to 'dlpack.to_dlpack' there is a memory leak following an expected validation failure. The issue occurs because the 'status' argument during validation failures is not properly checked. Since each of the above methods can return an error status, the 'status' value must be checked before continuing.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fxw-76px-3rxv",
+            "cve": "CVE-2020-15192",
+            "id": "pyup.io-39871",
             "specs": [
                 ">=2.2.0rc0,<2.2.1",
                 ">=2.3.0rc0,<2.3.1"
@@ -37782,9 +44597,9 @@
             "v": ">=2.2.0rc0,<2.2.1,>=2.3.0rc0,<2.3.1"
         },
         {
-            "advisory": "In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to 'dlpack.to_dlpack' the expected validations will cause variables to bind to 'nullptr' while setting a 'status' variable to the error condition. However, this 'status' argument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with '-fsanitize=null'.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8qj-fc9q-cphr",
-            "cve": "CVE-2020-15191",
-            "id": "pyup.io-39872",
+            "advisory": "TensorFlow versions 2.2.1 and 2.3.1 includes a fix for CVE-2020-15214: In TensorFlow Lite before versions 2.2.1 and 2.3.1, models using segment sum can trigger a write out bounds / segmentation fault if the segment ids are not sorted. Code assumes that the segment ids are in increasing order, using the last element of the tensor holding them to determine the dimension of output tensor. This results in allocating insufficient memory for the output tensor and in a write outside the bounds of the output array. This usually results in a segmentation fault, but depending on runtime conditions it can provide for a write gadget to be used in future memory corruption-based exploits. The issue was patched in commit 204945b19e44b57906c9344c0d00120eeeae178a. A potential workaround is to add a custom \"Verifier\" to the model loading code to ensure that the segment ids are sorted, although this only handles the case when the segment ids are stored statically in the model. A similar validation could be done if the segment ids are generated at runtime between inference steps. If the segment ids are generated as outputs of a tensor during inference steps, then there are no possible workaround and users are advised to upgrade to patched code.",
+            "cve": "CVE-2020-15214",
+            "id": "pyup.io-39850",
             "specs": [
                 ">=2.2.0rc0,<2.2.1",
                 ">=2.3.0rc0,<2.3.1"
@@ -37792,9 +44607,9 @@
             "v": ">=2.2.0rc0,<2.2.1,>=2.3.0rc0,<2.3.1"
         },
         {
-            "advisory": "In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes a list of strings to 'dlpack.to_dlpack' there is a memory leak following an expected validation failure. The issue occurs because the 'status' argument during validation failures is not properly checked. Since each of the above methods can return an error status, the 'status' value must be checked before continuing.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-8fxw-76px-3rxv",
-            "cve": "CVE-2020-15192",
-            "id": "pyup.io-39871",
+            "advisory": "Tensorflow versions 2.2.1 and 2.3.1 include a fix for CVE-2020-15191: In Tensorflow before versions 2.2.1 and 2.3.1, if a user passes an invalid argument to 'dlpack.to_dlpack' the expected validations will cause variables to bind to 'nullptr' while setting a 'status' variable to the error condition. However, this 'status' argument is not properly checked. Hence, code following these methods will bind references to null pointers. This is undefined behavior and reported as an error if compiling with '-fsanitize=null'.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-q8qj-fc9q-cphr",
+            "cve": "CVE-2020-15191",
+            "id": "pyup.io-39872",
             "specs": [
                 ">=2.2.0rc0,<2.2.1",
                 ">=2.3.0rc0,<2.3.1"
@@ -38227,9 +45042,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.1.0rc0,<2.1.4,>=2.2.0rc0,<2.2.3,>=2.3.0rc0,<2.3.3,>=2.4.0rc0,<2.4.2"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2 and 2.5.0 fix a heap buffer overflow in 'Conv3DBackprop*'. See CVE-2021-29520.",
-            "cve": "CVE-2021-29520",
-            "id": "pyup.io-40680",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2 and 2.5.0 fix a division by 0 in 'Conv2DBackpropFilter'. See CVE-2021-29524.",
+            "cve": "CVE-2021-29524",
+            "id": "pyup.io-40683",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.1.0rc0,<2.1.4",
@@ -38240,9 +45055,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.1.0rc0,<2.1.4,>=2.2.0rc0,<2.2.3,>=2.3.0rc0,<2.3.3,>=2.4.0rc0,<2.4.2"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2 and 2.5.0 fix a division by 0 in 'Conv2DBackpropFilter'. See CVE-2021-29524.",
-            "cve": "CVE-2021-29524",
-            "id": "pyup.io-40683",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2 and 2.5.0 fix a heap buffer overflow in 'Conv3DBackprop*'. See CVE-2021-29520.",
+            "cve": "CVE-2021-29520",
+            "id": "pyup.io-40680",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.1.0rc0,<2.1.4",
@@ -38669,9 +45484,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.3.0rc0,<2.3.3,>=2.4.0rc0,<2.4.2,>=2.1.0rc0,<2.1.4,>=2.2.0rc0,<2.2.3"
         },
         {
-            "advisory": "If the 'splits' argument of 'RaggedBincount' does not specify a valid 'SparseTensor'(https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of the 'splits' tensor buffer in the implementation of the 'RaggedBincount' op (https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincount_op.cc#L430-L433). Before the 'for' loop, 'batch_idx' is set to 0. The user controls the 'splits' array, making it contain only one element, 0. Thus, the code in the 'while' loop would increment 'batch_idx' and then try to read 'splits(1)', which is outside of bounds.",
-            "cve": "CVE-2021-29512",
-            "id": "pyup.io-40464",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 fix a segfault in 'CTCBeamSearchDecoder'. See CVE-2021-29581.",
+            "cve": "CVE-2021-29581",
+            "id": "pyup.io-40734",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.3.0rc0,<2.3.3",
@@ -38682,9 +45497,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.3.0rc0,<2.3.3,>=2.4.0rc0,<2.4.2,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 fix a segfault in 'CTCBeamSearchDecoder'. See CVE-2021-29581.",
-            "cve": "CVE-2021-29581",
-            "id": "pyup.io-40734",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29617: An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments.",
+            "cve": "CVE-2021-29617",
+            "id": "pyup.io-40770",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.3.0rc0,<2.3.3",
@@ -38695,9 +45510,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.3.0rc0,<2.3.3,>=2.4.0rc0,<2.4.2,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29617: An attacker can cause a denial of service via `CHECK`-fail in `tf.strings.substr` with invalid arguments.",
-            "cve": "CVE-2021-29617",
-            "id": "pyup.io-40770",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 fix an undefined behavior in 'MaxPool3DGradGrad'. See CVE-2021-29574.",
+            "cve": "CVE-2021-29574",
+            "id": "pyup.io-40728",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.3.0rc0,<2.3.3",
@@ -38708,9 +45523,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.3.0rc0,<2.3.3,>=2.4.0rc0,<2.4.2,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 fix an undefined behavior in 'MaxPool3DGradGrad'. See CVE-2021-29574.",
-            "cve": "CVE-2021-29574",
-            "id": "pyup.io-40728",
+            "advisory": "Tensorflow versions 2.1.4, 2.2.3, 2.3.3, 2.4.2 and 2.5.0 include a fix for CVE-2021-29512: If the 'splits' argument of 'RaggedBincount' does not specify a valid 'SparseTensor' (https://www.tensorflow.org/api_docs/python/tf/sparse/SparseTensor), then an attacker can trigger a heap buffer overflow. This will cause a read from outside the bounds of the 'splits' tensor buffer in the implementation of the 'RaggedBincount' op (https://github.com/tensorflow/tensorflow/blob/8b677d79167799f71c42fd3fa074476e0295413a/tensorflow/core/kernels/bincount_op.cc#L430-L433). Before the 'for' loop, 'batch_idx' is set to 0. The user controls the 'splits' array, making it contain only one element, 0. Thus, the code in the 'while' loop would increment 'batch_idx' and then try to read 'splits(1)', which is outside of bounds.",
+            "cve": "CVE-2021-29512",
+            "id": "pyup.io-40464",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.3.0rc0,<2.3.3",
@@ -38864,9 +45679,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.1.0rc0,<2.1.4,>=2.2.0rc0,<2.2.3"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 fix a division by 0 in 'SparseMatMul'. See CVE-2021-29557.",
-            "cve": "CVE-2021-29557",
-            "id": "pyup.io-40713",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 fix a division by 0 in 'FusedBatchNorm'. See CVE-2021-29555.",
+            "cve": "CVE-2021-29555",
+            "id": "pyup.io-40712",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.4.0rc0,<2.4.2",
@@ -38877,9 +45692,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.1.0rc0,<2.1.4,>=2.2.0rc0,<2.2.3"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 fix a division by 0 in 'FusedBatchNorm'. See CVE-2021-29555.",
-            "cve": "CVE-2021-29555",
-            "id": "pyup.io-40712",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 fix a division by 0 in 'SparseMatMul'. See CVE-2021-29557.",
+            "cve": "CVE-2021-29557",
+            "id": "pyup.io-40713",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.4.0rc0,<2.4.2",
@@ -38928,6 +45743,19 @@
             ],
             "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
+        {
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 update 'curl' to '7.76.0' to handle CVE-2020-8177.",
+            "cve": "CVE-2020-8177",
+            "id": "pyup.io-40773",
+            "specs": [
+                ">=2.5.0rc0,<2.5.0",
+                ">=2.4.0rc0,<2.4.2",
+                ">=2.3.0rc0,<2.3.3",
+                ">=2.2.0rc0,<2.2.3",
+                ">=2.1.0rc0,<2.1.4"
+            ],
+            "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
+        },
         {
             "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29616: The implementation of TrySimplify (https://github.com/tensorflow/tensorflow/blob/c22d88d6ff33031aa113e48aa3fc9aa74ed79595/tensorflow/core/grappler/optimizers/arithmetic_optimizer.cc#L390-L401) has undefined behavior due to dereferencing a null pointer in corner cases that result in optimizing a node with no inputs.",
             "cve": "CVE-2021-29616",
