MAL-2026-17325 Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...

CVE-2026-75142 vulnerabilities

Vulnerabilities for packages: ffmpeg, eco-python-ffmpeg-minimal, torchaudio-ffmpeg-tarballs...

CVE-2026-75146 vulnerabilities

Vulnerabilities for packages: ffmpeg, eco-python-ffmpeg-minimal, torchaudio-ffmpeg-tarballs...

CVE-2026-75147 vulnerabilities

Vulnerabilities for packages: ffmpeg, eco-python-ffmpeg-minimal, torchaudio-ffmpeg-tarballs...

GHSA-63QJ-83CJ-JP3M vulnerabilities

Vulnerabilities for packages: ffmpeg, eco-python-ffmpeg-minimal, torchaudio-ffmpeg-tarballs...

GHSA-564V-JR2Q-MGWF vulnerabilities

Vulnerabilities for packages: ffmpeg, eco-python-ffmpeg-minimal, torchaudio-ffmpeg-tarballs...

GHSA-5VJ8-JGQJ-77H6 vulnerabilities

Vulnerabilities for packages: ffmpeg, eco-python-ffmpeg-minimal, torchaudio-ffmpeg-tarballs...

CLEANSTART-2026-AP36720 Loop with Unreachable Exit Condition ('Infinite Loop') vulnerability in Apache Thrift Python, Go, PHP and Java bindings

Security vulnerability affects the tempo package. Loop with Unreachable Exit Condition 'Infinite Loop' vulnerability in Apache Thrift Python, Go, PHP and Java bindings...

CVE-2026-51856

In agentscope 1.0.18, 1.0.19, and 1.0.19 when the RealtimeAgent session exposes executepythoncode as an available tool, a remote WebSocket user can prompt the agent to call that tool and run Python code in the service environment. In the validated path, RealtimeAgent.acting forwards the...

CVE-2026-51853

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...

EUVD-2026-90423

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

CVE-2026-51857

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

PT-2026-103603

Name of the Vulnerable Software and Affected Versions agent-zero versions 1.7 through 1.10 Description A directory traversal issue exists in the FileBrowser. init function within the python/helpers/file browser.py file. The FileBrowser class initializes using the host root directory as the...

CVE-2026-103001: Modification of Assumed-Immutable Data (MAID)

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

CVE-2026-51857: Improper Control of Generation of Code

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

PT-2026-103614

Name of the Vulnerable Software and Affected Versions DB-GPT versions 0.7.5 and 0.8.0 Description A directory traversal issue exists in the python file upload function within the endpoint packages/dbgpt-app/src/dbgpt app/openapi/api v1/python upload api.py:42. This allows a remote attacker to wri...

PT-2026-103608

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

EUVD-2026-90425

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...

PT-2026-103461

Name of the Vulnerable Software and Affected Versions Python affected versions not specified Description The ssl.SSLContext.wrap bio function fails to require the server hostname argument to be non-null when ssl.SSLContext.check hostname is enabled. Due to a missing parameter check in SSLObject, ...

CVE-2026-19553: Improper Validation of Certificate with Host Mismatch

ssl.SSLContext.wrapbio didn't require the serverhostname argument to not be None if ssl.SSLContext.checkhostname was set. Due to a missing parameter check in SSLObject, if the serverhostname argument isn't supplied then hostname verification would be silently skipped. This defect could lead to...