Django REST framework

Package Instance

Lookup for vulnerable packages by Package URL.

Purlpkg:pypi/mercurial@3.9rc0
Typepypi
Namespace
Namemercurial
Version3.9rc0
Qualifiers
Subpath
Is_vulnerabletrue
Next_non_vulnerable_version4.9
Latest_non_vulnerable_version4.9
Affected_by_vulnerabilities
0
url VCID-276p-r83g-9fce
vulnerability_id VCID-276p-r83g-9fce
summary cext/manifest.c in Mercurial before 4.7.2 has an out-of-bounds read during parsing of a malformed manifest entry.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-17983
reference_id
reference_type
scores
0
value 0.00425
scoring_system epss
scoring_elements 0.62497
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-17983
1
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-91.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-91.yaml
2
reference_url https://www.mercurial-scm.org/repo/hg/rev/5405cb1a7901
reference_id
reference_type
scores
url https://www.mercurial-scm.org/repo/hg/rev/5405cb1a7901
3
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.7.2_.282018-10-01.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.7.2_.282018-10-01.29
4
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-17983
reference_id CVE-2018-17983
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2018-17983
5
reference_url https://github.com/advisories/GHSA-p575-cf9h-wv42
reference_id GHSA-p575-cf9h-wv42
reference_type
scores
url https://github.com/advisories/GHSA-p575-cf9h-wv42
fixed_packages
0
url pkg:pypi/mercurial@4.7.2
purl pkg:pypi/mercurial@4.7.2
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-ygk8-66cv-3qfk
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.7.2
aliases CVE-2018-17983, GHSA-p575-cf9h-wv42, PYSEC-2018-91
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-276p-r83g-9fce
1
url VCID-54jw-rtbb-nkbx
vulnerability_id VCID-54jw-rtbb-nkbx
summary multiple issues
references
0
reference_url https://access.redhat.com/errata/RHSA-2017:2489
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2017:2489
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-1000115
reference_id
reference_type
scores
0
value 0.02142
scoring_system epss
scoring_elements 0.84499
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-1000115
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-88.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-88.yaml
3
reference_url https://security.gentoo.org/glsa/201709-18
reference_id
reference_type
scores
url https://security.gentoo.org/glsa/201709-18
4
reference_url https://web.archive.org/web/20200227155758/http://www.securityfocus.com/bid/100290
reference_id
reference_type
scores
url https://web.archive.org/web/20200227155758/http://www.securityfocus.com/bid/100290
5
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
6
reference_url http://www.debian.org/security/2017/dsa-3963
reference_id
reference_type
scores
url http://www.debian.org/security/2017/dsa-3963
7
reference_url http://www.securityfocus.com/bid/100290
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/100290
8
reference_url https://security.archlinux.org/ASA-201708-7
reference_id ASA-201708-7
reference_type
scores
url https://security.archlinux.org/ASA-201708-7
9
reference_url https://security.archlinux.org/AVG-378
reference_id AVG-378
reference_type
scores
0
value Critical
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-378
10
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-1000115
reference_id CVE-2017-1000115
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2017-1000115
11
reference_url https://github.com/advisories/GHSA-hvr9-wr9p-grgr
reference_id GHSA-hvr9-wr9p-grgr
reference_type
scores
url https://github.com/advisories/GHSA-hvr9-wr9p-grgr
fixed_packages
0
url pkg:pypi/mercurial@4.3
purl pkg:pypi/mercurial@4.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-cjyt-q73h-2kga
2
vulnerability VCID-mmrr-cjnk-nyep
3
vulnerability VCID-nwr3-zjfg-bfgk
4
vulnerability VCID-u1z6-pw66-z3c2
5
vulnerability VCID-ygk8-66cv-3qfk
6
vulnerability VCID-zq69-6454-sfba
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.3
1
url pkg:pypi/mercurial@4.3.1
purl pkg:pypi/mercurial@4.3.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-cjyt-q73h-2kga
2
vulnerability VCID-mmrr-cjnk-nyep
3
vulnerability VCID-nwr3-zjfg-bfgk
4
vulnerability VCID-u1z6-pw66-z3c2
5
vulnerability VCID-ygk8-66cv-3qfk
6
vulnerability VCID-zq69-6454-sfba
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.3.1
aliases CVE-2017-1000115, GHSA-hvr9-wr9p-grgr, PYSEC-2017-88
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-54jw-rtbb-nkbx
2
url VCID-7t7h-jrwp-fbbh
vulnerability_id VCID-7t7h-jrwp-fbbh
