{"action":"Upgrade devpi-server to 6.20.2 or later.","affected":[{"fixed":"6.20.2","introduced":"0"}],"component":"devpi-server","cve_ids":["CVE-2026-54723"],"ecosystem":"PyPI","epss":0.00434,"exploited":false,"fixed_versions":["6.20.2"],"ghsa_id":"GHSA-m5pq-69xg-vcq3","id":"tcs_01M5KH6MDBM35HJ4MW66SAG6AX","modified_at":"2026-08-19T12:45:06.488373956Z","published_at":"2026-08-19T11:56:28.164114Z","references":["https://osv.dev/vulnerability/PYSEC-2026-3661","https://github.com/devpi/devpi/security/advisories/GHSA-m5pq-69xg-vcq3","https://github.com/devpi/devpi","https://pypi.org/project/devpi-server","https://github.com/advisories/GHSA-m5pq-69xg-vcq3","https://nvd.nist.gov/vuln/detail/CVE-2026-54723"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"PYSEC-2026-3661","url":"https://osv.dev/vulnerability/PYSEC-2026-3661"}],"summary":"devpi-server may leak database contents"}