11887 matches found
io4it (>=2.0.0, <=3.0.4.1), leettools (>=1.0.14, <=1.0.17) potentially affected by CVE-2020-14343 +1 more via docling-core (>=2.21.1, <=2.26.3)
docling-core PYPI version =2.21.1, =2.0.0, =1.0.14, =1.0.17 Source cves: CVE-2020-14343, CVE-2026-24009 Source advisory: SNYK:PYTHON-DOCLINGCORE-15091522...
Malicious code in sympy-dev (PyPI)
Package downloads and executes code from remote servers, indicating malicious behavior. Multiple files and IPs involved. Package impersonates popular sympy package...
EUVD-2026-3707
Malicious code in anduril-lattice-sdk-grpc-python PyPI...
shynabot (0.0.1), shynataskmanager (0.0.1) potentially affected by CVE-2026-23842 via chatterbot (1.0.4)
chatterbot PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on chatterbot and may be impacted: - shynabot 0.0.1 - shynataskmanager 0.0.1 Source cves: CVE-2026-23842 Source advisory: OSV:GHSA-V4W8-49PV-MF72...
shynabot (0.0.1), shynataskmanager (0.0.1) potentially affected by CVE-2026-23842 via chatterbot (1.0.4)
chatterbot PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on chatterbot and may be impacted: - shynabot 0.0.1 - shynataskmanager 0.0.1 Source cves: CVE-2026-23842 Source advisory: GHSA-V4W8-49PV-MF72...
agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +4 more potentially affected by CVE-2026-22219 via chainlit (>=2.4.400, <=2.6.3)
chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-22219 Source advisory: GHSA-2G59-M95P-PGFQ...
agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +4 more potentially affected by CVE-2026-22219 via chainlit (>=2.4.400, <=2.6.3)
chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-22219 Source advisory: OSV:GHSA-2G59-M95P-PGFQ...
dictatorgenai (0.1.0), lit-data-layers (>=0.1.0, <=0.1.4) potentially affected by CVE-2026-22218 via chainlit (1.3.2)
chainlit PYPI version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - dictatorgenai 0.1.0 - lit-data-layers =0.1.0, =0.1.4 Source cves: CVE-2026-22218 Source advisory: OSV:PYSEC-2026-598...
agentic-kernel (>=0.1.0, <=0.1.10), boterview (1.3.0) +4 more potentially affected by CVE-2026-22218 via chainlit (>=2.4.400, <=2.6.3)
chainlit PYPI version =2.4.400, =0.1.0, =0.1.1, =0.1.0, =0.2.2, =0.2.4 Source cves: CVE-2026-22218 Source advisory: OSV:PYSEC-2026-598...
edubotics-core (>=0.1.3, <=0.1.7) potentially affected by CVE-2026-22218 via chainlit (1.2.0)
chainlit PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - edubotics-core =0.1.3, =0.1.7 Source cves: CVE-2026-22218 Source advisory: OSV:PYSEC-2026-598...
CVE-2025-56005: Deserialization of Untrusted Data
An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in the yacc function. This parameter accepts a .pkl file that is deserialized with pickle.load without validation. Because pickle allows execution of embedded...
CVE-2025-56005
An undocumented and unsafe feature in the PLY Python Lex-Yacc library 3.11 allows Remote Code Execution RCE via the picklefile parameter in the yacc function. This parameter accepts a .pkl file that is deserialized with pickle.load without validation. Because pickle allows execution of embedded...
Malicious code in medifile (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5c005d95a9b1b91118e9306168ce69163190184714fe53c65b7ba716e867c8da Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
akasha-terminal (>=0.8.0, <=0.8.72), auralis (>=0.1.0, <=0.2.7) +17 more potentially affected by CVE-2025-15536 via opencc (>=1.1.1, <=1.1.9)
opencc PYPI version =1.1.1, =0.8.0, =0.1.0, =1.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.1.2 - senti-c 0.0.4 and more Source cves: CVE-2025-15536 Source advisory: SNYK:PYTHON-OPENCC-15874419...
Malicious code in legendevil1 (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3188a850ecb974606264f28634afaca67ec2f49c1c759cf590aa39ba19e50452 Package is designed to download and execute a remote script, which then downloads and runs a malicious executable --- Category: MALICIOUS - The campaign has...
swarm-plus (>=0.0.0.1, <=0.1.0) potentially affected by CVE-2025-68492 via chainlit (1.3.1)
chainlit PYPI version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on chainlit and may be impacted: - swarm-plus =0.0.0.1, =0.1.0 Source cves: CVE-2025-68492 Source advisory: OSV:GHSA-V492-6XX2-P57G...
EUVD-2026-2012
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, there is a path traversal vulnerability exists in GuardDog's safeextract function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite...
PT-2026-2804
Name of the Vulnerable Software and Affected Versions GuardDog versions prior to 2.7.1 Description GuardDog, a CLI tool for identifying malicious PyPI packages, contains a flaw in its safe extract function. This function does not validate the size of decompressed files when handling ZIP archives,...
CVE-2026-22870: Improper Handling of Highly Compressed Data (Data Amplification)
GuardDog is a CLI tool to identify malicious PyPI packages. Prior to 2.7.1, GuardDog's safeextract function does not validate decompressed file sizes when extracting ZIP archives wheels, eggs, allowing attackers to cause denial of service through zip bombs. A malicious package can consume gigabyt...
