Malicious Package

Overview reqcrypt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2026-45272 MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIALAUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in...

CVE-2026-45272 MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIALAUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in...

CVE-2026-45272

MyBooks (also known as Talebook), a personal ebook management web server, is vulnerable to remote code execution in versions 3.41.2 and earlier . The root cause is a Python code injection via the AdminSettings.post handler in webserver/handlers/admin.py, which accepts SOCIAL_AUTH key names withou...

CVE-2026-45272 MyBooks: Remote Code Execution via SOCIAL_AUTH Key Name Injection in Python Config File

MyBooks is an enhanced and easy-to-use personal ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler in webserver/handlers/admin.py accepts SOCIALAUTH key names without validating quotes or newline characters, and SettingsLoader.dumpfile in...

python: Python: Denial of Service via super-linear regular expression work in csv.Sniffer.sniff()

A flaw was found in the csv.Sniffer.sniff function within Python. An attacker can exploit this by providing specially crafted CSV samples, which can trigger super-linear regular-expression processing during dialect sniffing. This excessive processing consumes significant CPU resources, potentiall...

django-l10n-extensions (>=1.0.1, <=1.1.0), django-l10n-extensions-django-3 (1.0.7) +9 more potentially affected by CVE-2026-76222 via gitpython (1.0.1)

gitpython PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - django-l10n-extensions =1.0.1, =0.1.0, =0.1.0, =0.1.0.dev20160122122211, =0.3.0, =0.3.1, =0.1.0, =0.0.0, =0.1.2, =0.1.18 Source cves:...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-76222 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-76222 Source advisory: OSV:PYSEC-2026-3784...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-76221 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-76221 Source advisory: OSV:PYSEC-2026-3783...

cabrita (>=2.2.2b1, <=2.2.2b2), cico (>=0.1.0, <=0.1.8) +4 more potentially affected by CVE-2026-76221 via gitpython (2.1.10)

gitpython PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - cabrita =2.2.2b1, =0.1.0, =0.1.0, =3.11.1, =0.9.0, =0.9.7.2 Source cves: CVE-2026-76221 Source advisory: OSV:PYSEC-2026-3783...

UBUNTU-CVE-2026-76222

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory. Attackers can craft malicious repositories with traversal sequences in submodule names that GitPython...

UBUNTU-CVE-2026-76221

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace into option names. Attackers can inject malicious option names like 'sshComman...

UBUNTU-CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

CVE-2026-76219

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.fromtree, IndexFile.reset, and IndexFile.mergetree methods that append caller-influenced treeish strings to git read-tree without option validation or argument separation. Attackers can inject the...

CVE-2026-76220

GitPython before 3.1.58 contains a command execution vulnerability in the checkunsafeoptions guard that can be bypassed by combining a single-character kwarg with splitsinglecharoptions=False. Attackers can supply a crafted kwargs dictionary to guarded methods like clonefrom to emit a joined toke...

CVE-2026-76218

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation. Attackers can supply a template parameter pointing to a directory with malicious git hooks that execute arbitrary code when git operations are performed on the...

PYSEC-2026-3696 sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes

Summary The documented Python and PHP output modes generate source-code snippets from caller-supplied SQL. Their output filters escape quote characters without first escaping existing backslashes. Crafted SQL can therefore neutralize the generated quote escape, terminate the intended language...

Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing the Wildcard

SummaryGlances's REST API server includes a documented safety check intended to guarantee that corscredentials=True can never be combined with an unrestricted CORS origin allowlist. The check compares the configured origin list to the wildcard using exact list equality corsorigins == "" instead o...

elyra (>=2.0.0, <=3.0.0rc1), elyra-code-snippet-extension (>=2.2.0, <=3.0.0rc1) +11 more potentially affected by CVE-2026-73415 via jupyterlab (3.3.4)

jupyterlab PYPI version 3.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - elyra =2.0.0, =2.2.0, =2.2.0, =2.2.0, =2.2.0, =2.0.0, =0.1.1.10, =0.1.6.2, =0.0.1, =0.1.0, =0.0.13, =0.0.24 - retrolab 0.3.20 Source cves:...

elyra-code-snippet-extension (>=3.14.0, <=3.14.1), elyra-code-viewer-extension (>=3.14.0, <=3.14.1) +9 more potentially affected by CVE-2026-73415 via jupyterlab (3.5.3)

jupyterlab PYPI version 3.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - elyra-code-snippet-extension =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =3.14.0, =0.0.7, =0.1.2, =0.0.1, =0.1.0, =0.0.2, =0.0.3 Source cve...