summary multiple issues
references
0
reference_url https://access.redhat.com/errata/RHSA-2017:2489
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2017:2489
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-1000116
reference_id
reference_type
scores
0
value 0.04585
scoring_system epss
scoring_elements 0.89396
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-1000116
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-89.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-89.yaml
3
reference_url https://security.gentoo.org/glsa/201709-18
reference_id
reference_type
scores
url https://security.gentoo.org/glsa/201709-18
4
reference_url https://web.archive.org/web/20200227155758/http://www.securityfocus.com/bid/100290
reference_id
reference_type
scores
url https://web.archive.org/web/20200227155758/http://www.securityfocus.com/bid/100290
5
reference_url https://wiki.mercurial-scm.org/WhatsNew/Archive
reference_id
reference_type
scores
url https://wiki.mercurial-scm.org/WhatsNew/Archive
6
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.3_.2F_4.3.1_.282017-08-10.29
7
reference_url http://www.debian.org/security/2017/dsa-3963
reference_id
reference_type
scores
url http://www.debian.org/security/2017/dsa-3963
8
reference_url http://www.securityfocus.com/bid/100290
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/100290
9
reference_url https://security.archlinux.org/ASA-201708-7
reference_id ASA-201708-7
reference_type
scores
url https://security.archlinux.org/ASA-201708-7
10
reference_url https://security.archlinux.org/AVG-378
reference_id AVG-378
reference_type
scores
0
value Critical
scoring_system archlinux
scoring_elements
url https://security.archlinux.org/AVG-378
11
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-1000116
reference_id CVE-2017-1000116
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2017-1000116
12
reference_url https://github.com/advisories/GHSA-3qmg-c9vc-r47j
reference_id GHSA-3qmg-c9vc-r47j
reference_type
scores
url https://github.com/advisories/GHSA-3qmg-c9vc-r47j
fixed_packages
0
url pkg:pypi/mercurial@4.3
purl pkg:pypi/mercurial@4.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-cjyt-q73h-2kga
2
vulnerability VCID-mmrr-cjnk-nyep
3
vulnerability VCID-nwr3-zjfg-bfgk
4
vulnerability VCID-u1z6-pw66-z3c2
5
vulnerability VCID-ygk8-66cv-3qfk
6
vulnerability VCID-zq69-6454-sfba
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.3
aliases CVE-2017-1000116, GHSA-3qmg-c9vc-r47j, PYSEC-2017-89
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-7t7h-jrwp-fbbh
3
url VCID-cjyt-q73h-2kga
vulnerability_id VCID-cjyt-q73h-2kga
summary The mpatch_decode function in mpatch.c in Mercurial before 4.6.1 mishandles certain situations where there should be at least 12 bytes remaining after the current position in the patch data, but actually are not, aka OVE-20180430-0001.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-13348
reference_id
reference_type
scores
0
value 0.00662
scoring_system epss
scoring_elements 0.71501
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-13348
1
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-90.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-90.yaml
2
reference_url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
3
reference_url https://www.mercurial-scm.org/repo/hg/rev/90a274965de7
reference_id
reference_type
scores
url https://www.mercurial-scm.org/repo/hg/rev/90a274965de7
4
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
5
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-13348
reference_id CVE-2018-13348
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2018-13348
6
reference_url https://github.com/advisories/GHSA-3v62-ww8w-758m
reference_id GHSA-3v62-ww8w-758m
reference_type
scores
url https://github.com/advisories/GHSA-3v62-ww8w-758m
fixed_packages
0
url pkg:pypi/mercurial@4.6.1
purl pkg:pypi/mercurial@4.6.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-ygk8-66cv-3qfk
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.6.1
aliases CVE-2018-13348, GHSA-3v62-ww8w-758m, PYSEC-2018-90
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-cjyt-q73h-2kga
4
url VCID-mmrr-cjnk-nyep
vulnerability_id VCID-mmrr-cjnk-nyep
summary In Mercurial before 4.4.1, it is possible that a specially malformed repository can cause Git subrepositories to run arbitrary code in the form of a .git/hooks/post-update script checked into the repository. Typical use of Mercurial prevents construction of such repositories, but they can be created programmatically.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-17458
reference_id
reference_type
