ROOT-APP-PYPI-CVE-2023-26302 CVE-2023-26302 in rootio-markdown_it_py - Patched by Root

Root has patched CVE-2023-26302 in the rootio-markdownitpy package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-58065 CVE-2025-58065 in rootio-Flask-AppBuilder - Patched by Root

Root has patched CVE-2025-58065 in the rootio-Flask-AppBuilder package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-32962 CVE-2025-32962 in rootio-Flask-AppBuilder - Patched by Root

Root has patched CVE-2025-32962 in the rootio-Flask-AppBuilder package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-62801 CVE-2025-62801 in rootio-fastmcp - Patched by Root

Root has patched CVE-2025-62801 in the rootio-fastmcp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-C2JP-C369-7PVX GHSA-c2jp-c369-7pvx in rootio-fastmcp - Patched by Root

Root has patched GHSA-c2jp-c369-7pvx in the rootio-fastmcp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-64439 CVE-2025-64439 in rootio-langgraph-checkpoint - Patched by Root

Root has patched CVE-2025-64439 in the rootio-langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-68131 CVE-2025-68131 in rootio-cbor2 - Patched by Root

Root has patched CVE-2025-68131 in the rootio-cbor2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-VP47-9734-PRJW GHSA-vp47-9734-prjw in rootio-asteval - Patched by Root

Root has patched GHSA-vp47-9734-prjw in the rootio-asteval package for Root:PyPI. Multiple fixed versions available...

5dee (0.1.0), a2 (>=0.1.0, <=0.7.0) +5185 more potentially affected by CVE-2026-10705 via dask (>=0.11.0, <=2026.8.0)

dask PYPI version =0.11.0, =0.1.0, =0.4.0, =0.9.1.dev0, =0.1.0, =25.9.23, =0.1.0, =0.4.5, =1.0.0, =0.4.1, =0.0.1, =2026.4.17, =0.1.14, =0.1.23 and more Source cves: CVE-2026-10705 Source advisory: SNYK:PYTHON-DASK-17138893...

Malicious code in spaysrbdata (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2d461e4f26b3a0fb04120613c34e74745f6d63ce83abe98c40e470c527921501 The package exfiltrates Roblox cookies from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

a2 (>=0.1.0, <=0.3.17), abadpour (>=6.13.1, <=7.24.1) +978 more potentially affected by CVE-2026-3198 via mlflow (>=0.8.2, <=3.16.1)

mlflow PYPI version =0.8.2, =0.1.0, =6.13.1, =9.273.1, =1.1.0, =0.1.0, =0.1.0, =0.4.4, =0.0.5, =1.0.0, =0.1.0, =0.1.42, =0.1.44 - aidevelopementtoolkit 0.2.0 and more Source cves: CVE-2026-3198 Source advisory: SNYK:PYTHON-MLFLOW-17231495...

arbor-ai (>=0.1.5, <=0.1.14), coreason-runtime (>=0.1.0, <=0.11.1) +12 more potentially affected by CVE-2026-10300 via sglang (>=0.1.26, <=0.5.21)

sglang PYPI version =0.1.26, =0.1.5, =0.1.0, =1.1.0rc1, =2.0.0b40, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1.post1, =0.1.1, =0.0.0, =0.8.0, =0.10.9 Source cves: CVE-2026-10300 Source advisory: SNYK:PYTHON-SGLANG-17739025...

agent-vm-hermes-adapter (>=0.0.116, <=0.0.132), apify-hermes-agent-plugin (>=0.1.0, <=0.1.4) +18 more potentially affected by CVE-2026-10224 via hermes-agent (>=0.13.0, <=0.19.0)

hermes-agent PYPI version =0.13.0, =0.0.116, =0.1.0, =0.1.3, =0.1.0, =3.0.0, =0.1.2, =2.5.17, =0.3.0, =0.9.0, =0.1.0a16, =1.0.1, =1.0.0, =1.0.2, =1.0.21 and more Source cves: CVE-2026-10224 Source advisory: SNYK:PYTHON-HERMESAGENT-18507995...

agent-vm-hermes-adapter (>=0.0.116, <=0.0.132), apify-hermes-agent-plugin (>=0.1.0, <=0.1.4) +18 more potentially affected by CVE-2026-10221 via hermes-agent (>=0.13.0, <=0.19.0)

hermes-agent PYPI version =0.13.0, =0.0.116, =0.1.0, =0.1.3, =0.1.0, =3.0.0, =0.1.2, =2.5.17, =0.3.0, =0.9.0, =0.1.0a16, =1.0.1, =1.0.0, =1.0.2, =1.0.21 and more Source cves: CVE-2026-10221 Source advisory: SNYK:PYTHON-HERMESAGENT-18507994...

adversarial-workflow (>=0.4.0, <=0.9.8), ai-shell-agent (>=0.2.0, <=0.2.2) +24 more potentially affected by CVE-2026-10177 via aider-chat (>=0.69.1, <=0.86.2)

aider-chat PYPI version =0.69.1, =0.4.0, =0.2.0, =1.3.0, =0.1.0, =0.0.6, =0.1.2, =0.1.0, =0.0.4, =0.1.0, =0.0.52, =0.1.0, =0.1.0, =0.1.0, =1.0.1 and more Source cves: CVE-2026-10177 Source advisory: SNYK:PYTHON-AIDERCHAT-17895039...

adversarial-workflow (>=0.4.0, <=0.9.8), ai-shell-agent (>=0.2.0, <=0.2.2) +24 more potentially affected by CVE-2026-10175 via aider-chat (>=0.69.1, <=0.86.2)

aider-chat PYPI version =0.69.1, =0.4.0, =0.2.0, =1.3.0, =0.1.0, =0.0.6, =0.1.2, =0.1.0, =0.0.4, =0.1.0, =0.0.52, =0.1.0, =0.1.0, =0.1.0, =1.0.1 and more Source cves: CVE-2026-10175 Source advisory: SNYK:PYTHON-AIDERCHAT-17895038...

Malicious code in lib-1779997093-yjeeqn (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 adfe3f8b85f731f407f8da6669a76b821b042e4ea1f2fd8fcfddf3293c2ca697 During installation, the package opens a reverse shell --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

MAL-2026-4747 Malicious code in edison-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c151a181047e12f1de0e91b1923861446b04558028d518e30df1767ccc85def7 At pip install time, setup.py reads the EDISONQUERY environment variable from the installer's environment and POSTs it to...

MAL-2026-4272 Malicious code in env-loader-cli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1749501a0825ad4a98638bbab4bd2bd9550436adcb9bb7781b6552735f7f3eb0 The package advertises itself as a benign.env/JSON/YAML loader but its top-level init.py imports a hidden core module that, on every import envloader...

MAL-2026-4269 Malicious code in mistral-evals (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f79806b5d197ed3b6beeedfb7092ad6da36d1d186ad57dc12be0b030c63726c9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...