aigarmic (>=1.0.0, <=1.0.1), albedo (0.1.0) +130 more potentially affected by CVE-2026-9335 via keras (2.14.0)

keras PYPI version 2.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - aigarmic =1.0.0, =0.40.4, =0.0.0, =0.30.5, =0.3.0, =0.1.0, =0.1.0, =3.0.2, =2.0.0, =1.0.0rc1, =0.0.7, =1.3.1 and more Source cves: CVE-2026-9335 Sour...

cde (>=0.1.0, <=0.2.0.1), deeppavlov (>=0.0.5.1, <=0.0.5.3) potentially affected by CVE-2026-9335 via keras (2.1.2)

keras PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - cde =0.1.0, =0.0.5.1, =0.0.5.3 Source cves: CVE-2026-9335 Source advisory: OSV:GHSA-M8WH-29WM-52MV...

a2grunnerp (>=0.1.0, <=0.1.8), a62-emotion (>=0.9.2, <=0.11.4) +1387 more potentially affected by CVE-2026-9335 via keras (>=1.2.1, <=3.14.1)

keras PYPI version =1.2.1, =0.1.0, =0.9.2, =1.0.1, =0.1.0.dev2, =6.6.0, =0.1.2, =1.1.2, =0.1.0, =0.1.0, =0.3.3 - adversarial-attacks-white-black-box 0.1.7 and more Source cves: CVE-2026-9335 Source advisory: MEND:CVE-2026-9335...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +761 more potentially affected by CVE-2026-67326 via gitpython (>=3.0.0, <=3.1.49)

gitpython PYPI version =3.0.0, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

freedom (>=0.0.0_21_g3038804_dirty, <=0.0.1) potentially affected by CVE-2026-67326 via gitpython (0.3.4)

gitpython PYPI version 0.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - freedom =0.0.021g3038804dirty, =0.0.1 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

gpopt (>=0.1.0, <=0.2.3) potentially affected by CVE-2026-67326 via gitpython (0.3.6)

gitpython PYPI version 0.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - gpopt =0.1.0, =0.2.3 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

aws-client (>=0.10.0, <=0.11.0), git-repo (>=1.7.0, <=1.7.1) potentially affected by CVE-2026-67326 via gitpython (2.0.6)

gitpython PYPI version 2.0.6 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - aws-client =0.10.0, =1.7.0, =1.7.1 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-67326 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

cabrita (>=2.2.2b1, <=2.2.2b2), cico (>=0.1.0, <=0.1.8) +4 more potentially affected by CVE-2026-67326 via gitpython (2.1.10)

gitpython PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - cabrita =2.2.2b1, =0.1.0, =0.1.0, =3.11.1, =0.9.0, =0.9.7.2 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

arca (>=0.1.0a0, <=0.1.0), mali (>=0.2775.0, <=0.4018.0) +4 more potentially affected by CVE-2026-67326 via gitpython (2.1.7)

gitpython PYPI version 2.1.7 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - arca =0.1.0a0, =0.2775.0, =0.2304.0, =0.2304.0, =0.1.0a1, =1.0.0, =1.0.6 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

android-category (>=0.0.3, <=0.0.4), ant-cli (0.0.1) +34 more potentially affected by CVE-2026-67326 via gitpython (2.1.11)

gitpython PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - android-category =0.0.3, =0.0.2, =0.3.0, =0.0.2, =0.12.4rc1, =0.1.26.dev1542857464, =0.2.3, =0.1.0, =0.0.1, =1.2.5, =0.1.0.0b1, =0.1.3 and mo...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +914 more potentially affected by CVE-2026-67325 via gitpython (>=0.3.4, <=3.1.50)

gitpython PYPI version =0.3.4, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-67325 Source advisory: MEND:CVE-2026-67325...

CVE-2026-67338: Improper Neutralization of Encoded URI Schemes in a Web Page

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

aait (>=2.0.0, <=2.3.14), accutuning-helpers (>=1.0.32, <=1.0.33) +78 more potentially affected by CVE-2026-68770 via sentence-transformers (>=5.0.0, <=5.5.1)

sentence-transformers PYPI version =5.0.0, =2.0.0, =1.0.32, =0.1.0, =2026.5.22, =3.1.0, =3.9.11, =0.10.0, =0.4.13, =0.1.3, =0.1.18, =0.2.1a0, =0.1.2, =0.1.0, =0.1.1 and more Source cves: CVE-2026-68770 Source advisory: GHSA-JHR6-GM9C-RQJV...

aces-metric (>=0.0.3, <=0.0.4), adv-bible-search (>=0.1.0, <=0.1.1) +154 more potentially affected by CVE-2026-68770 via sentence-transformers (2.2.2)

sentence-transformers PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - aces-metric =0.0.3, =0.1.0, =0.1.5, =1.2.3, =0.8.0, =1.0.1, =0.0.5.dev0, =0.1.0, =0.1.5.1, =0.1.1, =0.0.2, =0.0.5,...

compcor (>=1.0.5, <=1.0.6) potentially affected by CVE-2026-68770 via sentence-transformers (2.2.1)

sentence-transformers PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - compcor =1.0.5, =1.0.6 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

agent-actions (>=0.1.0, <=0.1.3), agent-brain-cli (>=5.0.0, <=10.7.0) +171 more potentially affected by CVE-2026-68770 via sentence-transformers (3.4.1)

sentence-transformers PYPI version 3.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - agent-actions =0.1.0, =5.0.0, =5.0.0, =0.1.0, =0.1.1, =0.1.6, =3.1.8, =0.4.0, =0.6.3 - alithia 0.1.4 -...

amapy-server (>=1.0.1, <=1.0.2), arm-rag-testing (>=0.0.1, <=7.7.9) +16 more potentially affected by CVE-2026-68770 via sentence-transformers (3.2.1)

sentence-transformers PYPI version 3.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - amapy-server =1.0.1, =0.0.1, =0.8.26, =0.0.1, =0.1.1, =0.1.5, =0.5.0, =0.1.3, =1.0.2, =1.0.11 and more Source cves:...

airunner (>=3.0.0, <=3.1.7), anovos (>=0.2.0, <=1.0.1) +55 more potentially affected by CVE-2026-68770 via sentence-transformers (3.0.1)

sentence-transformers PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - airunner =3.0.0, =0.2.0, =0.7.128, =0.0.4, =0.3.3, =0.2.0, =0.0.2, =2.0.0, =0.2.11, =0.2.1.dev0, =0.2.1.dev0, =0.0.71,...