deep-labelprop (0.1.0), monailabel-weekly (0.1.0.dev2128) +2 more potentially affected by CVE-2026-100843 via monai (0.6.0)

monai PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on monai and may be impacted: - deep-labelprop 0.1.0 - monailabel-weekly 0.1.0.dev2128 - p-mod-api 0.0.2 - p2022 0.0.4 Source cves: CVE-2026-100843 Source advisory:...

actpdf (>=0.1.0, <=0.12.0), agenticmem (>=0.1.4.1, <=0.1.5.0) +182 more potentially affected by CVE-2026-49452 via weasyprint (>=0.28.0, <=68.1.0)

weasyprint PYPI version =0.28.0, =0.1.0, =0.1.4.1, =0.5.0, =0.1.1, =0.1.1, =0.1.0, =0.2.4, =0.1.2, =0.5.0, =1.1.0, =1.2.0 and more Source cves: CVE-2026-49452 Source advisory: MEND:CVE-2026-49452...

actions-runtime (>=1.0.1, <=1.0.4), agience-origin (>=0.1.0, <=0.2.8) +94 more potentially affected by CVE-2026-53533 via aiosmtplib (>=1.0.3, <=5.1.0)

aiosmtplib PYPI version =1.0.3, =1.0.1, =0.1.0, =1.0.0, =1.0.0, =0.1.0, =1.9.5, =3.0.0, =0.5.17, =1.3.0, =0.0.3, =0.39.0, =0.1.24, =0.1.52 - backend-ai-manager 25.6.0rc4 and more Source cves: CVE-2026-53533 Source advisory: MEND:CVE-2026-53533...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +129 more potentially affected by CVE-2026-71486 via vllm (>=0.1.3, <=0.25.1)

vllm PYPI version =0.1.3, =0.2.1, =1.2.2, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =0.1.0, =0.1.15rc1, =0.1.0, =0.1.0, =0.0.1, =0.0.38 and more Source cves: CVE-2026-71486 Source advisory: SNYK:PYTHON-VLLM-18912241...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-71491 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-71491 Source advisory: SNYK:PYTHON-SQLPARSE-18905009...

ai-24sea (1.1.0), aiops-ml (>=1.0.0, <=1.0.1) +49 more potentially affected by CVE-2026-64849 via mlflow (>=3.3.0, <=3.14.0)

mlflow PYPI version =3.3.0, =1.0.0, =0.4.0, =0.3.0, =0.1.0, =0.8.0, =0.8.0, =0.5.0.0, =0.5.0, =0.9.6, =0.9.7 and more Source cves: CVE-2026-64849 Source advisory: OSV:GHSA-7GWP-5PFP-969J...

MAL-2026-14100 Malicious code in socks5901 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3 During import, package exfiltrates all files from "/sdcard/" --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in socks5901 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6184fc1c33621ffa99f06b96ac94f05944bc3c7b431243e50ede0bb396e7dd3 During import, package exfiltrates all files from "/sdcard/" --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +129 more potentially affected by CVE-2026-71486 via vllm (>=0.1.3, <=0.25.1)

vllm PYPI version =0.1.3, =0.2.1, =1.2.2, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =0.1.0, =0.1.15rc1, =0.1.0, =0.1.0, =0.0.1, =0.0.38 and more Source cves: CVE-2026-71486 Source advisory: MEND:CVE-2026-71486...

Incomplete List of Disallowed Inputs

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Insufficient Verification of Data Authenticity

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Use of Hard-coded Credentials

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Use of Hard-coded Credentials

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

acdc-aws-etl-pipeline (>=0.1.7, <=0.5.9), acryl-datahub-gx-plugin (>=0.14.0.3rc1, <=0.15.0rc15) +687 more potentially affected by CVE-2026-59893 via sqlparse (>=0.1.14, <=0.5.5)

sqlparse PYPI version =0.1.14, =0.1.7, =0.14.0.3rc1, =2.0.0, =0.2.0, =0.0.1, =1.0.6, =0.1.0, =2.0.0, =0.8.0, =0.0.1a0, =0.1.0, =0.1.4 and more Source cves: CVE-2026-59893 Source advisory: OSV:GHSA-PRG7-HCFM-MFCR...

croparray (0.1.1) potentially affected by CVE-2026-68520 via glances (3.2.7)

glances PYPI version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on glances and may be impacted: - croparray 0.1.1 Source cves: CVE-2026-68520 Source advisory: OSV:GHSA-4H34-V6R8-MMJC...

croparray (0.1.1) potentially affected by CVE-2026-46608 +1 more via glances (3.2.7)

glances PYPI version 3.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on glances and may be impacted: - croparray 0.1.1 Source cves: CVE-2026-46608, CVE-2026-68517 Source advisory: OSV:GHSA-FP27-88FP-2PHG...

ROOT-APP-PYPI-CVE-2026-53537 CVE-2026-53537 in python-multipart - Patched by Root

Root has patched CVE-2026-53537 in the python-multipart package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-49461 CVE-2026-49461 in pypdf - Patched by Root

Root has patched CVE-2026-49461 in the pypdf package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48155 CVE-2026-48155 in pypdf - Patched by Root

Root has patched CVE-2026-48155 in the pypdf package for Root:PyPI. Multiple fixed versions available...

Malicious Package

Overview kb-ai is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...