@@ -38994,9 +45822,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29563: An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.RFFT`. Eigen code operating on an empty matrix can trigger on an assertion and will cause program termination.",
-            "cve": "CVE-2021-29563",
-            "id": "pyup.io-40720",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29566: An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to 'tf.raw_ops.Dilation2DBackpropInput'. This is because the implementation (https://github.com/tensorflow/tensorflow/blob/afd954e65f15aea4d438d0a219136fc4a63a573d/tensorflow/core/kernels/dilation_ops.cc#L321-L322) does not validate before writing to the output array. The values for 'h_out' and 'w_out' are guaranteed to be in range for 'out_backprop' (as they are loop indices bounded by the size of the array). However, there are no similar guarantees relating 'h_in_max'/'w_in_max' and 'in_backprop'.",
+            "cve": "CVE-2021-29566",
+            "id": "pyup.io-40722",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.4.0rc0,<2.4.2",
@@ -39007,9 +45835,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29560: An attacker can cause a heap buffer overflow in `tf.raw_ops.RaggedTensorToTensor`. This is because the implementation (https://github.com/tensorflow/tensorflow/blob/d94227d43aa125ad8b54115c03cece54f6a1977b/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L219-L222) uses the same index to access two arrays in parallel. Since the user controls the shape of the input arguments, an attacker could trigger a heap OOB access when `parent_output_index` is shorter than `row_split`.",
-            "cve": "CVE-2021-29560",
-            "id": "pyup.io-40717",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29563: An attacker can cause a denial of service by exploiting a `CHECK`-failure coming from the implementation of `tf.raw_ops.RFFT`. Eigen code operating on an empty matrix can trigger on an assertion and will cause program termination.",
+            "cve": "CVE-2021-29563",
+            "id": "pyup.io-40720",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.4.0rc0,<2.4.2",
@@ -39020,9 +45848,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29566: An attacker can write outside the bounds of heap allocated arrays by passing invalid arguments to 'tf.raw_ops.Dilation2DBackpropInput'. This is because the implementation (https://github.com/tensorflow/tensorflow/blob/afd954e65f15aea4d438d0a219136fc4a63a573d/tensorflow/core/kernels/dilation_ops.cc#L321-L322) does not validate before writing to the output array. The values for 'h_out' and 'w_out' are guaranteed to be in range for 'out_backprop' (as they are loop indices bounded by the size of the array). However, there are no similar guarantees relating 'h_in_max'/'w_in_max' and 'in_backprop'.",
-            "cve": "CVE-2021-29566",
-            "id": "pyup.io-40722",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2021-29560: An attacker can cause a heap buffer overflow in `tf.raw_ops.RaggedTensorToTensor`. This is because the implementation (https://github.com/tensorflow/tensorflow/blob/d94227d43aa125ad8b54115c03cece54f6a1977b/tensorflow/core/kernels/ragged_tensor_to_tensor_op.cc#L219-L222) uses the same index to access two arrays in parallel. Since the user controls the shape of the input arguments, an attacker could trigger a heap OOB access when `parent_output_index` is shorter than `row_split`.",
+            "cve": "CVE-2021-29560",
+            "id": "pyup.io-40717",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.4.0rc0,<2.4.2",
@@ -39449,9 +46277,9 @@
             "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
         {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 update 'curl' to '7.76.0' to handle CVE-2020-8177.",
-            "cve": "CVE-2020-8177",
-            "id": "pyup.io-40773",
+            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2020-8231: Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.",
+            "cve": "CVE-2020-8231",
+            "id": "pyup.io-40774",
             "specs": [
                 ">=2.5.0rc0,<2.5.0",
                 ">=2.4.0rc0,<2.4.2",
@@ -39474,19 +46302,6 @@
             ],
             "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
         },
-        {
-            "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 include a fix for CVE-2020-8231: Due to use of a dangling pointer, libcurl 7.29.0 through 7.71.1 can use the wrong connection when sending data.",
-            "cve": "CVE-2020-8231",
-            "id": "pyup.io-40774",
-            "specs": [
-                ">=2.5.0rc0,<2.5.0",
-                ">=2.4.0rc0,<2.4.2",
-                ">=2.3.0rc0,<2.3.3",
-                ">=2.2.0rc0,<2.2.3",
-                ">=2.1.0rc0,<2.1.4"
-            ],
-            "v": ">=2.5.0rc0,<2.5.0,>=2.4.0rc0,<2.4.2,>=2.3.0rc0,<2.3.3,>=2.2.0rc0,<2.2.3,>=2.1.0rc0,<2.1.4"
-        },
         {
             "advisory": "Tensorflow 2.1.4, 2.2.3, 2.3.3, 2.4.2, and 2.5.0 updates 'curl' to '7.76.0' to handle CVE-2020-8286: curl 7.41.0 through 7.73.0 is vulnerable to an improper check for certificate revocation due to insufficient verification of the OCSP response.",
             "cve": "CVE-2020-8286",
@@ -39746,9 +46561,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.3.0rc0,<2.3.4,>=2.4.0rc0,<2.4.3,>=2.5.0rc0,<2.5.1"
         },
         {
-            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37660: In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The implementation (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if 'x' and 'v' are empty but the code uses '||' instead of '&&'. The Tensorflow team has patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618.",
-            "cve": "CVE-2021-37660",
-            "id": "pyup.io-41135",
+            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37661: In affected versions an attacker can cause a denial of service in 'boosted_trees_create_quantile_stream_resource' by using negative arguments. The implementation (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantile_ops.cc#L96) does not validate that 'num_streams' only contains non-negative numbers. In turn, this results in using this value to allocate memory (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantiles/quantile_stream_resource.h#L31-L40). However, 'reserve' receives an unsigned integer so there is an implicit conversion from a negative value to a large positive unsigned. This results in a crash from the standard library. The Tensorflow team has patched the issue in GitHub commit 8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992.",
+            "cve": "CVE-2021-37661",
+            "id": "pyup.io-41136",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.3.0rc0,<2.3.4",
@@ -39758,9 +46573,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.3.0rc0,<2.3.4,>=2.4.0rc0,<2.4.3,>=2.5.0rc0,<2.5.1"
         },
         {
-            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37657: In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type 'tf.raw_ops.MatrixDiagV*'. The implementation (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of 'k' is a valid tensor. The Tensorflow team has checked that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong. The Tensorflow team has patched the issue in GitHub commit f2a673bd34f0d64b8e40a551ac78989d16daad09.",
-            "cve": "CVE-2021-37657",
-            "id": "pyup.io-41132",
+            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37660: In affected versions an attacker can cause a floating point exception by calling inplace operations with crafted arguments that would result in a division by 0. The implementation (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/inplace_ops.cc#L283) has a logic error: it should skip processing if 'x' and 'v' are empty but the code uses '||' instead of '&&'. The Tensorflow team has patched the issue in GitHub commit e86605c0a336c088b638da02135ea6f9f6753618.",
+            "cve": "CVE-2021-37660",
+            "id": "pyup.io-41135",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.3.0rc0,<2.3.4",
@@ -39770,9 +46585,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.3.0rc0,<2.3.4,>=2.4.0rc0,<2.4.3,>=2.5.0rc0,<2.5.1"
         },
         {
-            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37653: In affected versions an attacker can trigger a crash via a floating point exception in 'tf.raw_ops.ResourceGather'. The implementation (https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L725-L731) computes the value of a value, 'batch_size', and then divides by it without checking that this value is not 0. The Tensorflow team has patched the issue in GitHub commit ac117ee8a8ea57b73d34665cdf00ef3303bc0b11.",
-            "cve": "CVE-2021-37653",
-            "id": "pyup.io-41128",
+            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37657: In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in all operations of type 'tf.raw_ops.MatrixDiagV*'. The implementation (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/linalg/matrix_diag_op.cc) has incomplete validation that the value of 'k' is a valid tensor. The Tensorflow team has checked that this value is either a scalar or a vector, but there is no check for the number of elements. If this is an empty tensor, then code that accesses the first element of the tensor is wrong. The Tensorflow team has patched the issue in GitHub commit f2a673bd34f0d64b8e40a551ac78989d16daad09.",
+            "cve": "CVE-2021-37657",
+            "id": "pyup.io-41132",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.3.0rc0,<2.3.4",
@@ -39782,9 +46597,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.3.0rc0,<2.3.4,>=2.4.0rc0,<2.4.3,>=2.5.0rc0,<2.5.1"
         },
         {
-            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37661: In affected versions an attacker can cause a denial of service in 'boosted_trees_create_quantile_stream_resource' by using negative arguments. The implementation (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantile_ops.cc#L96) does not validate that 'num_streams' only contains non-negative numbers. In turn, this results in using this value to allocate memory (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/quantiles/quantile_stream_resource.h#L31-L40). However, 'reserve' receives an unsigned integer so there is an implicit conversion from a negative value to a large positive unsigned. This results in a crash from the standard library. The Tensorflow team has patched the issue in GitHub commit 8a84f7a2b5a2b27ecf88d25bad9ac777cd2f7992.",
-            "cve": "CVE-2021-37661",
-            "id": "pyup.io-41136",
+            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37653: In affected versions an attacker can trigger a crash via a floating point exception in 'tf.raw_ops.ResourceGather'. The implementation (https://github.com/tensorflow/tensorflow/blob/f24faa153ad31a4b51578f8181d3aaab77a1ddeb/tensorflow/core/kernels/resource_variable_ops.cc#L725-L731) computes the value of a value, 'batch_size', and then divides by it without checking that this value is not 0. The Tensorflow team has patched the issue in GitHub commit ac117ee8a8ea57b73d34665cdf00ef3303bc0b11.",
