47 published AI models are associated with this package: 1 name it in a requirements or pyproject file, 47 load it or import it directly, and 0 are inferred from the runtime stack their declared library pulls in. Only 0 state a version requirement, so this is not a count of affected models.
cvss
7.5
high
CVSS v3.1 base score out of 10
epss
6.9%
high
chance of exploitation in 30 days, 94th percentile of all CVEs
xyz score
5.6
medium
CyberXYZ composite out of 10
fig. 01 — GHSA-x84v-xcm2-53pg, the advisory selected below
The Requests package through 2.19.1 before 2018-09-14 for Python sends an HTTP Authorization header to an http URI upon receiving a same-hostname https-to-http redirect, which makes it easier for remote attackers to discover credentials by sniffing the network.
// cvss v3.1 vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Checked 2026-11-06 at 20:55 UTC. The most recent advisory here was published 2026-03-25. Updated continuously from NVD, GHSA, OSV and CNA feeds.