bentodev (>=0.1.17, <=2018.11.2), confsave (>=0.1.0, <=0.3.0) +3 more potentially affected by CVE-2026-67326 via gitpython (2.1.3)

gitpython PYPI version 2.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - bentodev =0.1.17, =0.1.0, =0.9.0, =0.53.0 - reckoner 1.1.1 Source cves: CVE-2026-67326 Source advisory: OSV:PYSEC-2026-3980...

Malicious code in trtllm-subdir-test (PyPI)

Source: kam193 e8cdbb30c1c2ddf88a76d18b935d4accf68155f936b5df59a8864fafd7f4e06f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in nvtorch-oot-nightly (PyPI)

Source: kam193 0f81b904b849df393cbe5c34f952af65d8b28e0797e33d62cf964df77d4929c7 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

CVE-2026-67338

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

ac-solver (0.1.0), acedeploy (>=2.4.15, <=2.4.366.dev1) +911 more potentially affected by CVE-2026-67325 via gitpython (>=0.3.4, <=3.1.50)

gitpython PYPI version =0.3.4, =2.4.15, =2025.10.17, =0.4.0, =0.4.0, =1.2.3, =0.4.7, =0.4.7, =0.2.0, =0.1.8, =0.87.2.dev9, =0.5.0, =0.1.0.dev19, =1.3.0, =2.0.3 and more Source cves: CVE-2026-67325 Source advisory: MEND:CVE-2026-67325...

Malicious code in asdk-plugin-alphagen (PyPI)

Source: kam193 d3479f5a67e780468835828895609215d82aa5a273dfc152e4bae5a12f21a245 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in asdk-plugin-legacy (PyPI)

Source: kam193 65dd9dd087b805a16fb5d68c92cf2be0ec28fec162d75bb0eb81bb8d9bcfb61a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in asdk-plugin-ai-platform (PyPI)

Source: kam193 ba38202b0196fc58518ffc2cb0c0cd9067da9fec70d6bb371119b8175893b416 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in telerape (PyPI)

Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-telerape...

CVE-2026-67338: Improper Neutralization of Encoded URI Schemes in a Web Page

JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...

contextualized-topic-models (>=1.4.3, <=1.5.0) potentially affected by CVE-2026-68770 via sentence-transformers (0.3.5.1)

sentence-transformers PYPI version 0.3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =1.4.3, =1.5.0 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

contextualized-topic-models (>=1.5.2, <=1.7.1) potentially affected by CVE-2026-68770 via sentence-transformers (0.3.6)

sentence-transformers PYPI version 0.3.6 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =1.5.2, =1.7.1 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

genienlp (0.6.0a4) potentially affected by CVE-2026-68770 via sentence-transformers (1.0.4)

sentence-transformers PYPI version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - genienlp 0.6.0a4 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

byudml (>=0.7.2, <=0.7.3), mmt-retrieval (0.1.2) +1 more potentially affected by CVE-2026-68770 via sentence-transformers (1.2.1)

sentence-transformers PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - byudml =0.7.2, =0.0.4, =0.0.12 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

compcor (>=1.0.5, <=1.0.6) potentially affected by CVE-2026-68770 via sentence-transformers (2.2.1)

sentence-transformers PYPI version 2.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - compcor =1.0.5, =1.0.6 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

aces-metric (>=0.0.3, <=0.0.4), adv-bible-search (>=0.1.0, <=0.1.1) +154 more potentially affected by CVE-2026-68770 via sentence-transformers (2.2.2)

sentence-transformers PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - aces-metric =0.0.3, =0.1.0, =0.1.5, =1.2.3, =0.8.0, =1.0.1, =0.0.5.dev0, =0.1.0, =0.1.5.1, =0.1.1, =0.0.2, =0.0.5,...

aait (>=2.0.0, <=2.3.14), accutuning-helpers (>=1.0.32, <=1.0.33) +83 more potentially affected by CVE-2026-68770 via sentence-transformers (>=5.0.0, <=5.5.1)

sentence-transformers PYPI version =5.0.0, =2.0.0, =1.0.32, =0.1.0, =2026.5.22, =3.1.0, =3.9.11, =0.10.0, =0.4.13, =0.1.3, =0.1.18, =0.2.1a0, =0.1.2, =0.1.4 and more Source cves: CVE-2026-68770 Source advisory: GHSA-JHR6-GM9C-RQJV...

chem-mrl (>=0.5.7, <=0.5.8), frony-document-processor (0.3.0) potentially affected by CVE-2026-68770 via sentence-transformers (4.0.1)

sentence-transformers PYPI version 4.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - chem-mrl =0.5.7, =0.5.8 - frony-document-processor 0.3.0 Source cves: CVE-2026-68770 Source advisory:...

contextualized-topic-models (>=1.8.0, <=1.8.2) potentially affected by CVE-2026-68770 via sentence-transformers (0.4.1)

sentence-transformers PYPI version 0.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - contextualized-topic-models =1.8.0, =1.8.2 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...

hypertag (>=0.4.0, <=0.6.3.3.1), pororo (0.3.1) potentially affected by CVE-2026-68770 via sentence-transformers (0.4.1.2)

sentence-transformers PYPI version 0.4.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - hypertag =0.4.0, =0.6.3.3.1 - pororo 0.3.1 Source cves: CVE-2026-68770 Source advisory: OSV:GHSA-JHR6-GM9C-RQJV...