CVE-2026-16488

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

CVE-2026-16488 QUSETIONS MiniCode-Python Project File config.py subprocess.Popen os command injection

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

CVE-2026-16488

A vulnerability was determined in QUSETIONS MiniCode-Python 0.1.0. This vulnerability affects the function subprocess.Popen of the file minicode/config.py of the component Project File Handler. Executing a manipulation can lead to os command injection. The attack may be launched remotely. A high...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-67322 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-67322 Source advisory: OSV:GHSA-RWJ8-PGH3-R573...

CVE-2026-46556

FlaskBB is a Forum Software written in Python using the micro framework Flask. Prior to version 2.2.1, a Server-Side Request Forgery SSRF vulnerability in getimageinfo allows any authenticated user to force the server to send HTTP requests to arbitrary internal endpoints, including cloud metadata...

MAL-2026-10986 Malicious code in comp-colors (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ac2a6fc7368c6b3ed1bfac9a3a9ea25e9a54ba5d980a48767c811e03fc72566 The package presents itself as a local color-palette toolkit but exports a public colors function in remote.py that POSTs to the hardcoded endpoint...

cabrita (>=2.2.2b1, <=2.2.2b2), cico (>=0.1.0, <=0.1.8) +4 more potentially affected by CVE-2026-67323 via gitpython (2.1.10)

gitpython PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - cabrita =2.2.2b1, =0.1.0, =0.1.0, =3.11.1, =0.9.0, =0.9.7.2 Source cves: CVE-2026-67323 Source advisory: OSV:GHSA-956X-8GVW-WG5V...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-67323 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-67323 Source advisory: OSV:GHSA-956X-8GVW-WG5V...

angr v9.3.0

angr angr is a platform-agnostic binary analysis framework. It is brought to you by the Computer Security Lab at UC Santa Barbara, SEFCOM at Arizona State University, their associated CTF team, Shellphish, the open source community, and @rhelmot. Project Links Homepage: https://angr.io Project...

django-l10n-extensions (>=1.0.1, <=1.1.0), django-l10n-extensions-django-3 (1.0.7) +9 more potentially affected by CVE-2026-42215 +1 more via gitpython (1.0.1)

gitpython PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - django-l10n-extensions =1.0.1, =0.1.0, =0.1.0, =0.1.0.dev20160122122211, =0.3.0, =0.3.1, =0.1.0, =0.0.0, =0.1.2, =0.1.18 Source cves:...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-42215 +1 more via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-42215, CVE-2026-67325 Source advisory: OSV:GHSA-2F96-G7MH-G2HX...

cabrita (>=2.2.2b1, <=2.2.2b2), cico (>=0.1.0, <=0.1.8) +4 more potentially affected by CVE-2026-42215 +1 more via gitpython (2.1.10)

gitpython PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - cabrita =2.2.2b1, =0.1.0, =0.1.0, =3.11.1, =0.9.0, =0.9.7.2 Source cves: CVE-2026-42215, CVE-2026-67325 Source advisory: OSV:GHSA-2F96-G7MH-G...

EUVD-2026-43956

pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDs...

aiodatastore (>=0.1.1, <=0.2.0), apache-airflow-providers-google (>=10.13.0, <=10.19.0) +65 more potentially affected by CVE-2026-59890 via setuptools (66.1.1)

setuptools PYPI version 66.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - aiodatastore =0.1.1, =10.13.0, =0.0.2, =0.1.0, =1.0.0, =0.16.0, =0.1.0, =0.1.0, =6.14.1, =8.1.1, =1.2.0, =0.0.2, =2.21.0, =2.25.0, =2.30.0...

koala-analytics (0.0.1), python-aemet (>=0.3.1rc0, <=0.3.1) potentially affected by CVE-2026-59890 via setuptools (47.3.1)

setuptools PYPI version 47.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - koala-analytics 0.0.1 - python-aemet =0.3.1rc0, =0.3.1 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

air-df (0.1.3), asrticlang (1.0.0) +31 more potentially affected by CVE-2026-59890 via setuptools (49.2.1)

setuptools PYPI version 49.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - air-df 0.1.3 - asrticlang 1.0.0 - azure-arm-nb-extensions =0.0.1, =0.1.0, =0.0.1, =2.0.4, =0.1.0, =0.0.1.9000, =1.3.9, =2.21.242, =0.5.3,...

clean-cybersource-rest-client-python (>=0.0.19, <=0.0.22), ozon-api-client (0.1.10) +2 more potentially affected by CVE-2026-59890 via setuptools (21.0.0)

setuptools PYPI version 21.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - clean-cybersource-rest-client-python =0.0.19, =3.8.0, =3.9.0 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

python-mu (>=1.0.1, <=1.0.3) potentially affected by CVE-2026-59890 via setuptools (18.4.0)

setuptools PYPI version 18.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - python-mu =1.0.1, =1.0.3 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

cvexplore (0.2.6.8), cyclonedx-python-lib (0.12.0) +8 more potentially affected by CVE-2026-59890 via setuptools (59.2.0)

setuptools PYPI version 59.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - cvexplore 0.2.6.8 - cyclonedx-python-lib 0.12.0 - eisenradio =0.8.6, =1.0.0, =2.6.3, =0.0.6, =5.1.0, =0.1.1, =0.1.1, =1.1.0, =1.2.1 Source...

CVE-2026-47425 Rattler vulnerable to entry-point path traversal in noarch:python install (arbitrary file write)

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...