aid-push (>=2.1.0, <=2.1.4), alexa-browser-client (>=0.3.3, <=3.3.2) +46 more potentially affected by CVE-2026-71554 via h2 (2.6.2)

h2 PYPI version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - aid-push =2.1.0, =0.3.3, =1.3.0, =1.2.0, =0.2.0, =0.7.1.1, =0.0.1, =0.4.0, =17.5.1, =0.1.10, =0.4.10 and more Source cves: CVE-2026-71554 Source advisory:...

aquests (>=0.7.8.5b1, <=0.7.16.18), kyoukai (2.2.1.post1) +1 more potentially affected by CVE-2026-71554 via h2 (3.0.1)

h2 PYPI version 3.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - aquests =0.7.8.5b1, =0.7.16.18 - kyoukai 2.2.1.post1 - th2c 0.3.1 Source cves: CVE-2026-71554 Source advisory: OSV:GHSA-6HR6-W5QG-QMWG...

kyoukai (>=2.2.0, <=2.2.1) potentially affected by CVE-2026-71554 via h2 (3.1.0)

h2 PYPI version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on h2 and may be impacted: - kyoukai =2.2.0, =2.2.1 Source cves: CVE-2026-71554 Source advisory: OSV:GHSA-6HR6-W5QG-QMWG...

aapns (>=19.11.0, <=23.7.0), abq (>=0.1.0, <=0.1.4) +421 more potentially affected by CVE-2026-71554 via h2 (>=2.4.4, <=4.4.0)

h2 PYPI version =2.4.4, =19.11.0, =0.1.0, =0.0.32, =0.0.1, =0.0.1, =0.4.0, =0.4.0, =2.1.0, =0.1.0, =2.0.0, =20.3.0rc1, =0.2.1, =0.3.2, =0.3.6, =0.3.8 and more Source cves: CVE-2026-71554 Source advisory: MEND:CVE-2026-71554...

accession (>=1.9.0, <=3.11.0), aio-aws (>=0.21.0, <=0.22.1) +72 more potentially affected by CVE-2026-18654 via awscli (>=1.7.34, <=1.45.23)

awscli PYPI version =1.7.34, =1.9.0, =0.21.0, =1.0.0, =0.1.1, =0.1.0, =2.0.4, =0.1.0, =0.1.17, =1.0.1, =0.9.1, =2020.5.19, =0.8.2, =0.3.0, =0.6.0 and more Source cves: CVE-2026-18654 Source advisory: GHSA-HQVF-45JJ-MCCQ...

accession (>=1.9.0, <=3.11.0), aio-aws (>=0.21.0, <=0.22.1) +72 more potentially affected by CVE-2026-18654 via awscli (>=1.7.34, <=1.45.23)

awscli PYPI version =1.7.34, =1.9.0, =0.21.0, =1.0.0, =0.1.1, =0.1.0, =2.0.4, =0.1.0, =0.1.17, =1.0.1, =0.9.1, =2020.5.19, =0.8.2, =0.3.0, =0.6.0 and more Source cves: CVE-2026-18654 Source advisory: OSV:GHSA-HQVF-45JJ-MCCQ...

gtm-onepint (1.2.14), gtm-onepintai (>=1.0.0, <=1.0.3) +1 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (1.0.0)

langgraph-checkpoint-postgres PYPI version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - gtm-onepint 1.2.14 - gtm-onepintai =1.0.0, =1.0.9, =1.2.13 Source cves: CVE-2026-71433 Source advisory...

agent-api-server (>=2.1.7, <=2.1.13), alphasix-axiom (>=1.1.3, <=1.1.22) +17 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=3.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =3.0.0, =2.1.7, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.1.0, =0.8.0, =0.11.1, =0.11.1, =1.0.0.dev7, =1.0.0, =1.0.0.dev7, =3.61.1 and more Source cves: CVE-2026-71433 Source advisory: OSV:GHSA-47PJ-3JCM-6WHG...

freiburg-ris-ca (0.1.0), my-agent (0.1.0) potentially affected by CVE-2026-71433 via langgraph-checkpoint-sqlite (1.0.4)

langgraph-checkpoint-sqlite PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-sqlite and may be impacted: - freiburg-ris-ca 0.1.0 - my-agent 0.1.0 Source cves: CVE-2026-71433 Source advisory: OSV:GHSA-47PJ-3JCM-6WH...

langgraph-agent-toolkit (>=0.7.8, <=0.7.23), mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.21)

langgraph-checkpoint-postgres PYPI version 2.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - langgraph-agent-toolkit =0.7.8, =0.1.0, =0.1.1 Source cves: CVE-2026-71433 Source advisory:...

katalyst (0.9.1), paper-sage (1.0.5) +2 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-sqlite (2.0.10)

langgraph-checkpoint-sqlite PYPI version 2.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-sqlite and may be impacted: - katalyst 0.9.1 - paper-sage 1.0.5 - quietfail 0.1.0 - quoriv =1.0.1, =1.2.0 Source cves: CVE-2026-71433...

agent-api-server (>=2.1.7, <=2.1.13), alphasix-axiom (>=1.1.3, <=1.1.22) +17 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=3.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =3.0.0, =2.1.7, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.1.0, =0.8.0, =0.11.1, =0.11.1, =1.0.0.dev7, =1.0.0, =1.0.0.dev7, =3.61.1 and more Source cves: CVE-2026-71433 Source advisory: SNYK:PYTHON-LANGGRAPHCHECKPOINTPOSTGRES-18592348...

agent-api-server (>=2.1.7, <=2.1.13), airflow-chat (>=0.1.0a2, <=0.1.0a7) +33 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=1.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =1.0.0, =2.1.7, =0.1.0a2, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.0.2, =1.0.0, =1.0.9, =1.2.13 and more Source cves: CVE-2026-71433 Source advisory: MEND:CVE-2026-71433...

Malicious code in xayoub-xctxteam (PyPI)

Source: amazon-inspector e150a2084afb57b865384c624d91da477fe2a6ac09e84640a4f831a4a9b48a56 On import xAyOuBXcTxTeaM, init.py automatically starts a Flask HTTP server bound to 0.0.0.0:50019 exposing /spam?uid=, /stop, and /status endpoints. Any remote party able to reach the installer's host on tha...

Malicious code in decapod-common (PyPI)

Source: kam193 335a31b4299781e6a6926da0b85d6f1b2e22aaefbb5953418b7abe7aa0ada4bd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

ROOT-APP-PYPI-CVE-2026-23490 CVE-2026-23490 in pyasn1 - Patched by Root

Root has patched CVE-2026-23490 in the pyasn1 package for Root:PyPI. Multiple fixed versions available...

Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...

Malicious code in uncrypt (PyPI)

Source: kam193 f391bbd6f86e9108de1a5de9d0131658bf5a637b768f724f536976e125d5b0c2 During import, the package silently starts the embedded executable which existence is not disclosed to the user. Dynamic analysis suggests the code harvests browser data and communicates with an external domain. ---...

safe-chain v1.5.15

Aikido Safe Chain ✅ Block malware on developer laptops and CI/CD ✅ Supports npm and PyPI more package managers coming ✅ Blocks packages newer than 48 hours without breaking your build ✅ Tokenless, free, no build data shared Need protection beyond npm & PyPI? Aikido Device Protection builds on Saf...

Malicious code in solana-sniper-bot (PyPI)

Source: kam193 1140920c05a1ce00ca8d35295fb927d1bbb2ca9fe2f8e7ab9f63f9391ca6476b During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...