airoboros (2.1.1), aphrodite-engine (>=0.3.0, <=0.5.1) +30 more potentially affected by CVE-2024-12376 via fschat (>=0.2.2, <=0.2.36)

fschat PYPI version =0.2.2, =0.3.0, =0.0.1, =1.1.0, =1.1.0, =0.1.1, =0.1.1, =0.9.0.8, =1.0.0, =1.1.4 - iflow-mcp-edenyavin-garakr-mcp 0.1.0 and more Source cves: CVE-2024-12376 Source advisory: OSV:PYSEC-2026-1396...

airoboros (2.1.1), aphrodite-engine (>=0.3.0, <=0.5.1) +30 more potentially affected by CVE-2024-10908 via fschat (>=0.2.2, <=0.2.36)

fschat PYPI version =0.2.2, =0.3.0, =0.0.1, =1.1.0, =1.1.0, =0.1.1, =0.1.1, =0.9.0.8, =1.0.0, =1.1.4 - iflow-mcp-edenyavin-garakr-mcp 0.1.0 and more Source cves: CVE-2024-10908 Source advisory: OSV:PYSEC-2026-1394...

trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-55890 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-55890 Source advisory: OSV:PYSEC-2026-1320...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-55890 via dtale (2.2.0)

dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2024-55890 Source advisory: OSV:PYSEC-2026-1320...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-8862 via dtale (2.2.0)

dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2024-8862 Source advisory: OSV:PYSEC-2026-1321...

PYSEC-2026-1321 D-Tale Command Execution Vulnerability

D-Tale is the combination of a Flask back-end and a React front-end to bring you an easy way to view & analyze Pandas data structures. In dtale\views.py, under the route @dtale.route"/chart-data/", the query parameters from the request are directly passed into runquery for execution. And...

trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-8862 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-8862 Source advisory: OSV:PYSEC-2026-1321...

intelligenzaartificiale (>=0.0.0.35, <=0.0.0.38), trt-engine-explorer (>=0.1.0, <=0.1.1) potentially affected by CVE-2024-45595 via dtale (2.2.0)

dtale PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - intelligenzaartificiale =0.0.0.35, =0.1.0, =0.1.1 Source cves: CVE-2024-45595 Source advisory: OSV:PYSEC-2026-1323...

trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-45595 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-45595 Source advisory: OSV:PYSEC-2026-1323...

PYSEC-2026-1628 MindsDB Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

adaptgym (>=0.1.1, <=0.1.2), aiearth-engine (>=3.1.0, <=3.1.5) +34 more potentially affected by CVE-2024-6345 via setuptools (66.0.0)

setuptools PYPI version 66.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - adaptgym =0.1.1, =3.1.0, =0.2.2, =0.1.1, =0.2.2 - bob-bio-base 8.0.0 - bob-bio-face 8.0.0 - bob-bio-spear 5.0.0 - bob-bio-vein 5.0.0 -...

Malicious code in web3-runtime-engine (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7437 Malicious code in web3-runtime-engine (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in resource-library-engine (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7387 Malicious code in resource-library-engine (npm)

--- -= Per source details. Do not edit below this line.=-...

ai-simple-engine-runtime-diffusers (0.0.1) potentially affected by CVE-2024-3568 via transformers (0.1.0)

transformers PYPI version 0.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - ai-simple-engine-runtime-diffusers 0.0.1 Source cves: CVE-2024-3568 Source advisory: OSV:PYSEC-2026-1978...

aie-sdk (>=3.0.1, <=3.0.4), aiearth-engine (>=3.0.2, <=3.1.6) +115 more potentially affected by CVE-2023-50782 via cryptography (38.0.1)

cryptography PYPI version 38.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aie-sdk =3.0.1, =3.0.2, =2022.10.0b0, =3.0.0, =2.1.1, =0.1.37, =0.7.18, =0.1.9, =0.1.10 - c7n-org 0.6.18 and more Source cves:...

aie-sdk (>=3.0.1, <=3.0.4), aiearth-engine (>=3.0.2, <=3.1.6) +115 more potentially affected by CVE-2024-0727 via cryptography (38.0.1)

cryptography PYPI version 38.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aie-sdk =3.0.1, =3.0.2, =2022.10.0b0, =3.0.0, =2.1.1, =0.1.37, =0.7.18, =0.1.9, =0.1.10 - c7n-org 0.6.18 and more Source cves:...

autopilotml (>=1.0.1, <=1.0.14), chicken-coop (>=0.0.1, <=0.0.5) +11 more potentially affected by CVE-2024-22415 via jupyter-lsp (>=2.2.0, <=2.2.1)

jupyter-lsp PYPI version =2.2.0, =1.0.1, =0.0.1, =0.0.1, =1.16.0, =0.0.1, =0.82.0, =1.0.4, =0.0.2, =0.0.12 Source cves: CVE-2024-22415 Source advisory: OSV:PYSEC-2026-1478...

trt-engine-explorer (>=0.1.2, <=0.1.5) potentially affected by CVE-2024-21642 via dtale (2.16.0)

dtale PYPI version 2.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on dtale and may be impacted: - trt-engine-explorer =0.1.2, =0.1.5 Source cves: CVE-2024-21642 Source advisory: OSV:PYSEC-2026-1319...