langgraph-agent-toolkit (>=0.7.8, <=0.7.23), mseep-deer-flow (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (2.0.21)

langgraph-checkpoint-postgres PYPI version 2.0.21 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-postgres and may be impacted: - langgraph-agent-toolkit =0.7.8, =0.1.0, =0.1.1 Source cves: CVE-2026-71433 Source advisory:...

freiburg-ris-ca (0.1.0), my-agent (0.1.0) potentially affected by CVE-2026-71433 via langgraph-checkpoint-sqlite (1.0.4)

langgraph-checkpoint-sqlite PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on langgraph-checkpoint-sqlite and may be impacted: - freiburg-ris-ca 0.1.0 - my-agent 0.1.0 Source cves: CVE-2026-71433 Source advisory: OSV:GHSA-47PJ-3JCM-6WH...

agent-api-server (>=2.1.7, <=2.1.16), airflow-chat (>=0.1.0a2, <=0.1.0a7) +33 more potentially affected by CVE-2026-71433 via langgraph-checkpoint-postgres (>=1.0.0, <=3.1.0)

langgraph-checkpoint-postgres PYPI version =1.0.0, =2.1.7, =0.1.0a2, =1.1.3, =1.9.0, =0.1.3, =0.1.18, =0.1.57, =0.0.2, =1.0.0, =1.0.9, =1.2.13 and more Source cves: CVE-2026-71433 Source advisory: MEND:CVE-2026-71433...

Malicious code in xayoub-xctxteam (PyPI)

Source: amazon-inspector e150a2084afb57b865384c624d91da477fe2a6ac09e84640a4f831a4a9b48a56 On import xAyOuBXcTxTeaM, init.py automatically starts a Flask HTTP server bound to 0.0.0.0:50019 exposing /spam?uid=, /stop, and /status endpoints. Any remote party able to reach the installer's host on tha...

Malicious code in decapod-common (PyPI)

Source: kam193 335a31b4299781e6a6926da0b85d6f1b2e22aaefbb5953418b7abe7aa0ada4bd Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

ROOT-APP-PYPI-CVE-2026-23490 CVE-2026-23490 in pyasn1 - Patched by Root

Root has patched CVE-2026-23490 in the pyasn1 package for Root:PyPI. Multiple fixed versions available...

Malicious code in decapod-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0de84c80d520754e010d02b90fd4dc728d90fa9efe8c1e8cc6ddd7eb05e0da4 setup.py overrides the install command to collect the installer's hostname and resolved IP address via socket.gethostname/gethostbyname and POST them...

Malicious code in uncrypt (PyPI)

Source: kam193 f391bbd6f86e9108de1a5de9d0131658bf5a637b768f724f536976e125d5b0c2 During import, the package silently starts the embedded executable which existence is not disclosed to the user. Dynamic analysis suggests the code harvests browser data and communicates with an external domain. ---...

safe-chain v1.5.15

Aikido Safe Chain ✅ Block malware on developer laptops and CI/CD ✅ Supports npm and PyPI more package managers coming ✅ Blocks packages newer than 48 hours without breaking your build ✅ Tokenless, free, no build data shared Need protection beyond npm & PyPI? Aikido Device Protection builds on Saf...

Malicious code in solana-sniper-bot (PyPI)

Source: kam193 1140920c05a1ce00ca8d35295fb927d1bbb2ca9fe2f8e7ab9f63f9391ca6476b During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in eth-account-wallet (PyPI)

Source: kam193 4e0a297fd6a2bfc0e15f9aac09c92768a4725458ad282594e97ec15bb3fa8c5f During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in defi-sdk-py (PyPI)

Source: kam193 b292686db581afeaaa7d53e2281a90d7d470fc71ab9e7d6156c49e2e99a44a30 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

Malicious code in mnemonic-py (PyPI)

Source: kam193 6599d6208d71e0e809661e86bf5641e6e7b871cd6f01a54abf22215b8a88ef11 During installation, the package exfiltrates sensitive env variables, browser data, crypto wallets files, ssh keys and other configuration files. --- Category: MALICIOUS - The campaign has clearly malicious intent, li...

ROOT-APP-PYPI-CVE-2026-68770 CVE-2026-68770 in sentence-transformers - Patched by Root

Root has patched CVE-2026-68770 in the sentence-transformers package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-34069 CVE-2024-34069 in Werkzeug - Patched by Root

Root has patched CVE-2024-34069 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-46136 CVE-2023-46136 in Werkzeug - Patched by Root

Root has patched CVE-2023-46136 in the Werkzeug package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-22195 CVE-2024-22195 in Jinja2 - Patched by Root

Root has patched CVE-2024-22195 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-56326 CVE-2024-56326 in Jinja2 - Patched by Root

Root has patched CVE-2024-56326 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-V396-V7Q4-X2QJ GHSA-v396-v7q4-x2qj in GitPython - Patched by Root

Root has patched GHSA-v396-v7q4-x2qj in the GitPython package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-55255 CVE-2026-55255 in langflow - Patched by Root

Root has patched CVE-2026-55255 in the langflow package for Root:PyPI. Multiple fixed versions available...