scores
0
value 0.17249
scoring_system epss
scoring_elements 0.95144
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-17458
1
reference_url https://bz.mercurial-scm.org/show_bug.cgi?id=5730
reference_id
reference_type
scores
url https://bz.mercurial-scm.org/show_bug.cgi?id=5730
2
reference_url https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
reference_id
reference_type
scores
url https://confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2018-01-24-942834324.html
3
reference_url https://github.com/dscho/hg
reference_id
reference_type
scores
url https://github.com/dscho/hg
4
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-90.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-90.yaml
5
reference_url https://lists.debian.org/debian-lts-announce/2017/12/msg00027.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2017/12/msg00027.html
6
reference_url https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
7
reference_url https://lists.debian.org/debian-lts-announce/2018/07/msg00041.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2018/07/msg00041.html
8
reference_url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
9
reference_url https://web.archive.org/web/20200227132808/http://www.securityfocus.com/bid/102926
reference_id
reference_type
scores
url https://web.archive.org/web/20200227132808/http://www.securityfocus.com/bid/102926
10
reference_url https://www.mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.html
reference_id
reference_type
scores
url https://www.mercurial-scm.org/pipermail/mercurial-devel/2017-November/107333.html
11
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.4.1_.282017-11-07.29
12
reference_url http://www.securityfocus.com/bid/102926
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/102926
13
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-17458
reference_id CVE-2017-17458
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2017-17458
14
reference_url https://github.com/advisories/GHSA-6v56-cpg6-3rpx
reference_id GHSA-6v56-cpg6-3rpx
reference_type
scores
url https://github.com/advisories/GHSA-6v56-cpg6-3rpx
fixed_packages
0
url pkg:pypi/mercurial@4.4.1
purl pkg:pypi/mercurial@4.4.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-cjyt-q73h-2kga
2
vulnerability VCID-nwr3-zjfg-bfgk
3
vulnerability VCID-u1z6-pw66-z3c2
4
vulnerability VCID-ygk8-66cv-3qfk
5
vulnerability VCID-zq69-6454-sfba
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.4.1
aliases CVE-2017-17458, GHSA-6v56-cpg6-3rpx, PYSEC-2017-90
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-mmrr-cjnk-nyep
5
url VCID-nwr3-zjfg-bfgk
vulnerability_id VCID-nwr3-zjfg-bfgk
summary mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002.
references
0
reference_url https://access.redhat.com/errata/RHSA-2019:2276
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2019:2276
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-13347
reference_id
reference_type
scores
0
value 0.0125
scoring_system epss
scoring_elements 0.79642
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-13347
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-89.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-89.yaml
3
reference_url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
4
reference_url https://www.mercurial-scm.org/repo/hg-committed/log?rev=modifies%28%22mercurial%2Fmpatch.c%22%29+and+4.5%3A%3A
reference_id
reference_type
scores
url https://www.mercurial-scm.org/repo/hg-committed/log?rev=modifies%28%22mercurial%2Fmpatch.c%22%29+and+4.5%3A%3A
5
reference_url https://www.mercurial-scm.org/repo/hg/rev/1acfc35d478c
reference_id
reference_type
scores
url https://www.mercurial-scm.org/repo/hg/rev/1acfc35d478c
6
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-13347
reference_id CVE-2018-13347
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2018-13347
8
reference_url https://github.com/advisories/GHSA-3mjj-mr4f-qxmx
reference_id GHSA-3mjj-mr4f-qxmx
reference_type
scores
url https://github.com/advisories/GHSA-3mjj-mr4f-qxmx
fixed_packages
0
url pkg:pypi/mercurial@4.6.1
purl pkg:pypi/mercurial@4.6.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-ygk8-66cv-3qfk
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.6.1
aliases CVE-2018-13347, GHSA-3mjj-mr4f-qxmx, PYSEC-2018-89
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-nwr3-zjfg-bfgk
6
url VCID-u1z6-pw66-z3c2
vulnerability_id VCID-u1z6-pw66-z3c2
summary The mpatch_apply function in mpatch.c in Mercurial before 4.6.1 incorrectly proceeds in cases where the fragment start is past the end of the original data, aka OVE-20180430-0004.
