cadlabs-ethereum-economic-model (0.0.2a0), nldi-el-serv (>=0.1.4, <=0.1.5) potentially affected by CVE-2026-73415 via jupyterlab (3.0.14)

jupyterlab PYPI version 3.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - cadlabs-ethereum-economic-model 0.0.2a0 - nldi-el-serv =0.1.4, =0.1.5 Source cves: CVE-2026-73415 Source advisory: OSV:PYSEC-2026-3671...

homeassistant-stubs (2022.9.4), pytest-homeassistant-custom-component (0.11.23) potentially affected by CVE-2026-64825 via homeassistant (2022.9.4)

homeassistant PYPI version 2022.9.4 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.9.4 - pytest-homeassistant-custom-component 0.11.23 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2021.12.0b4), pytest-homeassistant-custom-component (0.5.2) potentially affected by CVE-2026-64825 via homeassistant (2021.12.0b4)

homeassistant PYPI version 2021.12.0b4 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2021.12.0b4 - pytest-homeassistant-custom-component 0.5.2 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2023.10.0b3), pytest-homeassistant-custom-component (0.13.59) potentially affected by CVE-2026-64825 via homeassistant (2023.10.0b3)

homeassistant PYPI version 2023.10.0b3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.10.0b3 - pytest-homeassistant-custom-component 0.13.59 Source cves: CVE-2026-64825 Source advisory:...

homeassistant-stubs (2021.4.6) potentially affected by CVE-2026-64825 via homeassistant (2021.4.6)

homeassistant PYPI version 2021.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2021.4.6 Source cves: CVE-2026-64825 Source advisory: OSV:PYSEC-2026-3669...

homeassistant-stubs (2023.12.2), pytest-homeassistant-custom-component (0.13.84) potentially affected by CVE-2026-64825 via homeassistant (2023.12.2)

homeassistant PYPI version 2023.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.12.2 - pytest-homeassistant-custom-component 0.13.84 Source cves: CVE-2026-64825 Source advisory:...

vantage6-algorithm-store (4.11.0rc3), vantage6-node (4.11.0rc3) +1 more potentially affected by CVE-2026-73652 via vantage6 (4.11.0rc3)

vantage6 PYPI version 4.11.0rc3 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.11.0rc3 - vantage6-node 4.11.0rc3 - vantage6-server 4.11.0rc3 Source cves: CVE-2026-73652 Source advisory:...

abnativ (>=1.1.0, <=1.2.9), ai-24sea (>=0.1.0, <=1.1.0) +218 more potentially affected by CVE-2026-8147 via mlflow (>=2.14.0, <=3.12.0)

mlflow PYPI version =2.14.0, =1.1.0, =0.1.0, =1.0.0, =0.1.0, =1.7.0.dev1715243074, =1.7.0.dev1715246371, =1.8.0rc6, =1.7.0.dev1715246329, =1.7.0.dev1715246310, =0.1.9, =0.1.40 and more Source cves: CVE-2026-8147 Source advisory: OSV:PYSEC-2026-3686...

BIT-JUPYTERLAB-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

MAL-2026-14274 Malicious code in reqcrypt-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...

Malicious code in reqcrypt-dev (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...

PT-2026-79929

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked extensions...

PT-2026-80643

JupyterLab's PyPI extension manager enforces blocked extensions uris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...

Malicious code in deepface-weight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...

MAL-2026-14158 Malicious code in deepface-weight (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...

Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

MAL-2026-14133 Malicious code in reqcrypt (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...

Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

MAL-2026-14132 Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

devpi-web (2.6.0) potentially affected by CVE-2026-54723 via devpi-server (2.6.1)

devpi-server PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on devpi-server and may be impacted: - devpi-web 2.6.0 Source cves: CVE-2026-54723 Source advisory: OSV:GHSA-M5PQ-69XG-VCQ3...