9443 matches found
ROOT-APP-PYPI-CVE-2026-59204 CVE-2026-59204 in pillow - Patched by Root
Root has patched CVE-2026-59204 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-34993 CVE-2026-34993 in aiohttp - Patched by Root
Root has patched CVE-2026-34993 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-47265 CVE-2026-47265 in aiohttp - Patched by Root
Root has patched CVE-2026-47265 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-54280 CVE-2026-54280 in aiohttp - Patched by Root
Root has patched CVE-2026-54280 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root
Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-28802 CVE-2026-28802 in Authlib - Patched by Root
Root has patched CVE-2026-28802 in the Authlib package for Root:PyPI. Multiple fixed versions available...
MAL-2026-11429 Malicious code in trongriden (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 dfb2a16e0023940b622e66acf21c1597d4127d94fb730610f509960e49754c3f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
EUVD-2026-51849
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338
CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...
MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 0f81b904b849df393cbe5c34f952af65d8b28e0797e33d62cf964df77d4929c7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
ROOT-APP-PYPI-CVE-2023-44271 CVE-2023-44271 in rootio-pillow - Patched by Root
Root has patched CVE-2023-44271 in the rootio-pillow package for Root:PyPI. Multiple fixed versions available...
MAL-2026-11413 Malicious code in reguestsc (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 20e4ae2ce79408a65e9b4bb348c2d69e20eb6072e3641531e2ec5773f1bbddd6 Clones of a legitimate library with injected code downloading and executing a malicious executable on import. Dynamic analysis identified it as salatstealer. -...
ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in rootio-langchain - Patched by Root
Root has patched GHSA-gr75-jv2w-4656 in the rootio-langchain package for Root:PyPI. Multiple fixed versions available...
MAL-2026-11197 Malicious code in ai-perf-toolkit (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 41d25387636c9b0b89a404304d079c30ad28bda33bb551e551cb9e15a75c00ba During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed. --- Category: MALICIOUS - The campaign...
ROOT-APP-PYPI-CVE-2023-49082 CVE-2023-49082 in rootio-aiohttp - Patched by Root
Root has patched CVE-2023-49082 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...
MAL-2026-11051 Malicious code in trongridy (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 a437be8ac21a8c375aeb02c4ab825bce027392f95aa356491950536454d2bf58 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
Malicious code in intel-cicd-repo-infrastructure (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...