Amazon Linux 2 : python, --advisory ALAS2-2026-3810 (ALAS-2026-3810)

The version of python installed on the remote host is prior to 2.7.18-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3810 advisory. When using the tarfile module with a file opened in streaming mode mode=r| the tarfile module did not properly handle EOF, making...

msticpy v3.0.2

MSTIC Jupyter and Python Security Tools Microsoft Threat Intelligence Python Security Tools. msticpy is a library for InfoSec investigation and hunting in Jupyter Notebooks. It includes functionality to: query log data from multiple sources enrich the data with Threat Intelligence, geolocations a...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-59199 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-59199 Source advisory: OSV:GHSA-6R8X-57C9-28J4...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-59197 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-59197 Source advisory: OSV:GHSA-XJ96-63GP-2GMR...

EUVD-2026-42334

Mistune: XSS via unescaped class option in Admonition directive...

abracadabra (>=0.0.0, <=0.0.7), acclimatise (>=0.0.18, <=1.2.0) +419 more potentially affected by CVE-2026-59925 via mistune (0.8.4)

mistune PYPI version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on mistune and may be impacted: - abracadabra =0.0.0, =0.0.18, =2.0.0.post1, =0.3.0, =1.0.0, =1.3.4, =1.0.47, =1.0.66, =0.1.0, =0.1.0, =0.1.16, =0.18.3, =1.0.0, =2.2.0 and more...

EUVD-2026-42339

Mistune directives/include: mutual .. include:: recursion crashes the renderer with RecursionError, denial of service via two attacker-controlled markdown files...

dcicsnovault (>=2.0.0b4, <=4.0.0b2), django-dynamic-scraper (>=0.11.4, <=0.13.1) +12 more potentially affected by CVE-2026-55380 via pillow (3.4.2)

pillow PYPI version 3.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - dcicsnovault =2.0.0b4, =0.11.4, =0.18.1, =0.6.12a2, =0.9.0, =0.2.1, =0.0.3, =1.6.0, =1.4.0, =1.12.0 - yulelog 0.0.3 Source cves: CVE-2026-55380 Sour...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-55380 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-55380 Source advisory: OSV:GHSA-PHJ9-MV4W-65PM...

11x-wagtail-blog (>=0.0.0, <=0.2.0), 3lc (>=2.12.0, <=2.22.0) +2455 more potentially affected by CVE-2026-55380 via pillow (10.4.0)

pillow PYPI version 10.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - 11x-wagtail-blog =0.0.0, =2.12.0, =0.1.0, =0.1.3, =0.3.0, =0.1.3, =0.1.0, =0.1.4, =0.3.0, =0.2.1, =0.2.0, =0.0.1, =0.0.0, =0.0.9 and more Source...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-55379 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-55379 Source advisory: OSV:GHSA-45HQ-CXWH-F6VC...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-54060 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-54060 Source advisory: OSV:GHSA-5X94-69RX-G8H2...

aioload (0.4.0), amazoncaptcha (0.5.0) +67 more potentially affected by CVE-2026-54059 via pillow (8.0.1)

pillow PYPI version 8.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aioload 0.4.0 - amazoncaptcha 0.5.0 - apricopt =0.0.1a1.dev5, =0.1.0, =0.1.7, =0.1.3, =1.37.0, =1.38.1 - blendedux 0.0.2 and more Source cves:...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-54059 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-54059 Source advisory: OSV:GHSA-8V84-F9PQ-WR9X...

abraia (0.9.4), agave-pyclient (>=1.2.3, <=1.2.4) +78 more potentially affected by CVE-2026-54059 via pillow (9.0.0)

pillow PYPI version 9.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - abraia 0.9.4 - agave-pyclient =1.2.3, =3.2.0, =0.3.2, =0.23.0, =0.4.0, =0.8.0, =0.1.2, =1.39.0, =1.49.0.post1 and more Source cves: CVE-2026-54059...

addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +209 more potentially affected by CVE-2026-54059 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

aichatbot (0.0.1), aiqc (>=2.1.0, <=7.1.5) +53 more potentially affected by CVE-2026-54058 via pillow (8.1.2)

pillow PYPI version 8.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aichatbot 0.0.1 - aiqc =2.1.0, =0.0.2, =0.0.1, =0.14.0, =0.14.0, =0.0.0a1, =2.0.1, =0.2.0, =0.0.2, =3.0.8rc6, =3.0.8rc7 - django-image-assets 0.2.0...

helperpy (>=0.0.1, <=0.0.4), higlass-python (0.4.6) +4 more potentially affected by CVE-2026-54058 via pillow (8.3.0)

pillow PYPI version 8.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - helperpy =0.0.1, =0.0.2, =0.0.22 - seleniumbase 1.63.14 - workflow-nodes 0.7.0 Source cves: CVE-2026-54058 Source advisory: OSV:GHSA-62P4-GMF7-7G93...

Malicious code in trongridmy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 17d343778bc5b25dea876fcf592e8e0267c3ec189ea931a6c73ab536894aabee Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

Malicious code in trongrider (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0766a0a8222cb9a7a188ad8c88daf73b102036079be073f01661cde1622b99b5 The package exposes a function permprivatekey that POSTs the caller-supplied TRON private key as JSON to the hardcoded URL...