references
0
reference_url https://access.redhat.com/errata/RHSA-2019:2276
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2019:2276
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-13346
reference_id
reference_type
scores
0
value 0.00288
scoring_system epss
scoring_elements 0.52515
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-13346
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-88.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-88.yaml
3
reference_url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
4
reference_url https://www.mercurial-scm.org/repo/hg/rev/faa924469635
reference_id
reference_type
scores
url https://www.mercurial-scm.org/repo/hg/rev/faa924469635
5
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.6.1_.282018-06-06.29
6
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-13346
reference_id CVE-2018-13346
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2018-13346
7
reference_url https://github.com/advisories/GHSA-9xv4-r2hf-26gh
reference_id GHSA-9xv4-r2hf-26gh
reference_type
scores
url https://github.com/advisories/GHSA-9xv4-r2hf-26gh
fixed_packages
0
url pkg:pypi/mercurial@4.6.1
purl pkg:pypi/mercurial@4.6.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-ygk8-66cv-3qfk
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.6.1
aliases CVE-2018-13346, GHSA-9xv4-r2hf-26gh, PYSEC-2018-88
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-u1z6-pw66-z3c2
7
url VCID-ycw2-p9yf-tbdg
vulnerability_id VCID-ycw2-p9yf-tbdg
summary In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a repository name.
references
0
reference_url https://access.redhat.com/errata/RHSA-2017:1576
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2017:1576
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2017-9462
reference_id
reference_type
scores
0
value 0.48699
scoring_system epss
scoring_elements 0.97805
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2017-9462
2
reference_url https://bugs.debian.org/861243
reference_id
reference_type
scores
url https://bugs.debian.org/861243
3
reference_url https://github.com/advisories/GHSA-ghjx-3jg5-h6r2
reference_id
reference_type
scores
url https://github.com/advisories/GHSA-ghjx-3jg5-h6r2
4
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-91.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2017-91.yaml
5
reference_url https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
6
reference_url https://security.gentoo.org/glsa/201709-18
reference_id
reference_type
scores
url https://security.gentoo.org/glsa/201709-18
7
reference_url https://web.archive.org/web/20200227162318/http://www.securityfocus.com/bid/99123
reference_id
reference_type
scores
url https://web.archive.org/web/20200227162318/http://www.securityfocus.com/bid/99123
8
reference_url https://www.mercurial-scm.org/repo/hg/rev/77eaf9539499
reference_id
reference_type
scores
url https://www.mercurial-scm.org/repo/hg/rev/77eaf9539499
9
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.1.3_.282017-4-18.29
10
reference_url http://www.debian.org/security/2017/dsa-3963
reference_id
reference_type
scores
url http://www.debian.org/security/2017/dsa-3963
11
reference_url http://www.securityfocus.com/bid/99123
reference_id
reference_type
scores
url http://www.securityfocus.com/bid/99123
12
reference_url https://nvd.nist.gov/vuln/detail/CVE-2017-9462
reference_id CVE-2017-9462
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2017-9462
fixed_packages
0
url pkg:pypi/mercurial@4.1.3
purl pkg:pypi/mercurial@4.1.3
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-54jw-rtbb-nkbx
2
vulnerability VCID-7t7h-jrwp-fbbh
3
vulnerability VCID-cjyt-q73h-2kga
4
vulnerability VCID-mmrr-cjnk-nyep
5
vulnerability VCID-nwr3-zjfg-bfgk
6
vulnerability VCID-u1z6-pw66-z3c2
7
vulnerability VCID-ygk8-66cv-3qfk
8
vulnerability VCID-zq69-6454-sfba
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.1.3
aliases CVE-2017-9462, GHSA-ghjx-3jg5-h6r2, PYSEC-2017-91
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ycw2-p9yf-tbdg
8
url VCID-ygk8-66cv-3qfk
vulnerability_id VCID-ygk8-66cv-3qfk
summary A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside a repository.
