datajunction-server (>=0.0.1a104.dev0, <=0.0.259), pyutils-collection (>=0.1.4, <=0.1.5) +1 more potentially affected by CVE-2026-34073 via cryptography (45.0.0)

cryptography PYPI version 45.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - datajunction-server =0.0.1a104.dev0, =0.1.4, =2.0.3, =2.1.0 Source cves: CVE-2026-34073 Source advisory: OSV:GHSA-M959-CC7F-WV43...

no-cloud (0.0.8), nxviz (>=0.2.0, <=0.2.7) +4 more potentially affected by CVE-2026-34073 via cryptography (1.7.1)

cryptography PYPI version 1.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - no-cloud 0.0.8 - nxviz =0.2.0, =0.7.0, =1.6.0, =2.1.1rc5, =0.3.3, =0.6.0 Source cves: CVE-2026-34073 Source advisory:...

accomate (>=1.0.4, <=2.0.0.6), authx (>=0.5.0, <=0.5.1) +68 more potentially affected by CVE-2026-34073 via cryptography (37.0.2)

cryptography PYPI version 37.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - accomate =1.0.4, =0.5.0, =3.1.0, =1.1.0a0, =0.1.0, =1.3.697, =1.0.0, =0.0.3, =3.58.0, =4.4.3, =4.5.0 - downleth 1.0.0 and more Source...

aepp-sdk (>=0.18.0.5, <=0.25.0.1), bamboo-lib (>=0.0.37, <=0.0.39) +21 more potentially affected by CVE-2026-34073 via cryptography (2.3.0)

cryptography PYPI version 2.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aepp-sdk =0.18.0.5, =0.0.37, =0.1.1, =1.0.0, =0.2.0rc0, =0.0.3, =0.0.1, =1.0.0, =0.18.1, =0.7.8, =0.7.5, =1.1.2, =1.5.0 and more Source...

atlassian-jwt-auth (8.0.1), authx (>=0.0.3, <=0.0.5) +28 more potentially affected by CVE-2026-34073 via cryptography (3.1.1)

cryptography PYPI version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth 8.0.1 - authx =0.0.3, =0.9.1, =1.0.0, =0.8.2rc2, =3.20.0, =0.1.0a1, =0.0.1, =0.0.7, =0.0.5, =0.1.0a1, =0.1.0a4 and mo...

aidbbot (>=0.1.0, <=0.1.2), anythingpassword (>=0.2.1, <=0.2.3) +99 more potentially affected by CVE-2026-34073 via cryptography (44.0.2)

cryptography PYPI version 44.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - aidbbot =0.1.0, =0.2.1, =1.0.4, =0.1.0, =0.1.10, =0.2.35, =0.9.0, =0.1.0, =0.1.7, =2026.6.6, =0.1.0, =2.1.10, =0.0.20, =3.16.1148,...

atlassian-jwt-auth (>=3.2.1, <=3.3.0), biweeklybudget (>=0.7.1, <=1.0.0) +26 more potentially affected by CVE-2026-34073 via cryptography (2.1.4)

cryptography PYPI version 2.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - atlassian-jwt-auth =3.2.1, =0.7.1, =0.9.191, =0.7.0, =0.3.2, =0.9.7, =0.3.0, =0.4.1.dev20171202153821, =0.2.0, =3.0.0, =7.0.0, =0.5.7,...

antistasi-logbook (>=0.3.2, <=0.4.2), apilogicserver (>=5.2.15, <=16.0.5) +71 more potentially affected by CVE-2026-34073 via cryptography (36.0.1)

cryptography PYPI version 36.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - antistasi-logbook =0.3.2, =5.2.15, =0.2.0, =0.9.8b1, =0.0.1, =0.4.1rc0, =1.2.0, =0.3.7, =0.1.0, =0.1.20, =2.0.2, =0.2.1, =0.0.3, =0.0.7...

MAL-2026-2272 Malicious code in solana-api (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f0a22ac83bdfd88312e7d422a0e3c27531ccdb7a6c6e4afa1ae513bb9aecf41f Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files...

PT-2026-30785

After an API token exposure from an exploited Trivy dependency, two new releases of telnyx were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. Compromised versions execute code during importing the telnyx...

MAL-2026-2244 Malicious code in fluxhttp (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2669b72303bd592ba1633febc04bca1f0a8804d8546baf21b5f3f12baaa80f29 Malicious clone of a legitimate package. When using it, the code attempts to download and execute remote code. In on of the incarnations, the malicious code wa...

MAL-2026-2239 Malicious code in chaostoolkit-turbulence (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0d12e5d6a53ae410fe90d76b8da4f9f117a8891e73a678c5b5f49059ad31fa6b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in fairness-bias (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c76439565a70fd014098388baf5dd9a679f90be992102ba689fc0b7d6d3db352 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

PT-2026-30376

After an API Token exposure from an exploited trivy dependency, two new releases of litellm were uploaded to PyPI containing automatically activated malware, harvesting sensitive credentials and files, and exfiltrating to a remote API. Anyone who has installed and run the project should assume an...

Malicious code in target-iceberg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 95793a2b88fbc5bdaa5d42387e7472b796fe34c61959909a928f534137c101d9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-2138 Malicious code in open-vp-cal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ab8c06b5d7e9b98d62708ab7377d9e18a214e884c69b0c7217979121aed06917 When executing the module, the code installs a package from a remote location. The remote package contains malicious code exfiltrating selected env variables a...

MAL-2026-2120 Malicious code in logutilkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25a26f2dc6e0a8e2ba3bd43492fbffa597b39065e3f3378ea976dcabddf8fbf8 Malicious clone of a legitimate package. When using it, the code attempts to download and execute remote code. In on of the incarnations, the malicious code wa...

MAL-2026-2084 Malicious code in license-utils-kit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 eb0116c55754c947c819c966f213a99864511536a414619cf3154b89be59f9e8 Malicious clone of legitimate "license" package. When using the findbykey function, the malicious code from strongly obfuscated files is loaded. It then at lea...

MAL-2026-2006 Malicious code in mangrove-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 d6714958f20775c2347e9c8b606d1de2e28ed29fe4b1a82261ca4fb966fc20fa During installation, package attempts to modify LLM configuration files to provide a backdoor instruction for further control over an AI agent. --- Category:...

MAL-2026-1988 Malicious code in dataflux-pytorch (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 486e56ad4de2a59b9c8890d854505075b556ca6920be97f850a14c7d648f7f3b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...