+            "cve": "CVE-2021-37653",
+            "id": "pyup.io-41128",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.3.0rc0,<2.3.4",
@@ -39866,9 +46681,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.3.0rc0,<2.3.4,>=2.5.0rc0,<2.5.1,>=2.4.0rc0,<2.4.3"
         },
         {
-            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37666: In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in 'tf.raw_ops.RaggedTensorToVariant'. The implementation (https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) has an incomplete validation of the splits values, missing the case when the argument would be empty. The Tensorflow team has patched the issue in GitHub commit be7a4de6adfbd303ce08be4332554dff70362612.",
-            "cve": "CVE-2021-37666",
-            "id": "pyup.io-41141",
+            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37662: In affected versions an attacker can generate undefined behavior via a reference binding to nullptr in 'BoostedTreesCalculateBestGainsPerFeature' and similar attack can occur in 'BoostedTreesCalculateBestFeatureSplitV2'. The implementation (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) does not validate the input values. The Tensorflow team has patched the issue in GitHub commit 9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad and in commit 429f009d2b2c09028647dd4bb7b3f6f414bbaad7.",
+            "cve": "CVE-2021-37662",
+            "id": "pyup.io-41137",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.3.0rc0,<2.3.4",
@@ -39878,9 +46693,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.3.0rc0,<2.3.4,>=2.5.0rc0,<2.5.1,>=2.4.0rc0,<2.4.3"
         },
         {
-            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37662: In affected versions an attacker can generate undefined behavior via a reference binding to nullptr in 'BoostedTreesCalculateBestGainsPerFeature' and similar attack can occur in 'BoostedTreesCalculateBestFeatureSplitV2'. The implementation (https://github.com/tensorflow/tensorflow/blob/84d053187cb80d975ef2b9684d4b61981bca0c41/tensorflow/core/kernels/boosted_trees/stats_ops.cc) does not validate the input values. The Tensorflow team has patched the issue in GitHub commit 9c87c32c710d0b5b53dc6fd3bfde4046e1f7a5ad and in commit 429f009d2b2c09028647dd4bb7b3f6f414bbaad7.",
-            "cve": "CVE-2021-37662",
-            "id": "pyup.io-41137",
+            "advisory": "TensorFlow 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37666: In affected versions an attacker can cause undefined behavior via binding a reference to null pointer in 'tf.raw_ops.RaggedTensorToVariant'. The implementation (https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_to_variant_op.cc#L129) has an incomplete validation of the splits values, missing the case when the argument would be empty. The Tensorflow team has patched the issue in GitHub commit be7a4de6adfbd303ce08be4332554dff70362612.",
+            "cve": "CVE-2021-37666",
+            "id": "pyup.io-41141",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.3.0rc0,<2.3.4",
@@ -40034,9 +46849,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.5.0rc0,<2.5.1,>=2.4.0rc0,<2.4.3,>=2.3.0rc0,<2.3.4"
         },
         {
-            "advisory": "Tensorflow version 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37673:\r\nIn affected versions, an attacker can trigger a denial of service via a \"CHECK\"-fail in \"tf.raw_ops.MapStage\". The implementation (https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/map_stage_op.cc#L513) does not check that the \"key\" input is a valid non-empty tensor. The Tensorflow team has patched the issue in GitHub commit d7de67733925de196ec8863a33445b73f9562d1d.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-278g-rq84-9hmg\r\nhttps://github.com/tensorflow/tensorflow/commit/d7de67733925de196ec8863a33445b73f9562d1d",
-            "cve": "CVE-2021-37673",
-            "id": "pyup.io-41148",
+            "advisory": "Tensorflow version 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37679:\r\nIn affected versions it is possible to nest a \"tf.map_fn\" within another \"tf.map_fn\" call. However, if the input tensor is a \"RaggedTensor\" and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap. The \"t\" and \"z\" outputs should be identical, however this is not the case. The last row of \"t\" contains data from the heap which can be used to leak other memory information. The bug lies in the conversion from a \"Variant\" tensor to a \"RaggedTensor\". The implementation (https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_from_variant_op.cc#L177-L190) does not check that all inner shapes match and this results in the additional dimensions. The same implementation can result in data loss, if input tensor is tweaked. The Tensorflow team has patched the issue in GitHub commit 4e2565483d0ffcadc719bd44893fb7f609bb5f12.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-g8wg-cjwc-xhhp\r\nhttps://github.com/tensorflow/tensorflow/commit/4e2565483d0ffcadc719bd44893fb7f609bb5f12",
+            "cve": "CVE-2021-37679",
+            "id": "pyup.io-41154",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.5.0rc0,<2.5.1",
@@ -40046,9 +46861,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.5.0rc0,<2.5.1,>=2.4.0rc0,<2.4.3,>=2.3.0rc0,<2.3.4"
         },
         {
-            "advisory": "Tensorflow version 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37674:\r\nIn affected versions, an attacker can trigger a denial of service via a segmentation fault in \"tf.raw_ops.MaxPoolGrad\" caused by missing validation. The implementation (https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/maxpooling_op.cc) misses some validation for the \"orig_input\" and \"orig_output\" tensors. The fixes for CVE-2021-29579 were incomplete. The Tensorflow team has patched the issue in GitHub commit 136b51f10903e044308cf77117c0ed9871350475.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-7ghq-fvr3-pj2x\r\nhttps://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-068.md\r\nhttps://github.com/tensorflow/tensorflow/commit/136b51f10903e044308cf77117c0ed9871350475",
-            "cve": "CVE-2021-37674",
-            "id": "pyup.io-41149",
+            "advisory": "Tensorflow version 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37673:\r\nIn affected versions, an attacker can trigger a denial of service via a \"CHECK\"-fail in \"tf.raw_ops.MapStage\". The implementation (https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/map_stage_op.cc#L513) does not check that the \"key\" input is a valid non-empty tensor. The Tensorflow team has patched the issue in GitHub commit d7de67733925de196ec8863a33445b73f9562d1d.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-278g-rq84-9hmg\r\nhttps://github.com/tensorflow/tensorflow/commit/d7de67733925de196ec8863a33445b73f9562d1d",
+            "cve": "CVE-2021-37673",
+            "id": "pyup.io-41148",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.5.0rc0,<2.5.1",
@@ -40058,9 +46873,9 @@
             "v": ">=2.6.0rc0,<2.6.0,>=2.5.0rc0,<2.5.1,>=2.4.0rc0,<2.4.3,>=2.3.0rc0,<2.3.4"
         },
         {
-            "advisory": "Tensorflow version 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37679:\r\nIn affected versions it is possible to nest a \"tf.map_fn\" within another \"tf.map_fn\" call. However, if the input tensor is a \"RaggedTensor\" and there is no function signature provided, code assumes the output is a fully specified tensor and fills output buffer with uninitialized contents from the heap. The \"t\" and \"z\" outputs should be identical, however this is not the case. The last row of \"t\" contains data from the heap which can be used to leak other memory information. The bug lies in the conversion from a \"Variant\" tensor to a \"RaggedTensor\". The implementation (https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/ragged_tensor_from_variant_op.cc#L177-L190) does not check that all inner shapes match and this results in the additional dimensions. The same implementation can result in data loss, if input tensor is tweaked. The Tensorflow team has patched the issue in GitHub commit 4e2565483d0ffcadc719bd44893fb7f609bb5f12.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-g8wg-cjwc-xhhp\r\nhttps://github.com/tensorflow/tensorflow/commit/4e2565483d0ffcadc719bd44893fb7f609bb5f12",
-            "cve": "CVE-2021-37679",
-            "id": "pyup.io-41154",
+            "advisory": "Tensorflow version 2.3.4, 2.4.3, 2.5.1 and 2.6.0 include a fix for CVE-2021-37674:\r\nIn affected versions, an attacker can trigger a denial of service via a segmentation fault in \"tf.raw_ops.MaxPoolGrad\" caused by missing validation. The implementation (https://github.com/tensorflow/tensorflow/blob/460e000de3a83278fb00b61a16d161b1964f15f4/tensorflow/core/kernels/maxpooling_op.cc) misses some validation for the \"orig_input\" and \"orig_output\" tensors. The fixes for CVE-2021-29579 were incomplete. The Tensorflow team has patched the issue in GitHub commit 136b51f10903e044308cf77117c0ed9871350475.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-7ghq-fvr3-pj2x\r\nhttps://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-068.md\r\nhttps://github.com/tensorflow/tensorflow/commit/136b51f10903e044308cf77117c0ed9871350475",
+            "cve": "CVE-2021-37674",
+            "id": "pyup.io-41149",
             "specs": [
                 ">=2.6.0rc0,<2.6.0",
                 ">=2.5.0rc0,<2.5.1",
@@ -40142,36 +46957,36 @@
             "v": "<1.12.3"
         },
         {
-            "advisory": "Tensorflow-directml 1.12.3 updates 'png_archive' dependency to 1.6.37 to not be affected by CVE-2018-13785.",
-            "cve": "CVE-2018-13785",
-            "id": "pyup.io-39567",
+            "advisory": "Tensorflow-directml 1.12.3 updates 'sqlite' dependency to 3.28.0 to not be affected by CVE-2018-20346: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.",
+            "cve": "CVE-2018-20346",
+            "id": "pyup.io-39564",
             "specs": [
                 "<1.12.3"
             ],
             "v": "<1.12.3"
         },
         {
-            "advisory": "Tensorflow-directml 1.12.3 updates 'png_archive' dependency to 1.6.37 to not be affected by CVE-2018-14048.",
-            "cve": "CVE-2018-14048",
-            "id": "pyup.io-39566",
+            "advisory": "Tensorflow-directml 1.12.3 updates 'sqlite' dependency to 3.28.0 to not be affected by CVE-2018-20506: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.",
+            "cve": "CVE-2018-20506",
+            "id": "pyup.io-39565",
             "specs": [
                 "<1.12.3"
             ],
             "v": "<1.12.3"
