PYSEC-2026-1370 Fickling vulnerable to detection bypass due to "builtins" blindness

Fickling's assessment Fickling started emitting AST nodes for builtins imports in order to match them during analysis https://github.com/trailofbits/fickling/commit/9f309ab834797f280cb5143a2f6f987579fa7cdf. Original report Summary Fickling works by Pickle bytecode -- AST -- Security analysis...

fantasy-analysis (>=0.0.0, <=0.0.3), hc-nlp (>=0.1.0, <=0.2.0) +1 more potentially affected by CVE-2025-53000 via nbconvert (6.4.4)

nbconvert PYPI version 6.4.4 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - fantasy-analysis =0.0.0, =0.1.0, =2.4.0, =8.2.0 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...

allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2025-6051 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2025-6051 Source advisory: OSV:PYSEC-2026-1988...

aspect-based-sentiment-analysis (2.0.2), docly (>=0.0.4, <=0.2.1) +2 more potentially affected by CVE-2025-6051 via transformers (2.5.0)

transformers PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aspect-based-sentiment-analysis 2.0.2 - docly =0.0.4, =0.0.7b0, =0.1.9, =0.1.18 Source cves: CVE-2025-6051 Source advisory:...

PYSEC-2026-1670 MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

Summary The vulnerability allows any user to overwrite any files available under the account privileges of the running process. Details As part of static analysis, iOS MobSF supports loading and parsing statically linked libraries .a. When parsing such archives, the code extracts the embedded...

MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction

SummaryThe vulnerability allows any user to overwrite any files available under the account privileges of the running process. DetailsAs part of static analysis, iOS MobSF supports loading and parsing statically linked libraries .a. When parsing such archives, the code extracts the embedded objec...

allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2025-3777 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2025-3777 Source advisory: OSV:PYSEC-2026-1986...

Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Vulnerable MobSF Versions: = v4.3.2CVSS V4.0 Score: 8.6 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:L/SC:N/SI:N/SA:NDetails:A Stored Cross-Site Scripting XSS vulnerability has been identified in MobSF versions ≤ 4.3.2. The vulnerability arises from improper sanitization of user-supplied SVG...

allennlp (>=0.9.1.dev20200415, <=1.0.0rc4.dev20200511), allennlp-models (>=1.0.0rc2, <=1.0.0rc3) +6 more potentially affected by CVE-2025-1194 via transformers (2.8.0)

transformers PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200415, =1.0.0rc2, =0.1.9, =0.0.2, =0.1.0, =0.3.2 Source cves: CVE-2025-1194 Source advisory: OSV:PYSEC-2026-1984...

PYSEC-2026-1675 Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload

Vulnerable MobSF Versions: .svg This file becomes publicly accessible via the web interface at: http://127.0.0.1:8081/download/filename.svg If the SVG contains embedded JavaScript e.g., an XSS payload, accessing this URL via a browser leads to the execution of the script in the context of the Mob...

PYSEC-2026-1671 Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

Vulnerable MobSF Versions: = v4.3.2 Details: MobSF is a widely adopted mobile application security testing tool used by security teams across numerous organizations. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web application...

Mobile Security Framework (MobSF) Allows Web Server Resource Exhaustion via ZIP of Death Attack

Vulnerable MobSF Versions: = v4.3.2Details:MobSF is a widely adopted mobile application security testing tool used by security teams across numerous organizations. Typically, MobSF is deployed on centralized internal or cloud-based servers that also host other security tools and web applications...

cupyopt (0.14.11.1), fantasy-analysis (>=0.0.0, <=0.0.3) potentially affected by CVE-2024-8183 via prefect (0.14.11)

prefect PYPI version 0.14.11 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cupyopt 0.14.11.1 - fantasy-analysis =0.0.0, =0.0.3 Source cves: CVE-2024-8183 Source advisory: OSV:PYSEC-2026-1800...

cvapipe-analysis (0.1.4) potentially affected by CVE-2024-8183 via prefect (0.14.15)

prefect PYPI version 0.14.15 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cvapipe-analysis 0.1.4 Source cves: CVE-2024-8183 Source advisory: OSV:PYSEC-2026-1800...

aspect-based-sentiment-analysis (2.0.2), docly (>=0.0.4, <=0.2.1) +2 more potentially affected by CVE-2024-12720 via transformers (2.5.0)

transformers PYPI version 2.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - aspect-based-sentiment-analysis 2.0.2 - docly =0.0.4, =0.0.7b0, =0.1.9, =0.1.18 Source cves: CVE-2024-12720 Source advisory:...

PYSEC-2026-1673 MobSF Stored Cross-Site Scripting (XSS)

Product: MobSF Version: CFBundleIdentifier value. In the dynamicanalysis.html file you do not sanitize...

MobSF Stored Cross-Site Scripting (XSS)

Product: MobSFVersion: 4.3.1CWE-ID: CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'CVSS vector v.4.0: 8.5 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:NCVSS vector v.3.1: 8.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NDescription: Stored XSS in the iOS...

accomate (>=1.0.4, <=2.0.0.6), aind-analysis-arch-result-access (>=0.3.0, <=1.2.0) +267 more potentially affected by CVE-2024-5629 via pymongo (>=4.0.0, <=4.6.2)

pymongo PYPI version =4.0.0, =1.0.4, =0.3.0, =0.2.0, =0.1.0, =0.0.27, =0.3.1, =0.1.19, =1.9.0, =0.0.1a0, =0.0.2, =0.4.0, =0.1.0, =0.3.1 and more Source cves: CVE-2024-5629 Source advisory: OSV:PYSEC-2026-1826...

MAL-2026-10656 Malicious code in @pimy-b2cweb/frontend-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 52b7395e417c7c853087ef974cc074fc88ea814575ea3ff10ad627f90eb236ed The OpenSSF Package Analysis project identified '@pimy-b2cweb/frontend-lib' @ 99.99.99 npm as malicious. It is considered malicious because: - T...

Malicious code in zluri-ad-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b7a807f066f0255f7480ebd7d445043282260b464b0ef54a32a2d022c93bbf7 The package declares a preinstall hook node index.js that runs automatically on npm install. index.js requires os, dns, https, querystring, and the...