ROOT-APP-PYPI-CVE-2026-27962 CVE-2026-27962 in Authlib - Patched by Root

Root has patched CVE-2026-27962 in the Authlib package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48782 CVE-2026-48782 in pydantic-ai-slim - Patched by Root

Root has patched CVE-2026-48782 in the pydantic-ai-slim package for Root:PyPI. Multiple fixed versions available...

arbor-ai (>=0.1.5, <=0.1.14), coreason-runtime (>=0.1.0, <=0.11.1) +12 more potentially affected by CVE-2026-15977 via sglang (>=0.1.26, <=0.5.19)

sglang PYPI version =0.1.26, =0.1.5, =0.1.0, =1.1.0rc1, =2.0.0b40, =0.4.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1.post1, =0.1.1, =0.0.0, =0.8.0, =0.10.8 Source cves: CVE-2026-15977 Source advisory: SNYK:PYTHON-SGLANG-19432281...

Not Failing Securely ('Failing Open')

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Not Failing Securely 'Failing Open' in the install function of PyPIExtensionManager when the allowlist/blocklist check is not properly enforced due to a missing await. An attacker ca...

ROOT-APP-PYPI-CVE-2026-7722 CVE-2026-7722 in rootio-prefect - Patched by Root

Root has patched CVE-2026-7722 in the rootio-prefect package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-3515 CVE-2026-3515 in rootio-prefect - Patched by Root

Root has patched CVE-2026-3515 in the rootio-prefect package for Root:PyPI. Multiple fixed versions available...

MAL-2026-10992 Malicious code in dev-helper-bg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce930400319131adb4adf9f442340165a52a3ebd8320c497d1de05a3f896cac3 On import devhelper, devhelper/init.py calls startdecryptor at module top level, which spawns a daemon thread running decryptandrun. That function...

ROOT-APP-PYPI-CVE-2026-25645 CVE-2026-25645 in rootio-requests - Patched by Root

Root has patched CVE-2026-25645 in the rootio-requests package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-47081 CVE-2024-47081 in rootio-requests - Patched by Root

Root has patched CVE-2024-47081 in the rootio-requests package for Root:PyPI. Multiple fixed versions available...

PT-2026-71917

Name of the Vulnerable Software and Affected Versions jupyterlab versions 4.5.0 through 4.5.9 jupyterlab versions 4.6.0 through 4.6.1 Description The PyPI extension manager in JupyterLab fails to properly enforce blocked extensions uris because it uses a custom normalization process that is weake...

PT-2026-71454

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.6.0 through 4.6.1 JupyterLab versions 4.5.0 through 4.5.9 Description An enforcement gap exists in the PyPIExtensionManager.install function due to a missing await keyword, which prevents the is install allowed coroutine...

Malicious code in reimagined-broccoli (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70b417d0787324aa952fe69c59b47f6bea108ab02fd20241a6597c2ee0e6f3d8 The package reimagined-broccoli ships a benign-looking stub at reimaginedbroccoli/main.py that only prints a success message. The tarball also ships...

Malicious code in automatic-octo-invention (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e2dfb4e3eedab24e355b6d24db6096e6752563e220d28e83ad2cf213fe49fd89 The package ships an 8.6 MB stripped ELF binary at automaticoctoinvention/claw sha256 f6fe45f8fe9081987505af31f0249021a65b558af514f2e4e37340fb3182805...

ROOT-APP-PYPI-CVE-2025-71176 CVE-2025-71176 in rootio-pytest - Patched by Root

Root has patched CVE-2025-71176 in the rootio-pytest package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-49476 CVE-2026-49476 in rootio-soupsieve - Patched by Root

Root has patched CVE-2026-49476 in the rootio-soupsieve package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-6866 CVE-2024-6866 in rootio-flask-cors - Patched by Root

Root has patched CVE-2024-6866 in the rootio-flask-cors package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-6839 CVE-2024-6839 in rootio-flask-cors - Patched by Root

Root has patched CVE-2024-6839 in the rootio-flask-cors package for Root:PyPI. Multiple fixed versions available...

Malicious code in nemopush (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58d2958d0307dfe5b73dc1eef5a46e96c25f94ea31a0b4ab8b43a1878d427d2d The package advertises itself as 'A push notification package' but ships an 8.6 MB opaque ELF x86-64 binary named claude and a start.sh wrapper as...

MAL-2026-10864 Malicious code in kimichat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b57c88bce76fccb6cb2b3a99ef53a62402a8d56b4918ba4c7f2b634036317093 The package presents itself as a 'Python wrapper for the bundled kimichat runtime' and exposes a kimichat-run console script plus kimichat.run...

Malicious code in trongridme (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 04117292d543eae5a1d22c78d8a4507cc196c8770c9fb0a09ae2f9a10a8009d4 Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...