         },
         {
-            "advisory": "Tensorflow-directml 1.12.3 updates 'sqlite' dependency to 3.28.0 to not be affected by CVE-2018-20346: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.",
-            "cve": "CVE-2018-20346",
-            "id": "pyup.io-39564",
+            "advisory": "Tensorflow-directml 1.12.3 updates 'png_archive' dependency to 1.6.37 to not be affected by CVE-2018-14048.",
+            "cve": "CVE-2018-14048",
+            "id": "pyup.io-39566",
             "specs": [
                 "<1.12.3"
             ],
             "v": "<1.12.3"
         },
         {
-            "advisory": "Tensorflow-directml 1.12.3 updates 'sqlite' dependency to 3.28.0 to not be affected by CVE-2018-20506: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a \"merge\" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.",
-            "cve": "CVE-2018-20506",
-            "id": "pyup.io-39565",
+            "advisory": "Tensorflow-directml 1.12.3 updates 'png_archive' dependency to 1.6.37 to not be affected by CVE-2018-13785.",
+            "cve": "CVE-2018-13785",
+            "id": "pyup.io-39567",
             "specs": [
                 "<1.12.3"
             ],
@@ -40213,15 +47028,6 @@
             ],
             "v": "<1.15.2"
         },
-        {
-            "advisory": "Tensorflow-directml 1.15.2 updates 'sqlite' dependency to 3.30.01 to not be affected by CVE-2019-16168: In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"",
-            "cve": "CVE-2019-16168",
-            "id": "pyup.io-39558",
-            "specs": [
-                "<1.15.2"
-            ],
-            "v": "<1.15.2"
-        },
         {
             "advisory": "Tensorflow-directml 1.15.2 updates its dependency \"curl\" to handle CVE-2019-5482.",
             "cve": "CVE-2019-5482",
@@ -40232,22 +47038,13 @@
             "v": "<1.15.2"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.3 updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770.",
-            "cve": "CVE-2018-11770",
-            "id": "pyup.io-39833",
-            "specs": [
-                "<1.15.3"
-            ],
-            "v": "<1.15.3"
-        },
-        {
-            "advisory": "Tensorflow-directml 1.15.3 updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960.",
-            "cve": "CVE-2018-20330",
-            "id": "pyup.io-39831",
+            "advisory": "Tensorflow-directml 1.15.2 updates 'sqlite' dependency to 3.30.01 to not be affected by CVE-2019-16168: In SQLite through 3.29.0, whereLoopAddBtreeIndex in sqlite3.c can crash a browser or other application because of missing validation of a sqlite_stat1 sz field, aka a \"severe division by zero in the query planner.\"",
+            "cve": "CVE-2019-16168",
+            "id": "pyup.io-39558",
             "specs": [
-                "<1.15.3"
+                "<1.15.2"
             ],
-            "v": "<1.15.3"
+            "v": "<1.15.2"
         },
         {
             "advisory": "Tensorflow-directml 1.15.3 includes a fix for CVE-2019-10099: Prior to Spark 2.3.3, in certain situations Spark would write user data to local disk unencrypted, even if spark.io.encryption.enabled=true. This includes cached blocks that are fetched to disk (controlled by spark.maxRemoteBlockSizeFetchToMem); in SparkR, using parallelize; in Pyspark, using broadcast and parallelize; and use of python udfs.",
@@ -40303,6 +47100,15 @@
             ],
             "v": "<1.15.3"
         },
+        {
+            "advisory": "Tensorflow-directml 1.15.3 updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960.",
+            "cve": "CVE-2018-20330",
+            "id": "pyup.io-39831",
+            "specs": [
+                "<1.15.3"
+            ],
+            "v": "<1.15.3"
+        },
         {
             "advisory": "Tensorflow-directml 1.15.3 updates libjpeg-turbo to 2.0.4 to handle CVE-2018-19664, CVE-2018-20330 and CVE-2019-13960.",
             "cve": "CVE-2018-19664",
@@ -40312,6 +47118,15 @@
             ],
             "v": "<1.15.3"
         },
+        {
+            "advisory": "Tensorflow-directml 1.15.3 updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770.",
+            "cve": "CVE-2018-11770",
+            "id": "pyup.io-39833",
+            "specs": [
+                "<1.15.3"
+            ],
+            "v": "<1.15.3"
+        },
         {
             "advisory": "Tensorflow-directml 1.15.3 updates Apache Spark to 2.4.5 to handle CVE-2019-10099, CVE-2018-17190 and CVE-2018-11770.",
             "cve": "CVE-2018-17190",
@@ -40357,6 +47172,159 @@
             ],
             "v": "<1.15.4"
         },
+        {
+            "advisory": "Tensorflow-directml version 1.15.4 includes a fix for CVE-2020-15209: In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a \"nullptr\" buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with \"nullptr\". However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc.",
+            "cve": "CVE-2020-15209",
+            "id": "pyup.io-40358",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml version 1.15.4 includes a fix for CVE-2020-15208: In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a \"DCHECK\" which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d.",
+            "cve": "CVE-2020-15208",
+            "id": "pyup.io-40357",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml version 1.15.4 includes a fix for CVE-2020-15204: In eager mode, tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling \"tf.raw_ops.GetSessionHandle\" or \"tf.raw_ops.GetSessionHandleV2\" results in a null pointer dereference In linked snippet, in eager mode, \"ctx->session_state()\" returns \"nullptr\". Since code immediately dereferences this, we get a segmentation fault. The issue is patched in commit 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1",
+            "cve": "CVE-2020-15204",
+            "id": "pyup.io-40353",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15202: In Tensorflow before version 1.15.4, the 'Shard' API in TensorFlow expects the last argument to be a function taking two 'int64' (i.e., 'long long') arguments. However, there are several places in TensorFlow where a lambda taking 'int' or 'int32' arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6fg-mjxg-hqq4",
+            "cve": "CVE-2020-15202",
+            "id": "pyup.io-40351",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15194: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments. Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in `vec`, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.\"",
+            "cve": "CVE-2020-15194",
+            "id": "pyup.io-40349",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.",
+            "cve": "CVE-2020-11655",
+            "id": "pyup.io-40362",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-9327: In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.",
+            "cve": "CVE-2020-9327",
+            "id": "pyup.io-40361",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.",
+            "cve": "CVE-2020-13631",
+            "id": "pyup.io-40367",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.",
+            "cve": "CVE-2020-13435",
+            "id": "pyup.io-40365",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.",
+            "cve": "CVE-2020-13434",
+            "id": "pyup.io-40364",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-13871: SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.",
+            "cve": "CVE-2020-13871",
+            "id": "pyup.io-40368",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15203: In Tensorflow before version 1.15.4, by controlling the 'fill' argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a 'printf' call is constructed. This may result in segmentation fault.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-xmq7-7fxm-rr79",
+            "cve": "CVE-2020-15203",
+            "id": "pyup.io-40352",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15205: In Tensorflow before versions 1.15.4, the 'data_splits' argument of 'tf.raw_ops.StringNGrams' lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after 'ee ff' are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-g7p5-5759-qv46",
+            "cve": "CVE-2020-15205",
+            "id": "pyup.io-40354",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15210: In tensorflow-lite before versions 1.15.4, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, it leads to segmentation fault or just memory corruption.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-x9j7-x98r-r4w2",
+            "cve": "CVE-2020-15210",
+            "id": "pyup.io-40359",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15207: In tensorflow-lite before versions 1.15.4, to mimic Python's indexing with negative values, TFLite uses 'ResolveAxis' to convert negative values to positive indices. However, the only check that the converted index is now valid is only present in debug builds. If the 'DCHECK' does not trigger, then code execution moves ahead with a negative index. This, in turn, results in accessing data out of bounds which results in segfaults and/or data corruption.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-q4qf-3fc6-8x34",
+            "cve": "CVE-2020-15207",
+            "id": "pyup.io-40356",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15190: In Tensorflow before version 1.15.4 the \"tf.raw_ops.Switch\" operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is \"nullptr\", hence we are binding a reference to \"nullptr\". This is undefined behavior and reported as an error if compiling with \"-fsanitize=null\". In this case, this results in a segmentation fault. The issue was patched in commit da8558533d925694483d2c136a9220d6d49d843c.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-4g9f-63rx-5cw4",
+            "cve": "CVE-2020-15190",
+            "id": "pyup.io-39317",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.4 updates 'sqlite3' to '3.33.00' to handle several CVEs. One of them is CVE-2020-13630.",
+            "cve": "CVE-2020-13630",
+            "id": "pyup.io-40366",
+            "specs": [
+                "<1.15.4"
+            ],
+            "v": "<1.15.4"
+        },
         {
             "advisory": "Tensorflow-directml 1.15.4 updates its dependency \"SQlite\" to 3.32.3 to fix CVE-2020-15358.",
             "cve": "CVE-2020-15358",
@@ -40367,245 +47335,425 @@
             "v": "<1.15.4"
         },
         {
-            "advisory": "Tensorflow-directml version 1.15.4 includes a fix for CVE-2020-15209: In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, a crafted TFLite model can force a node to have as input a tensor backed by a \"nullptr\" buffer. This can be achieved by changing a buffer index in the flatbuffer serialization to convert a read-only tensor to a read-write one. The runtime assumes that these buffers are written to before a possible read, hence they are initialized with \"nullptr\". However, by changing the buffer index for a tensor and implicitly converting that tensor to be a read-write one, as there is nothing in the model that writes to it, we get a null pointer dereference. The issue is patched in commit 0b5662bc.",
