Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

MAL-2026-14132 Malicious code in deepface-weights (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...

devpi-web (2.6.0) potentially affected by CVE-2026-54723 via devpi-server (2.6.1)

devpi-server PYPI version 2.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on devpi-server and may be impacted: - devpi-web 2.6.0 Source cves: CVE-2026-54723 Source advisory: OSV:GHSA-M5PQ-69XG-VCQ3...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by unknown CVE via monai (>=1.0.0, <=1.5.2)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-MONAI-18960423...

magms (>=1.1.0, <=2.0.2) potentially affected by CVE-2026-100845 via monai (0.9.1)

monai PYPI version 0.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - magms =1.1.0, =2.0.2 Source cves: CVE-2026-100845 Source advisory: OSV:GHSA-WG9G-W2J2-8PGR...

monailabel (0.4.1), monailabel-weekly (0.4.0.dev2228) +2 more potentially affected by CVE-2026-100845 via monai (0.9.0)

monai PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - monailabel 0.4.1 - monailabel-weekly 0.4.0.dev2228 - neurips-cellseg-gc =0.0.1, =0.1.5, =0.1.10 Source cves: CVE-2026-100845 Source advisory:...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by unknown CVE via monai (>=1.0.0, <=1.5.2)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: unknown CVE Source advisory: GHSA-RGHG-Q7WP-9767...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by unknown CVE via monai (>=1.0.0, <=1.5.2)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-MONAI-18960425...

monailabel (>=0.2.0rc2, <=0.2.0), monailabel-weekly (>=0.3.0.dev2139, <=0.3.0.dev2147) +1 more potentially affected by CVE-2026-100844 via monai (0.7.0)

monai PYPI version 0.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - monailabel =0.2.0rc2, =0.3.0.dev2139, =0.1.0, =0.1.1 Source cves: CVE-2026-100844 Source advisory: OSV:GHSA-RGHG-Q7WP-9767...

fedbiomed-cli (>=0.1.2, <=0.1.8) potentially affected by CVE-2026-100844 via monai (0.4.0)

monai PYPI version 0.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - fedbiomed-cli =0.1.2, =0.1.8 Source cves: CVE-2026-100844 Source advisory: OSV:GHSA-RGHG-Q7WP-9767...

deep-labelprop (1.1.1), fastmonai (>=0.1.0, <=0.1.4) +5 more potentially affected by CVE-2026-100844 via monai (0.8.1)

monai PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 1.1.1 - fastmonai =0.1.0, =0.0.2, =0.0.3, =0.4.0.dev2201, =0.4.0.dev2208 Source cves: CVE-2026-100844 Source advisory:...

monailabel (0.4.1), monailabel-weekly (0.4.0.dev2228) +2 more potentially affected by CVE-2026-100844 via monai (0.9.0)

monai PYPI version 0.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - monailabel 0.4.1 - monailabel-weekly 0.4.0.dev2228 - neurips-cellseg-gc =0.0.1, =0.1.5, =0.1.10 Source cves: CVE-2026-100844 Source advisory:...

2404-segmentation-pipeline (>=0.1.0, <=1.0.0), abdomenatlas (>=0.1.0, <=0.1.1) +38 more potentially affected by unknown CVE via monai (>=1.0.0, <=1.5.2)

monai PYPI version =1.0.0, =0.1.0, =0.1.0, =0.0.1, =1.0.0rc1, =0.0.1, =0.1.5, =0.0.5, =0.1.5, =0.0.3, =6.0.0rc1, =0.1.1, =1.0.1a4, =1.0.1a5 and more Source cves: unknown CVE Source advisory: GHSA-QXQ5-QHX6-94QW...

deep-labelprop (1.1.1), fastmonai (>=0.1.0, <=0.1.4) +5 more potentially affected by CVE-2026-100843 via monai (0.8.1)

monai PYPI version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 1.1.1 - fastmonai =0.1.0, =0.0.2, =0.0.3, =0.4.0.dev2201, =0.4.0.dev2208 Source cves: CVE-2026-100843 Source advisory:...

deep-labelprop (0.1.0), monailabel-weekly (0.1.0.dev2128) +2 more potentially affected by CVE-2026-100843 via monai (0.6.0)

monai PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 0.1.0 - monailabel-weekly 0.1.0.dev2128 - p-mod-api 0.0.2 - p2022 0.0.4 Source cves: CVE-2026-100843 Source advisory:...

actpdf (>=0.1.0, <=0.12.0), agenticmem (>=0.1.4.1, <=0.1.5.0) +182 more potentially affected by CVE-2026-49452 via weasyprint (>=0.28.0, <=68.1.0)

weasyprint PYPI version =0.28.0, =0.1.0, =0.1.4.1, =0.5.0, =0.1.1, =0.1.1, =0.1.0, =0.2.4, =0.1.2, =0.5.0, =1.1.0, =1.2.0 and more Source cves: CVE-2026-49452 Source advisory: MEND:CVE-2026-49452...

actions-runtime (>=1.0.1, <=1.0.4), agience-origin (>=0.1.0, <=0.2.8) +94 more potentially affected by CVE-2026-53533 via aiosmtplib (>=1.0.3, <=5.1.0)

aiosmtplib PYPI version =1.0.3, =1.0.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.9.5, =3.0.0, =0.5.17, =1.3.0, =0.0.3, =0.39.0, =0.1.24, =0.1.52 - backend-ai-manager 25.6.0rc4 and more Source cves: CVE-2026-53533 Source advisory: MEND:CVE-2026-53533...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +129 more potentially affected by CVE-2026-71486 via vllm (>=0.1.3, <=0.25.1)

vllm PYPI version =0.1.3, =0.2.1, =1.2.2, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =0.1.0, =0.1.15rc1, =0.1.0, =0.1.0, =0.0.1, =0.0.38 and more Source cves: CVE-2026-71486 Source advisory: SNYK:PYTHON-VLLM-18912241...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-71491 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-71491 Source advisory: SNYK:PYTHON-SQLPARSE-18905009...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +49 more potentially affected by CVE-2026-64849 via mlflow (>=3.3.0, <=3.14.0)

mlflow PYPI version =3.3.0, =1.0.0, =0.4.0, =0.3.0, =0.1.0, =0.8.0, =0.8.0, =0.5.0.0, =0.5.0, =0.9.6, =0.9.7 and more Source cves: CVE-2026-64849 Source advisory: OSV:GHSA-7GWP-5PFP-969J...