homeassistant (>=0.58.0, <=0.58.1), pyplanet (>=0.5.0, <=0.5.2) +1 more potentially affected by CVE-2026-59881 via aiohttp (2.3.2)

aiohttp PYPI version 2.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - homeassistant =0.58.0, =0.5.0, =0.6.0, =0.6.2 Source cves: CVE-2026-59881 Source advisory: OSV:PYSEC-2026-3547...

annotald (1.3.8), caterpillar (>=1.0.0.dev4, <=1.0.0.dev17) potentially affected by CVE-2026-12072 via nltk (2.0.5)

nltk PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald 1.3.8 - caterpillar =1.0.0.dev4, =1.0.0.dev17 Source cves: CVE-2026-12072 Source advisory: OSV:PYSEC-2026-3581...

annotald (1.3.8), caterpillar (>=1.0.0.dev4, <=1.0.0.dev17) potentially affected by CVE-2026-12074 via nltk (2.0.5)

nltk PYPI version 2.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on nltk and may be impacted: - annotald 1.3.8 - caterpillar =1.0.0.dev4, =1.0.0.dev17 Source cves: CVE-2026-12074 Source advisory: OSV:PYSEC-2026-3584...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +115 more potentially affected by CVE-2026-54621 via datamodel-code-generator (>=0.25.1, <=0.59.1)

datamodel-code-generator PYPI version =0.25.1, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.1.0, =0.6.0 and more Source cves: CVE-2026-54621 Source advisory: OSV:PYSEC-2026-3561...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +138 more potentially affected by CVE-2026-55391 via datamodel-code-generator (>=0.5.10, <=0.61.0)

datamodel-code-generator PYPI version =0.5.10, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-55391 Source advisory: OSV:PYSEC-2026-3565...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +138 more potentially affected by CVE-2026-55403 via datamodel-code-generator (>=0.5.10, <=0.61.0)

datamodel-code-generator PYPI version =0.5.10, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-55403 Source advisory: OSV:PYSEC-2026-3563...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +136 more potentially affected by CVE-2026-54691 via datamodel-code-generator (>=0.10.3, <=0.59.1)

datamodel-code-generator PYPI version =0.10.3, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-54691 Source advisory: OSV:PYSEC-2026-3564...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +124 more potentially affected by CVE-2026-54653 via datamodel-code-generator (>=0.17.1, <=0.59.1)

datamodel-code-generator PYPI version =0.17.1, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.1.0, =0.6.0 and more Source cves: CVE-2026-54653 Source advisory: OSV:PYSEC-2026-3555...

agency-swarm (>=1.9.8, <=1.9.9), aigear (>=0.0.2, <=0.2.1) +34 more potentially affected by CVE-2026-54655 via datamodel-code-generator (>=0.51.0, <=0.59.1)

datamodel-code-generator PYPI version =0.51.0, =1.9.8, =0.0.2, =1.3.5, =0.3.1, =0.9.0, =0.7.6, =0.14.2, =0.3.2, =1.2.1, =8.1.2, =0.6.0, =2.5.1, =3.0.4 and more Source cves: CVE-2026-54655 Source advisory: OSV:PYSEC-2026-3562...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +136 more potentially affected by CVE-2026-54690 via datamodel-code-generator (>=0.10.3, <=0.59.1)

datamodel-code-generator PYPI version =0.10.3, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.0.0, =0.1.0 and more Source cves: CVE-2026-54690 Source advisory: OSV:PYSEC-2026-3560...

aas-middleware (>=0.1.0, <=0.2.6), acex-client (>=0.0.6, <=4.6.0) +127 more potentially affected by CVE-2026-54654 via datamodel-code-generator (>=0.14.1, <=0.59.1)

datamodel-code-generator PYPI version =0.14.1, =0.1.0, =0.0.6, =0.0.1, =0.2.5, =0.1.0a0.dev0, =0.0.2, =0.1.1, =0.1.1, =0.1.13, =0.1.1, =0.1.0, =0.6.0 and more Source cves: CVE-2026-54654 Source advisory: OSV:PYSEC-2026-3566...

openwebui-token-tracking (0.1.7) potentially affected by CVE-2026-59223 via open-webui (0.6.0)

open-webui PYPI version 0.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on open-webui and may be impacted: - openwebui-token-tracking 0.1.7 Source cves: CVE-2026-59223 Source advisory: OSV:PYSEC-2026-3603...

stitchlab-agentcore (>=0.1.0, <=1.0.2), strands-compose-agentcore (0.1.1) potentially affected by CVE-2026-16796 via bedrock-agentcore (>=1.1.1, <=1.7.0)

bedrock-agentcore PYPI version =1.1.1, =0.1.0, =1.0.2 - strands-compose-agentcore 0.1.1 Source cves: CVE-2026-16796 Source advisory: OSV:PYSEC-2026-3551...

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

SummaryThe AWS Bedrock AgentCore Python SDK bedrock-agentcore provides tools for building AI agents, including a Code Interpreter client that installs Python packages into a managed sandbox. An issue exists where, under certain circumstances, improper neutralization of argument delimiters in the...

tk3u8 (>=0.3.2.dev19, <=0.4.0), tubefeed (2.1.5) +1 more potentially affected by CVE-2026-55404 via yt-dlp (2025.6.25)

yt-dlp PYPI version 2025.6.25 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - tk3u8 =0.3.2.dev19, =0.4.0 - tubefeed 2.1.5 - ytdl-sub 2025.6.27 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

yt-fts (>=0.1.55, <=0.1.59), yt-queue (0.10.2) +1 more potentially affected by CVE-2026-55404 via yt-dlp (2024.7.16)

yt-dlp PYPI version 2024.7.16 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - yt-fts =0.1.55, =0.1.59 - yt-queue 0.10.2 - ytdl-sub 2024.7.21 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

basketcase (1.0.1) potentially affected by CVE-2026-55404 via yt-dlp (2021.10.22)

yt-dlp PYPI version 2021.10.22 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - basketcase 1.0.1 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

amusing-app (>=0.2.0, <=0.4.2), music-tool-kit (>=1.3.9, <=1.3.21) +6 more potentially affected by CVE-2026-55404 via yt-dlp (2024.4.9)

yt-dlp PYPI version 2024.4.9 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - amusing-app =0.2.0, =1.3.9, =0.2.0, =0.0.5, =2024.4.26.post1, =2024.5.11 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

tubefeed (2.1.10), ytdl-sub (>=2025.8.27.post3, <=2025.8.29) potentially affected by CVE-2026-55404 via yt-dlp (2025.8.22)

yt-dlp PYPI version 2025.8.22 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - tubefeed 2.1.10 - ytdl-sub =2025.8.27.post3, =2025.8.29 Source cves: CVE-2026-55404 Source advisory: OSV:PYSEC-2026-3622...

arbi-tr-frontend (>=0.1.0, <=0.1.1), comiccrawler (>=2024.3.25, <=2024.12.9) +33 more potentially affected by CVE-2026-55404 via yt-dlp (2024.12.23)

yt-dlp PYPI version 2024.12.23 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - arbi-tr-frontend =0.1.0, =2024.3.25, =1.2.1, =0.0.1.2, =0.3.0, =0.1.0, =0.1.0, =0.0.23, =0.1.5, =0.0.11, =0.0.39 - mseep-owl 0.0.2 and more...