-            "cve": "CVE-2020-15209",
-            "id": "pyup.io-40358",
+            "advisory": "Tensorflow-directml 1.15.5 includes a fix for CVE-2020-26267: In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.",
+            "cve": "CVE-2020-26267",
+            "id": "pyup.io-40333",
             "specs": [
-                "<1.15.4"
+                "<1.15.5"
             ],
-            "v": "<1.15.4"
+            "v": "<1.15.5"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.5 fixes an access to unitialized memory in the 'Eigen' code (CVE-2020-26266).",
+            "cve": "CVE-2020-26266",
+            "id": "pyup.io-40322",
+            "specs": [
+                "<1.15.5"
+            ],
+            "v": "<1.15.5"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.5 fixes a vulnerability caused by attempting to write to immutable memory region in 'tf.raw_ops.ImmutableConst' (CVE-2020-26268).",
+            "cve": "CVE-2020-26268",
+            "id": "pyup.io-40334",
+            "specs": [
+                "<1.15.5"
+            ],
+            "v": "<1.15.5"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.5 fixes a security vulnerability caused by accessing heap data outside of bounds when loading a specially crafted 'SavedModel' (CVE-2020-26271).",
+            "cve": "CVE-2020-26271",
+            "id": "pyup.io-40336",
+            "specs": [
+                "<1.15.5"
+            ],
+            "v": "<1.15.5"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.5 fixes a 'CHECK'-fail in LSTM with zero-length input (CVE-2020-26270).",
+            "cve": "CVE-2020-26270",
+            "id": "pyup.io-40335",
+            "specs": [
+                "<1.15.5"
+            ],
+            "v": "<1.15.5"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.5 updates the 'libjpeg-turbo' dependency to 2.0.5 to handle a security vulnerability (CVE-2020-13790).",
+            "cve": "CVE-2020-13790",
+            "id": "pyup.io-40337",
+            "specs": [
+                "<1.15.5"
+            ],
+            "v": "<1.15.5"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.5 updates its dependency 'Junit4' to v4.13.1 to include a security fix.",
+            "cve": "CVE-2020-15250",
+            "id": "pyup.io-40338",
+            "specs": [
+                "<1.15.5"
+            ],
+            "v": "<1.15.5"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.5 updates its dependency \"PCRE\" to version 8.44 to fix CVE-2019-20838.",
+            "cve": "CVE-2019-20838",
+            "id": "pyup.io-40339",
+            "specs": [
+                "<1.15.5"
+            ],
+            "v": "<1.15.5"
+        },
+        {
+            "advisory": "Tensorflow-directml 1.15.5 updates its dependency \"PCRE\" to version 8.44 to fix CVE-2020-14155.",
+            "cve": "CVE-2020-14155",
+            "id": "pyup.io-40340",
+            "specs": [
+                "<1.15.5"
+            ],
+            "v": "<1.15.5"
+        }
+    ],
+    "tensorpy": [
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-19646",
+            "id": "pyup.io-38821",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-5481",
+            "id": "pyup.io-44384",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-16168",
+            "id": "pyup.io-44385",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-5215",
+            "id": "pyup.io-44386",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-5482",
+            "id": "pyup.io-44387",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-16778",
+            "id": "pyup.io-44388",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "PVE-2021-37524",
+            "id": "pyup.io-44389",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-15601",
+            "id": "pyup.io-44390",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2018-19664",
+            "id": "pyup.io-44391",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2018-17190",
+            "id": "pyup.io-44392",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-19645",
+            "id": "pyup.io-44393",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
+        },
+        {
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-19244",
+            "id": "pyup.io-44394",
+            "specs": [
+                "<1.5.0"
+            ],
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml version 1.15.4 includes a fix for CVE-2020-15208: In tensorflow-lite before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, when determining the common dimension size of two tensors, TFLite uses a \"DCHECK\" which is no-op outside of debug compilation modes. Since the function always returns the dimension of the first tensor, malicious attackers can craft cases where this is larger than that of the second tensor. In turn, this would result in reads/writes outside of bounds since the interpreter will wrongly assume that there is enough data in both tensors. The issue is patched in commit 8ee24e7949a203d234489f9da2c5bf45a7d5157d.",
-            "cve": "CVE-2020-15208",
-            "id": "pyup.io-40357",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-19880",
+            "id": "pyup.io-44395",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml version 1.15.4 includes a fix for CVE-2020-15204: In eager mode, tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1 does not set the session state. Hence, calling \"tf.raw_ops.GetSessionHandle\" or \"tf.raw_ops.GetSessionHandleV2\" results in a null pointer dereference In linked snippet, in eager mode, \"ctx->session_state()\" returns \"nullptr\". Since code immediately dereferences this, we get a segmentation fault. The issue is patched in commit 9a133d73ae4b4664d22bd1aa6d654fec13c52ee1",
-            "cve": "CVE-2020-15204",
-            "id": "pyup.io-40353",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2018-20330",
+            "id": "pyup.io-44396",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15202: In Tensorflow before version 1.15.4, the 'Shard' API in TensorFlow expects the last argument to be a function taking two 'int64' (i.e., 'long long') arguments. However, there are several places in TensorFlow where a lambda taking 'int' or 'int32' arguments is being used. In these cases, if the amount of work to be parallelized is large enough, integer truncation occurs. Depending on how the two arguments of the lambda are used, this can result in segfaults, read/write outside of heap allocated arrays, stack overflows, or data corruption.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-h6fg-mjxg-hqq4",
-            "cve": "CVE-2020-15202",
-            "id": "pyup.io-40351",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-10099",
+            "id": "pyup.io-44397",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15194: In Tensorflow before versions 1.15.4, 2.0.3, 2.1.2, 2.2.1 and 2.3.1, the `SparseFillEmptyRowsGrad` implementation has incomplete validation of the shapes of its arguments. Although `reverse_index_map_t` and `grad_values_t` are accessed in a similar pattern, only `reverse_index_map_t` is validated to be of proper shape. Hence, malicious users can pass a bad `grad_values_t` to trigger an assertion failure in `vec`, causing denial of service in serving installations. The issue is patched in commit 390611e0d45c5793c7066110af37c8514e6a6c54, and is released in TensorFlow versions 1.15.4, 2.0.3, 2.1.2, 2.2.1, or 2.3.1.\"",
-            "cve": "CVE-2020-15194",
-            "id": "pyup.io-40349",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2018-11770",
+            "id": "pyup.io-44398",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 updates 'sqlite3' to '3.33.00' to handle several CVEs. One of them is CVE-2020-13630.",
-            "cve": "CVE-2020-13630",
-            "id": "pyup.io-40366",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2019-13960",
+            "id": "pyup.io-44399",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-11655: SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.",
-            "cve": "CVE-2020-11655",
-            "id": "pyup.io-40362",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15211",
+            "id": "pyup.io-44400",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-9327: In SQLite 3.31.1, isAuxiliaryVtabOperator allows attackers to trigger a NULL pointer dereference and segmentation fault because of generated column optimizations.",
-            "cve": "CVE-2020-9327",
-            "id": "pyup.io-40361",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13630",
+            "id": "pyup.io-44401",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-13631: SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.",
-            "cve": "CVE-2020-13631",
-            "id": "pyup.io-40367",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15194",
+            "id": "pyup.io-44402",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-13435: SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.",
-            "cve": "CVE-2020-13435",
-            "id": "pyup.io-40365",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15204",
+            "id": "pyup.io-44403",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-13871: SQLite 3.32.2 has a use-after-free in resetAccumulator in select.c because the parse tree rewrite for window functions is too late.",
-            "cve": "CVE-2020-13871",
-            "id": "pyup.io-40368",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15205",
+            "id": "pyup.io-44404",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-13434: SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.",
-            "cve": "CVE-2020-13434",
-            "id": "pyup.io-40364",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15202",
+            "id": "pyup.io-44405",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15203: In Tensorflow before version 1.15.4, by controlling the 'fill' argument of tf.strings.as_string, a malicious attacker is able to trigger a format string vulnerability due to the way the internal format use in a 'printf' call is constructed. This may result in segmentation fault.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-xmq7-7fxm-rr79",
-            "cve": "CVE-2020-15203",
-            "id": "pyup.io-40352",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15206",
+            "id": "pyup.io-44406",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15205: In Tensorflow before versions 1.15.4, the 'data_splits' argument of 'tf.raw_ops.StringNGrams' lacks validation. This allows a user to pass values that can cause heap overflow errors and even leak contents of memory In the linked code snippet, all the binary strings after 'ee ff' are contents from the memory stack. Since these can contain return addresses, this data leak can be used to defeat ASLR.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-g7p5-5759-qv46",
