elib (>=0.1.55, <=0.1.57), emiz (>=0.1.35, <=2018.4.2.1) +11 more potentially affected by CVE-2026-73620 via gitpython (2.1.8)

gitpython PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elib =0.1.55, =0.1.35, =0.2.4a149, =0.0.1, =1.0.0, =0.4233.0, =0.2354.0, =0.2354.0, =0.1.7, =0.2.120, =1.0.0, =0.1.0, =2.1.1 Source cves:...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2026-73620 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2026-73620 Source advisory: OSV:PYSEC-2026-3949...

airflow-indexima (>=1.0.1, <=2.2.1), arcli (>=0.1.0, <=0.1.1) +69 more potentially affected by CVE-2026-73620 via gitpython (2.1.15)

gitpython PYPI version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - airflow-indexima =1.0.1, =0.1.0, =0.3.0rc1, =0.1.0, =0.7.0, =0.2.0, =0.11.0, =0.1.0, =0.6.0, =0.3.0, =2.0.0, =2019.2.3rc0, =2021.7.0 and more...

android-category (>=0.0.3, <=0.0.4), ant-cli (0.0.1) +34 more potentially affected by CVE-2026-73619 via gitpython (2.1.11)

gitpython PYPI version 2.1.11 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - android-category =0.0.3, =0.0.2, =0.3.0, =0.0.2, =0.12.4rc1, =0.1.26.dev1542857464, =0.2.3, =0.1.0, =0.0.1, =1.2.5, =0.1.0.0b1, =0.1.3 and mo...

elib (>=0.1.55, <=0.1.57), emiz (>=0.1.35, <=2018.4.2.1) +11 more potentially affected by CVE-2026-73619 via gitpython (2.1.8)

gitpython PYPI version 2.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - elib =0.1.55, =0.1.35, =0.2.4a149, =0.0.1, =1.0.0, =0.4233.0, =0.2354.0, =0.2354.0, =0.1.7, =0.2.120, =1.0.0, =0.1.0, =2.1.1 Source cves:...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-73619 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-73619 Source advisory: OSV:PYSEC-2026-3948...

codev (>=0.5.1a10, <=0.7.4a3), git-repo (1.6.0) potentially affected by CVE-2026-73619 via gitpython (2.0.2)

gitpython PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - codev =0.5.1a10, =0.7.4a3 - git-repo 1.6.0 Source cves: CVE-2026-73619 Source advisory: OSV:PYSEC-2026-3948...

airflow-indexima (>=1.0.1, <=2.2.1), arcli (>=0.1.0, <=0.1.1) +69 more potentially affected by CVE-2026-73619 via gitpython (2.1.15)

gitpython PYPI version 2.1.15 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - airflow-indexima =1.0.1, =0.1.0, =0.3.0rc1, =0.1.0, =0.7.0, =0.2.0, =0.11.0, =0.1.0, =0.6.0, =0.3.0, =2.0.0, =2019.2.3rc0, =2021.7.0 and more...

bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-73619 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-73619 Source advisory: OSV:PYSEC-2026-3948...

aaa-ml-datasets-course (1.0.0), aerocm (0.1.0b0) +109 more potentially affected by CVE-2026-73627 via jupyterlab (>=4.1.0, <=4.5.8)

jupyterlab PYPI version =4.1.0, =0.5.5, =2.0.0, =4.33.0, =0.1.0, =1.6.4b1, =1.8.2, =0.0.1, =0.3.1, =0.1.0, =0.0.2, =0.0.6 and more Source cves: CVE-2026-73627 Source advisory: MEND:CVE-2026-73627...

CVE-2026-73626

JupyterLab versions =4.6.0,=4.6.1 and =4.5.9 contain an allowlist/blocklist enforcement gap in PyPIExtensionManager.install. A missing 'await' caused the isinstallallowed coroutine to never execute, so the extension allowlist/blocklist check was not enforced for direct callers of install. The sto...

a2 (>=0.1.0, <=0.6.1), aaa-ml-datasets-course (1.0.0) +623 more potentially affected by CVE-2026-73626 via jupyterlab (>=0.31.1, <=4.5.8)

jupyterlab PYPI version =0.31.1, =0.1.0, =0.1.0b0, =0.1.0b0, =0.1.0b0, =0.1.0, =0.5.5, =2.0.0, =0.1.1, =0.1.0, =3.0.0, =4.33.0, =5.0.0 and more Source cves: CVE-2026-73626 Source advisory: MEND:CVE-2026-73626...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +911 more potentially affected by CVE-2026-73625 via gitpython (>=0.3.4, <=3.1.53)

gitpython PYPI version =0.3.4, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-73625 Source advisory: MEND:CVE-2026-73625...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +911 more potentially affected by CVE-2026-73624 via gitpython (>=0.3.4, <=3.1.53)

gitpython PYPI version =0.3.4, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-73624 Source advisory: MEND:CVE-2026-73624...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +911 more potentially affected by CVE-2026-73620 via gitpython (>=0.3.4, <=3.1.55)

gitpython PYPI version =0.3.4, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-73620 Source advisory: MEND:CVE-2026-73620...

Beyond Source: An Empirical Study of Python Bytecode Security Risks

Python package security is largely source-centric, yet Python runtimes can execute bytecode directly through .pyc files, compiled-only modules, and marshalled code objects, creating an inspection-execution gap. We present an empirical study of Python bytecode as a security artifact. We measure...

CVE-2026-73416: Improper Handling of Case Sensitivity

jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...

a2 (>=0.1.0, <=0.6.1), aaa-ml-datasets-course (1.0.0) +623 more potentially affected by CVE-2026-73415 via jupyterlab (>=0.31.1, <=4.5.8)

jupyterlab PYPI version =0.31.1, =0.1.0, =0.1.0b0, =0.1.0b0, =0.1.0b0, =0.1.0, =0.5.5, =2.0.0, =0.1.1, =0.1.0, =3.0.0, =4.33.0, =5.0.0 and more Source cves: CVE-2026-73415 Source advisory: MEND:CVE-2026-73415...

agent-toolkit (0.1.9), branchy-chat (0.1.2) +27 more potentially affected by CVE-2026-72742 via dspy (>=3.0.0b1, <=3.3.0b1)

dspy PYPI version =3.0.0b1, =0.7.7, =0.3.5, =0.1.9, =0.1.0, =0.3.5, =0.1.0, =0.5.31, =0.1.0, =0.1.4, =0.1.0, =0.3.23, =0.3.33 - modaic 0.44.3 and more Source cves: CVE-2026-72742 Source advisory: SNYK:PYTHON-DSPY-18751972...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2026-68971 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2026-68971 Source advisory: OSV:GHSA-5247-M8W9-2V4M...