aind-airflow-jobs (>=0.2.1, <=0.2.6), apache-airflow-providers-snowflake (>=1.0.0b2, <=1.0.0) +2 more potentially affected by CVE-2026-54183 via apache-airflow (2.8.1)

apache-airflow PYPI version 2.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - aind-airflow-jobs =0.2.1, =1.0.0b2, =1.1.1.post0.dev6, =1.1.3.post0.dev5 Source cves: CVE-2026-54183 Source advisory:...

airflow-clickhouse-plugin (1.2.0), airflow-tools (>=0.8.5, <=0.9.1) +2 more potentially affected by CVE-2026-54183 via apache-airflow (2.8.4)

apache-airflow PYPI version 2.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-clickhouse-plugin 1.2.0 - airflow-tools =0.8.5, =0.0.4, =2.4.0rc1, =2.5.1 Source cves: CVE-2026-54183 Source advisory:...

somenergia-dag-utils (>=0.2.0, <=0.2.1) potentially affected by CVE-2026-54183 via apache-airflow (2.5.2)

apache-airflow PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - somenergia-dag-utils =0.2.0, =0.2.1 Source cves: CVE-2026-54183 Source advisory: OSV:PYSEC-2026-3705...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +268 more potentially affected by CVE-2026-59244 via apache-airflow (>=1.8.2, <=3.3.1rc2)

apache-airflow PYPI version =1.8.2, =0.8.44.4rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.2.1, =0.2.9b1, =1.0.7, =0.4.0, =0.5.0, =0.1.0a1, =0.1.0a7 - airflow-clickhouse-plug 1.6.2 and more Source cves: CVE-2026-59244 Source advisory: MEND:CVE-2026-59244...

airflow-balancer (>=0.7.0, <=0.7.6), airflow-calendar (>=0.5.0, <=0.9.1) +44 more potentially affected by CVE-2026-58076 via apache-airflow (>=3.0.0, <=3.3.1rc2)

apache-airflow PYPI version =3.0.0, =0.7.0, =0.5.0, =1.5.0, =0.6.1, =1.10.7, =0.6.0a1, =0.1.0, =1.4.3, =0.3.0, =1.2.10, =3.0.0, =1.1.3rc1, =1.4.0 and more Source cves: CVE-2026-58076 Source advisory: MEND:CVE-2026-58076...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +268 more potentially affected by CVE-2026-54183 via apache-airflow (>=1.8.2, <=3.3.1rc2)

apache-airflow PYPI version =1.8.2, =0.8.44.4rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.2.1, =0.2.9b1, =1.0.7, =0.4.0, =0.5.0, =0.1.0a1, =0.1.0a7 - airflow-clickhouse-plug 1.6.2 and more Source cves: CVE-2026-54183 Source advisory: MEND:CVE-2026-54183...

airflow-calendar (>=0.5.0, <=0.9.1), airflow-provider-great-expectations (1.0.0) +2 more potentially affected by CVE-2026-67260 via apache-airflow (>=3.3.0, <=3.3.1rc2)

apache-airflow PYPI version =3.3.0, =0.5.0, =1.3.0, =1.3.1rc2 Source cves: CVE-2026-67260 Source advisory: MEND:CVE-2026-67260...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +268 more potentially affected by CVE-2026-68968 via apache-airflow (>=1.8.2, <=3.3.1rc2)

apache-airflow PYPI version =1.8.2, =0.8.44.4rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.2.1, =0.2.9b1, =1.0.7, =0.4.0, =0.5.0, =0.1.0a1, =0.1.0a7 - airflow-clickhouse-plug 1.6.2 and more Source cves: CVE-2026-68968 Source advisory: MEND:CVE-2026-68968...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +268 more potentially affected by CVE-2026-68971 via apache-airflow (>=1.8.2, <=3.3.1rc2)

apache-airflow PYPI version =1.8.2, =0.8.44.4rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.2.1, =0.2.9b1, =1.0.7, =0.4.0, =0.5.0, =0.1.0a1, =0.1.0a7 - airflow-clickhouse-plug 1.6.2 and more Source cves: CVE-2026-68971 Source advisory: MEND:CVE-2026-68971...

abi-ds-utils (1.0.1), acceldata-o2a (1.0.0) +268 more potentially affected by CVE-2026-68076 via apache-airflow (>=1.8.2, <=3.3.1rc2)

apache-airflow PYPI version =1.8.2, =0.8.44.4rc1, =1.4.0.3.post4, =1.4.0.3.post3, =0.1.0rc3, =0.2.1, =0.2.9b1, =1.0.7, =0.4.0, =0.5.0, =0.1.0a1, =0.1.0a7 - airflow-clickhouse-plug 1.6.2 and more Source cves: CVE-2026-68076 Source advisory: MEND:CVE-2026-68076...