-            "cve": "CVE-2020-15205",
-            "id": "pyup.io-40354",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15208",
+            "id": "pyup.io-44407",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15210: In tensorflow-lite before versions 1.15.4, if a TFLite saved model uses the same tensor as both input and output of an operator, then, depending on the operator, it leads to segmentation fault or just memory corruption.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-x9j7-x98r-r4w2",
-            "cve": "CVE-2020-15210",
-            "id": "pyup.io-40359",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-11656",
+            "id": "pyup.io-44408",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15207: In tensorflow-lite before versions 1.15.4, to mimic Python's indexing with negative values, TFLite uses 'ResolveAxis' to convert negative values to positive indices. However, the only check that the converted index is now valid is only present in debug builds. If the 'DCHECK' does not trigger, then code execution moves ahead with a negative index. This, in turn, results in accessing data out of bounds which results in segfaults and/or data corruption.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-q4qf-3fc6-8x34",
-            "cve": "CVE-2020-15207",
-            "id": "pyup.io-40356",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-11655",
+            "id": "pyup.io-44409",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.4 includes a fix for CVE-2020-15190: In Tensorflow before version 1.15.4 the \"tf.raw_ops.Switch\" operation takes as input a tensor and a boolean and outputs two tensors. Depending on the boolean value, one of the tensors is exactly the input tensor whereas the other one should be an empty tensor. However, the eager runtime traverses all tensors in the output. Since only one of the tensors is defined, the other one is \"nullptr\", hence we are binding a reference to \"nullptr\". This is undefined behavior and reported as an error if compiling with \"-fsanitize=null\". In this case, this results in a segmentation fault. The issue was patched in commit da8558533d925694483d2c136a9220d6d49d843c.\r\nhttps://github.com/tensorflow/tensorflow/security/advisories/GHSA-4g9f-63rx-5cw4",
-            "cve": "CVE-2020-15190",
-            "id": "pyup.io-39317",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13434",
+            "id": "pyup.io-44410",
             "specs": [
-                "<1.15.4"
+                "<1.5.0"
             ],
-            "v": "<1.15.4"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 includes a fix for CVE-2020-26267: In affected versions of TensorFlow the tf.raw_ops.DataFormatVecPermute API does not validate the src_format and dst_format attributes. The code assumes that these two arguments define a permutation of NHWC. This can result in uninitialized memory accesses, read outside of bounds and even crashes. This is fixed in versions 1.15.5, 2.0.4, 2.1.3, 2.2.2, 2.3.2, and 2.4.0.",
-            "cve": "CVE-2020-26267",
-            "id": "pyup.io-40333",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13435",
+            "id": "pyup.io-44411",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 updates its dependency \"PCRE\" to version 8.44 to fix CVE-2020-14155.",
-            "cve": "CVE-2020-14155",
-            "id": "pyup.io-40340",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13871",
+            "id": "pyup.io-44412",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 fixes a vulnerability caused by attempting to write to immutable memory region in 'tf.raw_ops.ImmutableConst' (CVE-2020-26268).",
-            "cve": "CVE-2020-26268",
-            "id": "pyup.io-40334",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-13631",
+            "id": "pyup.io-44413",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 fixes a 'CHECK'-fail in LSTM with zero-length input (CVE-2020-26270).",
-            "cve": "CVE-2020-26270",
-            "id": "pyup.io-40335",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15209",
+            "id": "pyup.io-44414",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 fixes a security vulnerability caused by accessing heap data outside of bounds when loading a specially crafted 'SavedModel' (CVE-2020-26271).",
-            "cve": "CVE-2020-26271",
-            "id": "pyup.io-40336",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-9327",
+            "id": "pyup.io-44415",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 updates the 'libjpeg-turbo' dependency to 2.0.5 to handle a security vulnerability (CVE-2020-13790).",
-            "cve": "CVE-2020-13790",
-            "id": "pyup.io-40337",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15195",
+            "id": "pyup.io-44416",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 updates its dependency \"PCRE\" to version 8.44 to fix CVE-2019-20838.",
-            "cve": "CVE-2019-20838",
-            "id": "pyup.io-40339",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15207",
+            "id": "pyup.io-44417",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 fixes an access to unitialized memory in the 'Eigen' code (CVE-2020-26266).",
-            "cve": "CVE-2020-26266",
-            "id": "pyup.io-40322",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15190",
+            "id": "pyup.io-44418",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
+            "v": "<1.5.0"
         },
         {
-            "advisory": "Tensorflow-directml 1.15.5 updates its dependency 'Junit4' to v4.13.1 to include a security fix.",
-            "cve": "CVE-2020-15250",
-            "id": "pyup.io-40338",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15203",
+            "id": "pyup.io-44419",
             "specs": [
-                "<1.15.5"
+                "<1.5.0"
             ],
-            "v": "<1.15.5"
-        }
-    ],
-    "tensorpy": [
+            "v": "<1.5.0"
+        },
         {
-            "advisory": "Tensorpy 1.5.0 bumps tensorflow to 1.15.4. Tensorflow versions before 1.15.4 are known to be affected by several CVEs.",
-            "cve": "PVE-2021-38821",
-            "id": "pyup.io-38821",
+            "advisory": "Tensorpy 1.5.0 updates Tensorflow to v1.15.4 to include security fixes.",
+            "cve": "CVE-2020-15210",
+            "id": "pyup.io-44420",
             "specs": [
                 "<1.5.0"
             ],
@@ -40634,7 +47782,7 @@
     ],
     "tern": [
         {
-            "advisory": "The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.",
+            "advisory": "Tern 2.5.0 updates its dependency 'urllib3' to v1.26.4 due to security issues.",
             "cve": "CVE-2021-28363",
             "id": "pyup.io-40054",
             "specs": [
@@ -40653,15 +47801,6 @@
             ],
             "v": "<0.3.4"
         },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-22901",
-            "id": "pyup.io-42623",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
         {
             "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
             "cve": "CVE-2021-37636",
@@ -40671,33 +47810,6 @@
             ],
             "v": "<0.3.4"
         },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37637",
-            "id": "pyup.io-42564",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37638",
-            "id": "pyup.io-42565",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37639",
-            "id": "pyup.io-42566",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
         {
             "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
             "cve": "CVE-2021-37640",
@@ -40923,6 +48035,276 @@
             ],
             "v": "<0.3.4"
         },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37637",
+            "id": "pyup.io-42564",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37638",
+            "id": "pyup.io-42565",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37639",
+            "id": "pyup.io-42566",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37668",
+            "id": "pyup.io-42595",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37669",
+            "id": "pyup.io-42596",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37670",
+            "id": "pyup.io-42597",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37671",
+            "id": "pyup.io-42598",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37672",
+            "id": "pyup.io-42599",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37673",
+            "id": "pyup.io-42600",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37674",
+            "id": "pyup.io-42601",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37675",
+            "id": "pyup.io-42602",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37676",
+            "id": "pyup.io-42603",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37677",
+            "id": "pyup.io-42604",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37678",
+            "id": "pyup.io-42605",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37679",
+            "id": "pyup.io-42606",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37680",
+            "id": "pyup.io-42607",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37681",
+            "id": "pyup.io-42608",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37682",
+            "id": "pyup.io-42609",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37683",
+            "id": "pyup.io-42610",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37684",
+            "id": "pyup.io-42611",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37685",
+            "id": "pyup.io-42612",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37686",
+            "id": "pyup.io-42613",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37687",
+            "id": "pyup.io-42614",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37688",
+            "id": "pyup.io-42615",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37689",
+            "id": "pyup.io-42616",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37690",
+            "id": "pyup.io-42617",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37691",
+            "id": "pyup.io-42618",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-37692",
+            "id": "pyup.io-42619",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-22876",
+            "id": "pyup.io-42620",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
+        {
+            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
+            "cve": "CVE-2021-22897",
