10734 matches found
ROOT-APP-PYPI-CVE-2026-54276 CVE-2026-54276 in aiohttp - Patched by Root
Root has patched CVE-2026-54276 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
Malicious code in reqcrypts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb4e239b6344dfe684483344d4d1a2da013a4d506b78d81e9096c6b31a690ae reqcrypts is published as a drop-in HTTP client import reqcrypts; reqcrypts.geturl but its RequestHandler wraps every JSON response through a...
MAL-2026-14341 Malicious code in reqcrypts (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7fb4e239b6344dfe684483344d4d1a2da013a4d506b78d81e9096c6b31a690ae reqcrypts is published as a drop-in HTTP client import reqcrypts; reqcrypts.geturl but its RequestHandler wraps every JSON response through a...
Malicious code in rc4-secure (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b7bcd1dcd28ea36c95e97448601f2414f34d53eabfc5452ec2471a316ebed97b The package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt invokes...
JupyterLab: PyPI extension blocklist package-name canonicalization bypass
JupyterLab's PyPI extension manager enforces blockedextensionsuris by comparing the requested install name to blocklist entries with a custom string normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as...
BIT-JUPYTERLAB-2026-73416 jupyterlab: PyPI extension blocklist package-name canonicalization bypass
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces...
Malicious code in reqcrypt-dev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...
MAL-2026-14274 Malicious code in reqcrypt-dev (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dcb6f64adb9e9635c1060d7c40db6006cad5446b87dcd7b20ceeb8ee7c6980f8 The package presents itself as a requests-style HTTP client but its response processor inspects every JSON response for the magic keys payloaddd,...
MAL-2026-14158 Malicious code in deepface-weight (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6808b9ae619e6cf9fdb59b52305e25b8e2fdb87167fbd78fae0ca6c1c07a5f1a On import, deepface-weight spawns a daemon background thread that polls the installer's working directory for data/telethonmarketuserbot.session for...
MAL-2026-14133 Malicious code in reqcrypt (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...
Malicious code in reqcrypt (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e5cdb52328dccd4eb61462c930b56f456dbdf759f0ce3005da3a7ecf4b688 reqcrypt presents itself as a general-purpose HTTP client, but its internal PayloadProcessor unconditionally inspects every HTTP response for JSON ke...
Malicious code in deepface-weights (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...
MAL-2026-14132 Malicious code in deepface-weights (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c1cf8a0f273b75a4cf2b66c9b9fc351023b9f77d61e82c74d74534424ce0558 On import, deepfaceweights starts a daemon thread that polls every 10 seconds for the file data/telethonmarketuserbot.session in the current working...
Incomplete List of Disallowed Inputs
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
Insufficient Verification of Data Authenticity
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
Use of Hard-coded Credentials
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
Use of Hard-coded Credentials
Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...
ROOT-APP-PYPI-CVE-2026-53537 CVE-2026-53537 in python-multipart - Patched by Root
Root has patched CVE-2026-53537 in the python-multipart package for Root:PyPI. Multiple fixed versions available...