allennlp (>=0.9.1.dev20200220, <=0.9.1.dev20200401), anilv-interpret-text (0.0.1) +9 more potentially affected by CVE-2024-12720 via transformers (2.4.1)

transformers PYPI version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - allennlp =0.9.1.dev20200220, =0.5.8, =0.1.2, =0.0.12b0, =1.0.1, =1.0.0.dev202005031000, =0.1.1, =0.2.2, =0.3.0, =0.5.11 Source cves:...

PYSEC-2026-1284 Vulnerable OpenSSL included in cryptography wheels

pyca/cryptography's wheels include a statically linked copy of OpenSSL. The versions of OpenSSL included in cryptography 42.0.0-44.0.0 are vulnerable to a security issue. More details about the vulnerability itself can be found in https://openssl-library.org/news/secadv/20250211.txt. If you are...

edgy-project (>=0.1.12, <=0.1.15), fallixy (0.18.1) +5 more potentially affected by CVE-2024-52804 via tornado (4.4.3)

tornado PYPI version 4.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on tornado and may be impacted: - edgy-project =0.1.12, =0.18.1, =0.1.2, =0.9.0, =1.2.1 - pymultitor 2.1.0 Source cves: CVE-2024-52804 Source advisory: OSV:PYSEC-2026-1975...

caluma (>=5.4.0, <=5.5.2), django-cms-forms (>=0.0.1, <=0.0.11) +2 more potentially affected by CVE-2024-45231 via django (2.2.11)

django PYPI version 2.2.11 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - caluma =5.4.0, =0.0.1, =0.3.10.56, =1.2.0, =1.2.2 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

seed-auth-api (>=0.9.0, <=0.9.2), umap-project (>=0.8.0, <=0.8.3) potentially affected by CVE-2024-45231 via django (1.10.5)

django PYPI version 1.10.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - seed-auth-api =0.9.0, =0.8.0, =0.8.3 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

django-rstblog (>=0.1.0, <=0.1.1), drf-user (0.0.1) +2 more potentially affected by CVE-2024-45231 via django (2.0.7)

django PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-rstblog =0.1.0, =0.1.1 - drf-user 0.0.1 - drfaddons 0.0.3 - umap-project 1.0.0rc1 Source cves: CVE-2024-45231 Source advisory:...

django-alexa (0.0.9), katka-core (>=0.5.0, <=0.8.0) +2 more potentially affected by CVE-2024-45231 via django (2.1.5)

django PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-alexa 0.0.9 - katka-core =0.5.0, =1.0.0rc9, =1.0.0 Source cves: CVE-2024-45231 Source advisory: OSV:PYSEC-2026-1297...

PYSEC-2026-1628 MindsDB Cross-site Scripting vulnerability

A cross-site scripting XSS vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whenever a user enumerates an ML Engine, database, project, or dataset containing arbitrary JavaScript code within the web UI...

py-ms (2.1.0), sprite-hoai-thu (0.0.0) +3 more potentially affected by CVE-2024-5569 via zipp (2.0.0)

zipp PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on zipp and may be impacted: - py-ms 2.1.0 - sprite-hoai-thu 0.0.0 - sprite-sheet-project =1.1.1, =0.0.0, =0.0.1 - spriteutil-kv 1.0.1 Source cves: CVE-2024-5569 Source advisory:...

Remote Code Execution in create_conda_env function in lollms

A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and pythonversion...

airflow-clickhouse-plugin (>=0.9.0, <=0.9.1), bigeye-airflow (>=0.1.20, <=0.1.21) +3 more potentially affected by CVE-2026-49487 via apache-airflow (2.4.3)

apache-airflow PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.9.0, =0.1.20, =2.4.3, =2.4.3.4 Source cves: CVE-2026-49487 Source advisory: OSV:GHSA-22HF-VX2V-GJFF...

airflow-clickhouse-plugin (>=0.9.0, <=0.9.1), bigeye-airflow (>=0.1.20, <=0.1.21) +3 more potentially affected by CVE-2026-48891 via apache-airflow (2.4.3)

apache-airflow PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.9.0, =0.1.20, =2.4.3, =2.4.3.4 Source cves: CVE-2026-48891 Source advisory: OSV:GHSA-3322-MJXH-9MP5...

airflow-clickhouse-plugin (>=0.9.0, <=0.9.1), bigeye-airflow (>=0.1.20, <=0.1.21) +3 more potentially affected by CVE-2026-48828 via apache-airflow (2.4.3)

apache-airflow PYPI version 2.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin =0.9.0, =0.1.20, =2.4.3, =2.4.3.4 Source cves: CVE-2026-48828 Source advisory: OSV:GHSA-563F-2439-RMQ4...

Malicious code in @bmg-web/bmg-snackbar (npm)

--- -= Per source details. Do not edit below this line.=-...

umap-project (0.8.3) potentially affected by CVE-2024-32879 via social-auth-app-django (1.1.0)

social-auth-app-django PYPI version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project 0.8.3 Source cves: CVE-2024-32879 Source advisory: OSV:PYSEC-2026-1931...

rest-social-auth (>=1.3.0, <=1.4.0), saltdash (>=0.9.1, <=0.9.5) +1 more potentially affected by CVE-2024-32879 via social-auth-app-django (2.1.0)

social-auth-app-django PYPI version 2.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - rest-social-auth =1.3.0, =0.9.1, =1.0.0rc1, =1.0.0rc8 Source cves: CVE-2024-32879 Source advisory: OSV:PYSEC-2026-19...

umap-project (>=0.8.0, <=0.8.2) potentially affected by CVE-2024-32879 via social-auth-app-django (1.0.1)

social-auth-app-django PYPI version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on social-auth-app-django and may be impacted: - umap-project =0.8.0, =0.8.2 Source cves: CVE-2024-32879 Source advisory: OSV:PYSEC-2026-1931...

PYSEC-2026-1763 PDM Trojan Lockfile

Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...

PDM Trojan Lockfile

SummaryIt's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. DetailsProject foo can be targeted by creating the project foo-2 and uploading the file...

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-it

Summaryhyper-bump-it reads a file glob pattern from the configuration file. That is combined with the project root directory to construct a full glob pattern that is used to find files that should be edited. These matched files should be contained within the project root directory, but that is no...