+            "id": "pyup.io-42621",
+            "specs": [
+                "<0.3.4"
+            ],
+            "v": "<0.3.4"
+        },
         {
             "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
             "cve": "CVE-2021-37665",
@@ -40952,242 +48334,8 @@
         },
         {
             "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37668",
-            "id": "pyup.io-42595",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37669",
-            "id": "pyup.io-42596",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37670",
-            "id": "pyup.io-42597",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37671",
-            "id": "pyup.io-42598",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37672",
-            "id": "pyup.io-42599",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37673",
-            "id": "pyup.io-42600",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37674",
-            "id": "pyup.io-42601",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37675",
-            "id": "pyup.io-42602",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37676",
-            "id": "pyup.io-42603",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37677",
-            "id": "pyup.io-42604",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37678",
-            "id": "pyup.io-42605",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37679",
-            "id": "pyup.io-42606",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37680",
-            "id": "pyup.io-42607",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37681",
-            "id": "pyup.io-42608",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37682",
-            "id": "pyup.io-42609",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37683",
-            "id": "pyup.io-42610",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37684",
-            "id": "pyup.io-42611",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37685",
-            "id": "pyup.io-42612",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37686",
-            "id": "pyup.io-42613",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37687",
-            "id": "pyup.io-42614",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37688",
-            "id": "pyup.io-42615",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37689",
-            "id": "pyup.io-42616",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37690",
-            "id": "pyup.io-42617",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37691",
-            "id": "pyup.io-42618",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-37692",
-            "id": "pyup.io-42619",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-22876",
-            "id": "pyup.io-42620",
-            "specs": [
-                "<0.3.4"
-            ],
-            "v": "<0.3.4"
-        },
-        {
-            "advisory": "Textattack 0.3.4 updates its dependency 'tensorflow' to v2.5.1 to include several security fixes.",
-            "cve": "CVE-2021-22897",
-            "id": "pyup.io-42621",
+            "cve": "CVE-2021-22901",
+            "id": "pyup.io-42623",
             "specs": [
                 "<0.3.4"
             ],
@@ -41254,6 +48402,17 @@
             "v": "<2.5.0"
         }
     ],
+    "tf-restore-helper": [
+        {
+            "advisory": "Tf-restore-helper 0.1.1 updates its dependency 'Werkzeug' to v2.0.2 to include a security fix.",
+            "cve": "PVE-2021-42050",
+            "id": "pyup.io-44589",
+            "specs": [
+                "<0.1.1"
+            ],
+            "v": "<0.1.1"
+        }
+    ],
     "tftpy": [
         {
             "advisory": "Tftpy 0.4.6 adds some security checks around the 'tftproot'.",
@@ -41289,7 +48448,7 @@
     ],
     "thefuck": [
         {
-            "advisory": "The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the \"undo archive operation\" feature.",
+            "advisory": "The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the \"undo archive operation\" feature.\r\nhttps://github.com/nvbn/thefuck/commit/e343c577cd7da4d304b837d4a07ab4df1e023092",
             "cve": "CVE-2021-34363",
             "id": "pyup.io-40651",
             "specs": [
@@ -41320,6 +48479,17 @@
             "v": "<1.1.0"
         }
     ],
+    "threedi-modelchecker": [
+        {
+            "advisory": "Threedi-modelchecker 0.23 adds integrity and other additional checks on connection for untrusted sqlite input.\r\nhttps://github.com/nens/threedi-modelchecker/commit/c90ae2c53fa8c26efb5256f66631a0de2ffb6c83",
+            "cve": "PVE-2022-44498",
+            "id": "pyup.io-44498",
+            "specs": [
+                "<0.23"
+            ],
+            "v": "<0.23"
+        }
+    ],
     "thrift": [
         {
             "advisory": "Thrift version 0.10.0 (Python bindings) includes fixes related to certs' hostname verification and Python TSocket resource leaks.\r\nhttps://issues.apache.org/jira/browse/THRIFT-3599\r\nhttps://issues.apache.org/jira/browse/THRIFT-3634",
@@ -41534,7 +48704,7 @@
     ],
     "torchserve": [
         {
-            "advisory": "Torchserve 0.5.1 updates its dependency 'log4j2' to v2.16.0 to fix critical vulnerabilities.",
+            "advisory": "Torchserve 0.5.1 updates its dependency 'log4j' to v2.16.0 to include a fix for a critical vulnerability.",
             "cve": "CVE-2021-44228",
             "id": "pyup.io-43736",
             "specs": [
@@ -41559,6 +48729,15 @@
                 "<0.5.2"
             ],
             "v": "<0.5.2"
+        },
+        {
+            "advisory": "Torchserve 0.5.2 includes a version of'log4j2' affected by a medium severity vulnerability.",
+            "cve": "CVE-2021-44832",
+            "id": "pyup.io-44463",
+            "specs": [
+                "<=0.5.2"
+            ],
+            "v": "<=0.5.2"
         }
     ],
     "tornado": [
@@ -41928,8 +49107,8 @@
             "v": "<3.12.3"
         },
         {
-            "advisory": "Tutor 3.3.5 updates the 'Jinja2' underlying dependency to fix a security vulnerability.",
-            "cve": "PVE-2021-40925",
+            "advisory": "Tutor 3.3.5 updates the 'Jinja2' underlying dependency to v2.10.1 to fix a security vulnerability.",
+            "cve": "CVE-2019-10906",
             "id": "pyup.io-40925",
             "specs": [
                 "<3.3.5"
@@ -42095,8 +49274,8 @@
     ],
     "twodolib": [
         {
-            "advisory": "Twodolib 0.5.1 updated its requirements for security reasons.",
-            "cve": "PVE-2021-37306",
+            "advisory": "Twodolib 0.5.1 updates its dependency 'requests' to v2.20.1 to include a security fix.",
+            "cve": "CVE-2018-18074",
             "id": "pyup.io-37306",
             "specs": [
                 "<0.5.1"
@@ -42159,17 +49338,6 @@
             "v": "<0.13.0"
         }
     ],
-    "uciparse": [
-        {
-            "advisory": "Uciparse 0.1.9 updates build process to include security scans using Safety.",
-            "cve": "PVE-2021-39605",
-            "id": "pyup.io-39605",
-            "specs": [
-                "<0.1.9"
-            ],
-            "v": "<0.1.9"
-        }
-    ],
     "udata": [
         {
             "advisory": "Udata 1.6.16 prevents Google ranking spam attacks on reuse pages (`rel=nofollow` on reuse link) - see: https://github.com/opendatateam/udata/pull/2320",
@@ -42331,7 +49499,7 @@
             "v": "<1.24.2"
         },
         {
-            "advisory": "urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.",
+            "advisory": "Urllib3 1.25.9 includes a fix for CVE-2020-26137: Urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116.\r\nhttps://bugs.python.org/issue39603\r\nhttps://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b\r\nhttps://github.com/urllib3/urllib3/pull/1800",
             "cve": "CVE-2020-26137",
             "id": "pyup.io-38834",
             "specs": [
@@ -42340,13 +49508,13 @@
             "v": "<1.25.9"
         },
         {
-            "advisory": "Urllib3 1.8 improves the default SSL/TLS settings to avoid vulnerabilities.",
-            "cve": "PVE-2021-39094",
-            "id": "pyup.io-39094",
+            "advisory": "Urllib3 1.26.5 includes a fix for CVE-2021-33503: An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.\r\nhttps://github.com/advisories/GHSA-q2q7-5pp4-w6pg",
+            "cve": "CVE-2021-33503",
+            "id": "pyup.io-43975",
             "specs": [
-                "<1.8"
+                "<1.26.5"
             ],
-            "v": "<1.8"
+            "v": "<1.26.5"
         },
         {
             "advisory": "In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.",
@@ -42387,7 +49555,7 @@
             "v": ">=1.25.2,<=1.25.7"
         },
         {
-            "advisory": "The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.",
+            "advisory": "Urllib3 1.26.4 includes a fix for CVE-2021-28363: The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.\r\nhttps://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r",
             "cve": "CVE-2021-28363",
             "id": "pyup.io-40014",
             "specs": [
@@ -42578,7 +49746,7 @@
             "v": "<0.0.9"
         },
         {
-            "advisory": "The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.",
+            "advisory": "Virustotal-python 0.1.2 updates its dependency 'urllib3' to v1.26.4 to include a security fix.",
             "cve": "CVE-2021-28363",
             "id": "pyup.io-40663",
             "specs": [
@@ -42653,6 +49821,53 @@
             "v": "<0.6.21"
         }
     ],
+    "vpype": [
+        {
+            "advisory": "Vpype 1.8.1 updates 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22815",
+            "id": "pyup.io-44521",
+            "specs": [
+                "<1.8.1"
+            ],
+            "v": "<1.8.1"
+        },
+        {
+            "advisory": "Vpype 1.8.1 updates 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22816",
+            "id": "pyup.io-44522",
+            "specs": [
+                "<1.8.1"
+            ],
+            "v": "<1.8.1"
+        },
+        {
+            "advisory": "Vpype 1.8.1 updates 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2022-44525",
+            "id": "pyup.io-44526",
+            "specs": [
+                "<1.8.1"
+            ],
+            "v": "<1.8.1"
+        },
+        {
+            "advisory": "Vpype 1.8.1 updates 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "PVE-2022-44524",
+            "id": "pyup.io-44527",
+            "specs": [
+                "<1.8.1"
+            ],
+            "v": "<1.8.1"
+        },
+        {
+            "advisory": "Vpype 1.8.1 updates 'Pillow' to v9.0.0 to include security fixes.",
+            "cve": "CVE-2022-22817",
+            "id": "pyup.io-44523",
+            "specs": [
+                "<1.8.1"
