CVE-2026-54275 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-13.0, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, py3.13-scanner-test-libraries-aiohttp, metaflow-service-fips, authentik-fips, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, airflow, authentik, tritonserver-backend-vllm-cuda-13.0,...

CVE-2026-48524 vulnerabilities

Vulnerabilities for packages: superset-fips, openstack-keystone-2025.1, ggshield, openstack-placement-2025.1, openstack-horizon-2025.2, openstack-glance-2025.2-fips, openstack-horizon-2026.1, metaflow-service-fips, openstack-placement-2025.1-fips, airflow-postgres-fips, wazuh-manager,...

CVE-2026-54273 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-13.0, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, py3.13-scanner-test-libraries-aiohttp, metaflow-service-fips, authentik-fips, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, airflow, authentik, tritonserver-backend-vllm-cuda-13.0,...

CVE-2026-48526 vulnerabilities

Vulnerabilities for packages: superset-fips, openstack-keystone-2025.1, ggshield, openstack-placement-2025.1, openstack-horizon-2025.2, openstack-glance-2025.2-fips, openstack-horizon-2026.1, metaflow-service-fips, openstack-placement-2025.1-fips, airflow-postgres-fips, wazuh-manager,...

CVE-2026-54278 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-13.0, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, py3.13-scanner-test-libraries-aiohttp, metaflow-service-fips, authentik-fips, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, airflow, authentik, tritonserver-backend-vllm-cuda-13.0,...

CVE-2026-54279 vulnerabilities

Vulnerabilities for packages: py3-vllm-cuda-13.0, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, py3.13-scanner-test-libraries-aiohttp, metaflow-service-fips, authentik-fips, tritonserver-backend-vllm-cuda-12.9, mlflow-fips, airflow, authentik, tritonserver-backend-vllm-cuda-13.0,...

image-crawl (0.1.0), metaflow-card-notebook (1.0.0) +2 more potentially affected by CVE-2025-53000 via nbconvert (6.1.0)

nbconvert PYPI version 6.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - image-crawl 0.1.0 - metaflow-card-notebook 1.0.0 - omdenalore 0.2.10 - vimms 2.0.1 Source cves: CVE-2025-53000 Source advisory:...

garmindb (3.2.8), metaflow-card-notebook (>=1.0.2, <=1.0.5) potentially affected by CVE-2025-53000 via nbconvert (6.4.1)

nbconvert PYPI version 6.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - garmindb 3.2.8 - metaflow-card-notebook =1.0.2, =1.0.5 Source cves: CVE-2025-53000 Source advisory: OSV:GHSA-XM59-RQC7-HHVF...

Malicious code in nflx-metaflow (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1905 Malicious code in nflx-metaflow (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in nflx-metaflow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d317c47382e978342b2098c06b1d0ff46acfefdc5a5ed6ce2b531b1f5b24fe4 Packages are designed to collect basic info about the user when importing them, and have no other purpose. While they claim to do so, some packages from the sa...

MAL-2025-1984 Malicious code in nflx-metaflow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d317c47382e978342b2098c06b1d0ff46acfefdc5a5ed6ce2b531b1f5b24fe4 Packages are designed to collect basic info about the user when importing them, and have no other purpose. While they claim to do so, some packages from the sa...

Malicious code in companyx-metaflow (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ec7089679a9c5637609b94cb606e78aa693a8bd224ba334ca46b3f48c54169c1 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in metaflow-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 935f6862330ac0c1176e0f24726b106d01156e8272de9955b5fe802e283eb254 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-590 Malicious code in metaflow-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 935f6862330ac0c1176e0f24726b106d01156e8272de9955b5fe802e283eb254 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview metaflow-ui is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...