dataflow-airflow (2.10.10) potentially affected by CVE-2026-68868 via apache-airflow-providers-google (19.0.0)

apache-airflow-providers-google PYPI version 19.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dataflow-airflow 2.10.10 Source cves: CVE-2026-68868 Source advisory: OSV:PYSEC-2026-3714...

airflow-add-ons (>=0.2.9b1, <=0.2.9b2) potentially affected by CVE-2026-68868 via apache-airflow-providers-google (7.0.0)

apache-airflow-providers-google PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-add-ons =0.2.9b1, =0.2.9b2 Source cves: CVE-2026-68868 Source advisory: OSV:PYSEC-2026-371...

example-pkg-naturalett (>=14.4.4, <=14.4.8) potentially affected by CVE-2026-68868 via apache-airflow-providers-google (4.0.0)

apache-airflow-providers-google PYPI version 4.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - example-pkg-naturalett =14.4.4, =14.4.8 Source cves: CVE-2026-68868 Source advisory:...

airflow-tools (>=0.9.0, <=0.11.0), risk-custom-secrets-provider (>=1.0.9, <=1.1.3) potentially affected by CVE-2026-68868 via apache-airflow-providers-google (10.23.0)

apache-airflow-providers-google PYPI version 10.23.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-tools =0.9.0, =1.0.9, =1.1.3 Source cves: CVE-2026-68868 Source advisory:...

Malicious LiteLLM Releases Tied to Trivy Hack May Have Exposed 2,100+ Organizations

Two malicious LiteLLM releases sat on PyPI for about 40 minutes in March carrying credential-stealing code capable of harvesting cloud keys, SSH keys, Kubernetes tokens, database passwords, and other secrets from systems that installed them. Threat intelligence firm CloudSEK now says a dataset it...

bubble (>=2016.3.17, <=2016.8.16), winston (>=0.1.1, <=0.2.3) potentially affected by CVE-2026-9318 via tablib (0.11.2)

tablib PYPI version 0.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on tablib and may be impacted: - bubble =2016.3.17, =0.1.1, =0.2.3 Source cves: CVE-2026-9318 Source advisory: OSV:GHSA-GQGW-JGHV-MXWX...

bitwarden (>=0.2.2, <=0.4.0), bubble3 (>=2018.3.29, <=2018.6.4) +4 more potentially affected by CVE-2026-9318 via tablib (0.12.1)

tablib PYPI version 0.12.1 is affected by a known vulnerability. The following packages have a transitive dependency on tablib and may be impacted: - bitwarden =0.2.2, =2018.3.29, =0.0.1, =0.9.4, =0.0.1, =0.0.4 Source cves: CVE-2026-9318 Source advisory: OSV:GHSA-GQGW-JGHV-MXWX...

apitestez (>=1.0.35, <=1.1.3), arthexis (>=0.1.3, <=0.11.0) +69 more potentially affected by CVE-2026-9318 via tablib (>=3.0.0, <=3.9.0)

tablib PYPI version =3.0.0, =1.0.35, =0.1.3, =2.0.0, =9.6.4, =9.8.7.1, =202307.1107.0, =8.0.0, =3.12.6, =0.22.10, =6.26.0, =0.6.18, =0.6.29 and more Source cves: CVE-2026-9318 Source advisory: OSV:GHSA-GQGW-JGHV-MXWX...

apitestez (>=1.0.35, <=1.1.3), arthexis (>=0.1.3, <=0.11.0) +69 more potentially affected by CVE-2026-9318 via tablib (>=3.0.0, <=3.9.0)

tablib PYPI version =3.0.0, =1.0.35, =0.1.3, =2.0.0, =9.6.4, =9.8.7.1, =202307.1107.0, =8.0.0, =3.12.6, =0.22.10, =6.26.0, =0.6.18, =0.6.29 and more Source cves: CVE-2026-9318 Source advisory: GHSA-GQGW-JGHV-MXWX...

django-cms-qe (1.4.3), django-import-export (2.0.1) +1 more potentially affected by CVE-2026-9318 via tablib (0.14.0)

tablib PYPI version 0.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on tablib and may be impacted: - django-cms-qe 1.4.3 - django-import-export 2.0.1 - iambic 1.0.0 Source cves: CVE-2026-9318 Source advisory: OSV:GHSA-GQGW-JGHV-MXWX...