liteyukibot-v7-runtime-astrbot (>=0.1.0a1, <=0.1.0a7) potentially affected by CVE-2026-15500 via astrbot (>=4.27.2, <=4.28.2)

astrbot PYPI version =4.27.2, =0.1.0a1, =0.1.0a7 Source cves: CVE-2026-15500 Source advisory: SNYK:PYTHON-ASTRBOT-17954638...

liteyukibot-v7-runtime-astrbot (>=0.1.0a1, <=0.1.0a7) potentially affected by CVE-2026-15499 via astrbot (>=4.27.2, <=4.28.2)

astrbot PYPI version =4.27.2, =0.1.0a1, =0.1.0a7 Source cves: CVE-2026-15499 Source advisory: SNYK:PYTHON-ASTRBOT-17954639...

liteyukibot-v7-runtime-astrbot (>=0.1.0a1, <=0.1.0a7) potentially affected by CVE-2026-15501 via astrbot (>=4.27.2, <=4.28.2)

astrbot PYPI version =4.27.2, =0.1.0a1, =0.1.0a7 Source cves: CVE-2026-15501 Source advisory: SNYK:PYTHON-ASTRBOT-17954640...

ROOT-APP-PYPI-CVE-2024-35195 CVE-2024-35195 in rootio-requests - Patched by Root

Root has patched CVE-2024-35195 in the rootio-requests package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-48795 CVE-2023-48795 in rootio-paramiko - Patched by Root

Root has patched CVE-2023-48795 in the rootio-paramiko package for Root:PyPI. Multiple fixed versions available...

llama-index-llms-openllm (>=0.0.1, <=0.4.0) potentially affected by CVE-2026-15035 via openllm (>=0.4.44, <=0.6.30)

openllm PYPI version =0.4.44, =0.0.1, =0.4.0 Source cves: CVE-2026-15035 Source advisory: SNYK:PYTHON-OPENLLM-17895040...

MAL-2026-6983 Malicious code in tronpak (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 35790f872dd1f0fa6c17fca434134a08101946af27a0e2b4467e3b362f618e01 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...

MAL-2026-6979 Malicious code in turbod (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78d60e25c1258021c4fb69a93456c76ef1157be852c7b9dc7165290ca599b0f7 Starting version 1.0.7, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

ROOT-APP-PYPI-CVE-2026-48776 CVE-2026-48776 in rootio-langgraph-sdk - Patched by Root

Root has patched CVE-2026-48776 in the rootio-langgraph-sdk package for Root:PyPI. Multiple fixed versions available...

GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE

SummaryA path traversal vulnerability exists in GuardDog's safeextract function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog.CWE: CWE-22 Improper...

ROOT-APP-PYPI-CVE-2026-48990 CVE-2026-48990 in rootio-joserfc - Patched by Root

Root has patched CVE-2026-48990 in the rootio-joserfc package for Root:PyPI. Multiple fixed versions available...

PDM Trojan Lockfile

SummaryIt's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. DetailsProject foo can be targeted by creating the project foo-2 and uploading the file...

PYSEC-2026-1763 PDM Trojan Lockfile

Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...

ROOT-APP-PYPI-CVE-2026-25528 CVE-2026-25528 in rootio-langsmith - Patched by Root

Root has patched CVE-2026-25528 in the rootio-langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48804 CVE-2026-48804 in rootio-python-socketio - Patched by Root

Root has patched CVE-2026-48804 in the rootio-python-socketio package for Root:PyPI. Multiple fixed versions available...

3m (>=0.1.0, <=0.1.3), 3tears-agent-identity (>=0.15.0, <=0.64.0) +4382 more potentially affected by CVE-2026-14742 via langgraph (>=0.0.15, <=1.2.12)

langgraph PYPI version =0.0.15, =0.1.0, =0.15.0, =0.15.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.18.0, =0.1.0, =0.1.6 - a2a-client-handler 0.1.0 - a2a-langgraph 0.1.0 and more Source cves: CVE-2026-14742 Source advisory: SNYK:PYTHON-LANGGRAPH-17817813...

PYSEC-2026-607 Malicious code in pantheon-agents (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of pantheon-agents were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...

ROOT-APP-PYPI-CVE-2026-28223 CVE-2026-28223 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-28223 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-28222 CVE-2026-28222 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-28222 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-44201 CVE-2026-44201 in rootio-wagtail - Patched by Root

Root has patched CVE-2026-44201 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...