@bitblit/ratchet-aws-node-only (>=6.1.226-alpha, <=6.1.231-alpha), @bitblit/ratchet-epsilon-common (>=6.1.226-alpha, <=6.1.231-alpha) +20 more potentially affected by unknown CVE via nodemailer (>=10.0.0, <=10.0.3)

nodemailer NPM version =10.0.0, =6.1.226-alpha, =6.1.226-alpha, =6.1.226-alpha, =1.3.1, =12.4.0-depup.0, =39.2.0, =0.3.0, =0.3.0, =1.14.1, =12.4.0, =0.3.0, =0.4.3 and more Source cves: unknown CVE Source advisory: GHSA-V53P-9FQP-M79J...

mbq-tokens (0.0.1), twilio (>=6.4.2a1, <=6.5.0) potentially affected by CVE-2026-102269 via pyjwt (1.5.0)

pyjwt PYPI version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - mbq-tokens 0.0.1 - twilio =6.4.2a1, =6.5.0 Source cves: CVE-2026-102269 Source advisory: OSV:GHSA-HXM8-2XGR-2P9M...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-102269 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-102269 Source advisory: GHSA-HXM8-2XGR-2P9M...

dbnd-datastage-monitor (>=1.0.4.1, <=1.0.4.3), dkcloudcommand (>=1.0.132rc1, <=1.1.270rc1) +5 more potentially affected by CVE-2026-102268 via pyjwt (1.6.1)

pyjwt PYPI version 1.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - dbnd-datastage-monitor =1.0.4.1, =1.0.132rc1, =0.2.1, =0.1.1rc0, =0.5.3, =1.2.0rc1, =0.0.3a0, =0.1.10 Source cves: CVE-2026-102268 Source advisory:...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-102268 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-102268 Source advisory: OSV:GHSA-FFC3-869F-JXW9...

djangorestframework-jwt (>=1.0.2, <=1.1.1) potentially affected by CVE-2026-102268 via pyjwt (0.3.2)

pyjwt PYPI version 0.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - djangorestframework-jwt =1.0.2, =1.1.1 Source cves: CVE-2026-102268 Source advisory: OSV:GHSA-FFC3-869F-JXW9...

atlassian-jwt-auth (>=2.7.0, <=3.0.0), credential-shield-fdelgados (>=0.0.1, <=2.0.0) +11 more potentially affected by CVE-2026-102267 via pyjwt (1.4.2)

pyjwt PYPI version 1.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - atlassian-jwt-auth =2.7.0, =0.0.1, =0.5.0, =0.1.1, =1.0.0a2, =0.4.15, =0.1.1, =0.0.1, =0.9.0, =5.4.0, =0.8.0, =0.3.3, =0.4.0 Source cves:...

django-googleauth-ng (>=2.1.0, <=2.3.0) potentially affected by CVE-2026-102267 via pyjwt (0.4.1)

pyjwt PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - django-googleauth-ng =2.1.0, =2.3.0 Source cves: CVE-2026-102267 Source advisory: OSV:GHSA-9V7F-9G4P-FFGJ...

airavata-custos-portal (>=0.0.1, <=0.0.6), airavata-custos-portal-sdk (0.0.1) +1 more potentially affected by CVE-2026-102267 via pyjwt (0.4.3)

pyjwt PYPI version 0.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - airavata-custos-portal =0.0.1, =1.2.0, =1.3.2 Source cves: CVE-2026-102267 Source advisory: OSV:GHSA-9V7F-9G4P-FFGJ...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.7) +1689 more potentially affected by CVE-2026-102267 via pyjwt (>=2.0.0a2, <=2.13.0)

pyjwt PYPI version =2.0.0a2, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.26, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-102267 Source advisory: GHSA-9V7F-9G4P-FFGJ...

360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +197 more potentially affected by CVE-2026-102272 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =3.8.0, =3.9.3 and...

agilicus (>=1.5.1, <=1.6.1), akeyra (>=0.0.1, <=0.1.2) +30 more potentially affected by CVE-2026-101917 via pyjwt (1.5.3)

pyjwt PYPI version 1.5.3 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - agilicus =1.5.1, =0.0.1, =4.10.0, =4.10.0, =4.10.0, =4.10.0, =4.10.0, =4.10.0, =4.10.0, =4.10.0, =4.10.0, =4.7.0, =2.1.0, =1.10.0.1b0, =0.4.8,...

aaa-ml-datasets-course (1.0.0), aerocm (0.1.0b0) +148 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.0.0, <=4.5.8)

jupyterlab PYPI version =4.0.0, =0.5.5, =2.0.0, =4.33.0, =1.0.1, =0.1.0, =1.6.4b1, =0.0.1, =1.8.2, =0.0.1, =0.3.1, =0.1.0, =0.1.4 - cad-viewer-widget 3.0.2 and more Source cves: CVE-2026-102904 Source advisory: SNYK:PYTHON-JUPYTERLAB-20335547...

foxbms-fox-cli (1.12.0), ironoc-pytest-conor-heffron (>=2.3.4, <=2.5.1) +8 more potentially affected by CVE-2026-102938 via virtualenv (>=21.1.0, <=21.7.4)

virtualenv PYPI version =21.1.0, =2.3.4, =0.1.4, =0.1.0, =0.3.1, =0.0.3, =1.5.1, =1.1.0, =1.0.0, =2.0.0, =2.0.1 Source cves: CVE-2026-102938 Source advisory: SNYK:PYTHON-VIRTUALENV-20335493...

Malicious code in @rutxploit-sec/waves-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bdeb076eee35958fd0520e7f9cca9d361c47f02cb81c73288609ecdfb60bdbb1 @rutxploit-sec/waves-icons is a dependency-confusion proof-of-concept squatting the internal scope name @waves/icons. Its package.json declares a...

MAL-2026-17289 Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to...

Malicious code in @rutxploit-sec/subsplash-google-tag-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8fe2c746dc5c09bc67257fd4eba671824806c9080b7ca94949e45175deb03b8d package.json declares a preinstall script that executes inline Node code reading os.hostname and os.userInfo.username and issuing an HTTP GET to...

Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

MAL-2026-17288 Malicious code in @rutxploit-sec/subsplash-canny (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dc1ebadea2eb63a0fc7cf7446e36a589c5b87fc7d28e68b68145b98577107ebb npm package @rutxploit-sec/subsplash-canny declares a preinstall lifecycle script that runs node -e inline code reading os.hostname and...

Malicious code in @rutxploit-sec/waves-button-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435937e521ca52ff4d99fd276136aff40364c4a88a3a4677cecf390c9d9bb600 @rutxploit-sec/[email protected] auto-executes host-identifier exfiltration on both npm install and require. package.json declares a preinstall...