MAL-2026-14588 Malicious code in yaml-report-formatter (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd762621d7d279a25921e8f8c7d1a7e8040948bd3ac445ca9cabd8f200ce36f0 Package presents itself as a YAML report formatter but its top-level src/yamlreportformatter/init.py starts a daemon thread on import that reads a...

ROOT-APP-PYPI-CVE-2026-54284 CVE-2026-54284 in sqlparse - Patched by Root

Root has patched CVE-2026-54284 in the sqlparse package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-27JP-WM6Q-GP25 GHSA-27jp-wm6q-gp25 in sqlparse - Patched by Root

Root has patched GHSA-27jp-wm6q-gp25 in the sqlparse package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-4340 CVE-2024-4340 in sqlparse - Patched by Root

Root has patched CVE-2024-4340 in the sqlparse package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-62QF-JCQ8-8GXW GHSA-62qf-jcq8-8gxw in sqlparse - Patched by Root

Root has patched GHSA-62qf-jcq8-8gxw in the sqlparse package for Root:PyPI. Multiple fixed versions available...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +52 more potentially affected by unknown CVE via monai (>=0.4.0, <=1.5.2)

monai PYPI version =0.4.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.1.0, =0.0.5, =0.1.0, =0.0.3, =6.0.0rc1, =6.1.1 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0032...

cforge (>=1.0.0b1, <=1.0.0b6) potentially affected by unknown CVE via mcp-contextforge-gateway (1.0.0b2)

mcp-contextforge-gateway PYPI version 1.0.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on mcp-contextforge-gateway and may be impacted: - cforge =1.0.0b1, =1.0.0b6 Source cves: unknown CVE Source advisory: MEND:WS-2026-0038...

gulp-dissect (>=1.0.1, <=1.0.3), lazy-crawler (>=2.0.0, <=2.0.1) +1 more potentially affected by CVE-2026-55558 via aiosmtplib (>=5.0.0, <=5.1.0)

aiosmtplib PYPI version =5.0.0, =1.0.1, =2.0.0, =1.7.14, =1.7.605 Source cves: CVE-2026-55558 Source advisory: GHSA-VXJ7-4XRP-5VR4...

async-notify (>=0.8.0, <=0.8.11), navigator-api (>=2.3.10, <=2.3.17) potentially affected by CVE-2026-55558 via aiosmtplib (2.0.0)

aiosmtplib PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-notify =0.8.0, =2.3.10, =2.3.17 Source cves: CVE-2026-55558 Source advisory: OSV:GHSA-VXJ7-4XRP-5VR4...

async-sender (1.3.3) potentially affected by CVE-2026-55558 via aiosmtplib (1.0.4)

aiosmtplib PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-sender 1.3.3 Source cves: CVE-2026-55558 Source advisory: OSV:GHSA-VXJ7-4XRP-5VR4...

asphalt-mailer (4.0.0), async-sender (2.0.1) +13 more potentially affected by CVE-2026-55558 via aiosmtplib (2.0.2)

aiosmtplib PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - asphalt-mailer 4.0.0 - async-sender 2.0.1 - axdocsystem =0.1.24, =1.2.3, =0.9.0b19, =0.0.1, =0.1.3, =2.1.5, =2.2.1, =0.1.0, =0.1.5, =0.1.0,...

gulp-dissect (>=1.0.1, <=1.0.3), lazy-crawler (>=2.0.0, <=2.0.1) +1 more potentially affected by CVE-2026-55558 via aiosmtplib (>=5.0.0, <=5.1.0)

aiosmtplib PYPI version =5.0.0, =1.0.1, =2.0.0, =1.7.14, =1.7.605 Source cves: CVE-2026-55558 Source advisory: OSV:GHSA-VXJ7-4XRP-5VR4...

async-sender (1.3.4) potentially affected by CVE-2026-55558 via aiosmtplib (1.0.5)

aiosmtplib PYPI version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-sender 1.3.4 Source cves: CVE-2026-55558 Source advisory: OSV:GHSA-VXJ7-4XRP-5VR4...

actions-runtime (>=1.0.1, <=1.0.4), agience-origin (>=0.1.0, <=0.2.8) +20 more potentially affected by CVE-2026-55558 via aiosmtplib (3.0.2)

aiosmtplib PYPI version 3.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - actions-runtime =1.0.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.4.2, =1.7.0, =0.2.3, =1.6.52, =1.8.0rc2, =0.1.0, =0.1.2 and more Source cves:...

async-sender (>=1.4.2, <=1.4.3) potentially affected by CVE-2026-55558 via aiosmtplib (1.1.3)

aiosmtplib PYPI version 1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-sender =1.4.2, =1.4.3 Source cves: CVE-2026-55558 Source advisory: OSV:GHSA-VXJ7-4XRP-5VR4...

async-sender (>=1.3.0, <=1.3.2) potentially affected by CVE-2026-55558 via aiosmtplib (1.0.3)

aiosmtplib PYPI version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-sender =1.3.0, =1.3.2 Source cves: CVE-2026-55558 Source advisory: OSV:GHSA-VXJ7-4XRP-5VR4...

async-notify (>=0.5.17, <=0.6.3), async-sender (1.4.4) +8 more potentially affected by CVE-2026-55558 via aiosmtplib (1.1.6)

aiosmtplib PYPI version 1.1.6 is affected by a known vulnerability. The following packages have a transitive dependency on aiosmtplib and may be impacted: - async-notify =0.5.17, =0.1.3, =0.2.3, =1.0.4, =2.0.11, =0.9.13.1, =0.8.4, =0.1.0a0, =0.1.6a0 Source cves: CVE-2026-55558 Source advisory:...

Malicious code in flyteplugins-redis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14584 Malicious code in flyteplugins-redis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 785b972da662fb9bf37532e8607149e096679239dbd373dc18406df647564c03 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-nsight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46b08f15350f8ecf5aabe4633458f517dda24d5eb2687ab95680dc068cf2f129 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...