references
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2019-3902
reference_id
reference_type
scores
0
value 0.00541
scoring_system epss
scoring_elements 0.67958
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2019-3902
1
reference_url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902
reference_id
reference_type
scores
url https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3902
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2019-188.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2019-188.yaml
3
reference_url https://lists.debian.org/debian-lts-announce/2019/04/msg00024.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2019/04/msg00024.html
4
reference_url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
5
reference_url https://usn.ubuntu.com/4086-1
reference_id
reference_type
scores
url https://usn.ubuntu.com/4086-1
6
reference_url https://usn.ubuntu.com/4086-1/
reference_id
reference_type
scores
url https://usn.ubuntu.com/4086-1/
7
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.9_.282019-02-01.29
8
reference_url https://nvd.nist.gov/vuln/detail/CVE-2019-3902
reference_id CVE-2019-3902
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2019-3902
9
reference_url https://github.com/advisories/GHSA-mq66-vcfc-8246
reference_id GHSA-mq66-vcfc-8246
reference_type
scores
url https://github.com/advisories/GHSA-mq66-vcfc-8246
fixed_packages
0
url pkg:pypi/mercurial@4.9
purl pkg:pypi/mercurial@4.9
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.9
aliases CVE-2019-3902, GHSA-mq66-vcfc-8246, PYSEC-2019-188
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-ygk8-66cv-3qfk
9
url VCID-zq69-6454-sfba
vulnerability_id VCID-zq69-6454-sfba
summary Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data access. This attack appear to be exploitable via network connectivity. This vulnerability appears to have been fixed in 4.5.1.
references
0
reference_url https://access.redhat.com/errata/RHSA-2019:2276
reference_id
reference_type
scores
url https://access.redhat.com/errata/RHSA-2019:2276
1
reference_url https://api.first.org/data/v1/epss?cve=CVE-2018-1000132
reference_id
reference_type
scores
0
value 0.006
scoring_system epss
scoring_elements 0.69772
published_at 2026-05-30T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2018-1000132
2
reference_url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-87.yaml
reference_id
reference_type
scores
url https://github.com/pypa/advisory-database/tree/main/vulns/mercurial/PYSEC-2018-87.yaml
3
reference_url https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2018/03/msg00034.html
4
reference_url https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2018/07/msg00005.html
5
reference_url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
reference_id
reference_type
scores
url https://lists.debian.org/debian-lts-announce/2020/07/msg00032.html
6
reference_url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29
reference_id
reference_type
scores
url https://www.mercurial-scm.org/wiki/WhatsNew#Mercurial_4.5.1_.2F_4.5.2_.282018-03-06.29
7
reference_url https://nvd.nist.gov/vuln/detail/CVE-2018-1000132
reference_id CVE-2018-1000132
reference_type
scores
url https://nvd.nist.gov/vuln/detail/CVE-2018-1000132
8
reference_url https://github.com/advisories/GHSA-4mr4-7vjv-9hm6
reference_id GHSA-4mr4-7vjv-9hm6
reference_type
scores
url https://github.com/advisories/GHSA-4mr4-7vjv-9hm6
fixed_packages
0
url pkg:pypi/mercurial@4.5.1
purl pkg:pypi/mercurial@4.5.1
is_vulnerable true
affected_by_vulnerabilities
0
vulnerability VCID-276p-r83g-9fce
1
vulnerability VCID-cjyt-q73h-2kga
2
vulnerability VCID-nwr3-zjfg-bfgk
3
vulnerability VCID-u1z6-pw66-z3c2
4
vulnerability VCID-ygk8-66cv-3qfk
resource_url http://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@4.5.1
aliases CVE-2018-1000132, GHSA-4mr4-7vjv-9hm6, PYSEC-2018-87
risk_score null
exploitability null
weighted_severity null
resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-zq69-6454-sfba
Fixing_vulnerabilities
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/packages/pkg:pypi/mercurial@3.9rc0