+            ],
+            "v": "<1.8.1"
+        }
+    ],
     "vresutils": [
         {
             "advisory": "Vresutils version 0.3.1 includes a security fix for the function 'init' in 'vresutils/snakemake.py'. Use of unsafe yaml load allows instantiation of arbitrary objects. Consider yaml.safe_load()\r\nhttps://github.com/FRESNA/vresutils/commit/5d5fbb5d19454042c5bc1c379b4634d1182cfd6a",
@@ -42745,6 +49960,15 @@
             ],
             "v": ">=2.11a1,<2.11.7,>=2.12a1,<2.12.4"
         },
+        {
+            "advisory": "Wagtail 2.15.2 includes a fix for CVE-2022-21683: When notifications for new replies in comment threads are sent, they are sent to all users who have replied or commented anywhere on the site, rather than only in the relevant threads. This means that a user could listen in to new comment replies on pages they have not have editing access to, as long as they have left a comment or reply somewhere on the site. A patched version has been released as Wagtail 2.15.2, which restores the intended behaviour - to send notifications for new replies to the participants in the active thread only (editing permissions are not considered). New comments can be disabled by setting 'WAGTAILADMIN_COMMENTS_ENABLED = False' in the Django settings file.\r\nhttps://github.com/wagtail/wagtail/security/advisories/GHSA-xqxm-2rpm-3889",
+            "cve": "CVE-2022-21683",
+            "id": "pyup.io-44608",
+            "specs": [
+                ">=2.13a0,<2.15.2"
+            ],
+            "v": ">=2.13a0,<2.15.2"
+        },
         {
             "advisory": "Wagtail 2.7.2 fixes CVE-2020-11001, which allows a XSS attack via page revision comparison view.",
             "cve": "CVE-2020-11001",
@@ -42957,7 +50181,7 @@
             "v": "<0.30.0"
         },
         {
-            "advisory": "Wasmtime is an open source runtime for WebAssembly & WASI. In Wasmtime from version 0.19.0 and before version 0.30.0 there was a use-after-free bug when passing `externref`s from the host to guest Wasm content. To trigger the bug, you have to explicitly pass multiple `externref`s from the host to a Wasm instance at the same time, either by passing multiple `externref`s as arguments from host code to a Wasm function, or returning multiple `externref`s to Wasm from a multi-value return function defined in the host. If you do not have host code that matches one of these shapes, then you are not impacted. If Wasmtime's `VMExternRefActivationsTable` became filled to capacity after passing the first `externref` in, then passing in the second `externref` could trigger a garbage collection. However the first `externref` is not rooted until we pass control to Wasm, and therefore could be reclaimed by the collector if nothing else was holding a reference to it or otherwise keeping it alive. Then, when control was passed to Wasm after the garbage collection, Wasm could use the first `externref`, which at this point has already been freed. We have reason to believe that the effective impact of this bug is relatively small because usage of `externref` is currently quite rare. The bug has been fixed, and users should upgrade to Wasmtime 0.30.0. If you cannot upgrade Wasmtime yet, you can avoid the bug by disabling reference types support in Wasmtime by passing `false` to `wasmtime::Config::wasm_reference_types`.",
+            "advisory": "Wasmtime 0.30.0 includes a fix for CVE-2021-39216: A use-after-free bug when passing externrefs from the host to guest Wasm content.\r\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-v4cp-h94r-m7xf",
             "cve": "CVE-2021-39216",
             "id": "pyup.io-41831",
             "specs": [
@@ -43307,7 +50531,7 @@
     ],
     "whitenoise": [
         {
-            "advisory": "whitenoise 4.1.3 change: Fix potential path traversal attack while running in autorefresh mode on\r\n   Windows",
+            "advisory": "Whitenoise 4.1.3 fixes potential path traversal attack while running in autorefresh mode on Windows.\r\nhttps://github.com/evansd/whitenoise/commit/4d8a3ab1e97d7ddb18b3fa8b4909c92bad5529c6",
             "cve": "PVE-2021-37275",
             "id": "pyup.io-37275",
             "specs": [
@@ -43407,8 +50631,8 @@
     "wolkenbrot": [
         {
             "advisory": "Wolkenbrot 0.3 updates its dependency 'cryptography' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2020-25659",
-            "id": "pyup.io-42217",
+            "cve": "CVE-2020-36242",
+            "id": "pyup.io-42171",
             "specs": [
                 "<0.3"
             ],
@@ -43416,8 +50640,8 @@
         },
         {
             "advisory": "Wolkenbrot 0.3 updates its dependency 'cryptography' to v3.3.2 to include security fixes.",
-            "cve": "CVE-2020-36242",
-            "id": "pyup.io-42171",
+            "cve": "CVE-2020-25659",
+            "id": "pyup.io-42217",
             "specs": [
                 "<0.3"
             ],
@@ -43483,15 +50707,6 @@
         }
     ],
     "wtforms": [
-        {
-            "advisory": "Wtforms 1.0 adds CSRF support.\r\nhttps://github.com/wtforms/wtforms/commit/084be36d63bbea46d308dbd5e80dd3e296c70321",
-            "cve": "PVE-2021-42483",
-            "id": "pyup.io-42483",
-            "specs": [
-                "<1.0"
-            ],
-            "v": "<1.0"
-        },
         {
             "advisory": "Wtforms 3.0.0a1 escape unsafe characters in label text, patching a XSS vulnerability.\r\nhttps://github.com/wtforms/wtforms/commit/8529b953a0919300794f95e01a7713162908c8a6",
             "cve": "PVE-2021-42852",
@@ -43757,18 +50972,18 @@
             "v": "<1.0.9.2"
         },
         {
-            "advisory": "Yandex2lightroom 1.0.9.2 updates its dependency 'urllib3' to v1.26.7 for including a security fixes.",
-            "cve": "CVE-2020-7212",
-            "id": "pyup.io-42410",
+            "advisory": "Yandex2lightroom 1.0.9.2 updates its dependency 'urllib3' to v1.26.7 for including security fixes.",
+            "cve": "CVE-2021-33503",
+            "id": "pyup.io-42673",
             "specs": [
                 "<1.0.9.2"
             ],
             "v": "<1.0.9.2"
         },
         {
-            "advisory": "Yandex2lightroom 1.0.9.2 updates its dependency 'urllib3' to v1.26.7 for including security fixes.",
-            "cve": "CVE-2021-33503",
-            "id": "pyup.io-42673",
+            "advisory": "Yandex2lightroom 1.0.9.2 updates its dependency 'urllib3' to v1.26.7 for including a security fixes.",
+            "cve": "CVE-2020-7212",
+            "id": "pyup.io-42410",
             "specs": [
                 "<1.0.9.2"
             ],
@@ -43797,17 +51012,6 @@
             "v": "<0.1.14"
         }
     ],
-    "yfpy": [
-        {
-            "advisory": "Yfpy 4.0.0 includes general security updates and removes support for Python 3.5 (which doesn't receive security updates anymore).",
-            "cve": "PVE-2021-42415",
-            "id": "pyup.io-42415",
-            "specs": [
-                "<4.0.0"
-            ],
-            "v": "<4.0.0"
-        }
-    ],
     "ymlref": [
         {
             "advisory": "ymlref allows code injection.",
@@ -43971,26 +51175,26 @@
     "zodipy": [
         {
             "advisory": "Zodipy 0.2.2 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
-            "cve": "PVE-2021-41277",
-            "id": "pyup.io-43346",
+            "cve": "CVE-2021-23437",
+            "id": "pyup.io-42812",
             "specs": [
                 "<0.2.2"
             ],
             "v": "<0.2.2"
         },
         {
-            "advisory": "Zodipy 0.2.2 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
-            "cve": "CVE-2021-23437",
-            "id": "pyup.io-42812",
+            "advisory": "Zodipy 0.2.2 updates its dependency 'pillow' to v8.3.2 to include a security fix. Prior versions of pillow were vulnerable to 6-byte Out-Of-Bound read in FliDecode.",
+            "cve": "PVE-2021-42813",
+            "id": "pyup.io-42813",
             "specs": [
                 "<0.2.2"
             ],
             "v": "<0.2.2"
         },
         {
-            "advisory": "Zodipy 0.2.2 updates its dependency 'pillow' to v8.3.2 to include a security fix. Prior versions of pillow were vulnerable to 6-byte Out-Of-Bound read in FliDecode.",
-            "cve": "PVE-2021-42813",
-            "id": "pyup.io-42813",
+            "advisory": "Zodipy 0.2.2 updates its dependency 'pillow' to v8.3.2 to include security fixes.",
+            "cve": "PVE-2021-41277",
+            "id": "pyup.io-43346",
             "specs": [
                 "<0.2.2"
             ],
@@ -44086,6 +51290,16 @@
             ],
             "v": ">=4.0.0, <4.6.3,>=5.0.0, <5.3.0"
         },
+        {
+            "advisory": "Zope 5.2.1 and 4.6.1 include a fix for CVE-2021-32674: This is an extension of the advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA\\u002D5pr9\\u002Dv234\\u002Djw36 with additional cases of TAL expression traversal vulnerabilities.\r\nhttps://github.com/zopefoundation/Zope/security/advisories/GHSA-rpcg-f9q6-2mq6",
+            "cve": "CVE-2021-32674",
+            "id": "pyup.io-40636",
+            "specs": [
+                ">=4.0.0a1,<4.6.1",
+                ">=5.0.0a1,<5.2.1"
+            ],
+            "v": ">=4.0.0a1,<4.6.1,>=5.0.0a1,<5.2.1"
+        },
         {
             "advisory": "Zope 5.3 updates the 'AccessControl' version pin to fix a remote code execution issue. See CVE-2021-32807: The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution. By default, you need to have the admin-level Zope \"Manager\" role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk. The problem has been fixed in AccessControl 4.3 and 5.2. Only AccessControl versions 4 and 5 are vulnerable, and only on Python 3, not Python 2.7. As a workaround, a site administrator can restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.",
             "cve": "CVE-2021-32807",
@@ -44094,16 +51308,6 @@
                 ">=5.0.0,<5.3.0"
             ],
             "v": ">=5.0.0,<5.3.0"
-        },
-        {
-            "advisory": "Zope is an open-source web application server. This advisory extends the previous advisory at https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36 with additional cases of TAL expression traversal vulnerabilities. Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use. By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk. The problem has been fixed in Zope 5.2.1 and 4.6.1. The workaround is the same as for https://github.com/zopefoundation/Zope/security/advisories/GHSA-5pr9-v234-jw36: A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.",
-            "cve": "CVE-2021-32674",
-            "id": "pyup.io-40636",
-            "specs": [
-                ">=5.0.0a1,<5.21.0",
-                ">=4.0.0a1,<4.6.1"
-            ],
-            "v": ">=5.0.0a1,<5.21.0,>=4.0.0a1,<4.6.1"
         }
     ],
     "zope.html": [