voice-agent-tequity (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-62663 via banks (2.2.0)

banks PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on banks and may be impacted: - voice-agent-tequity =0.1.0, =0.1.1 Source cves: CVE-2026-62663 Source advisory: SNYK:PYTHON-BANKS-18507725...

Malicious code in mcp-search-server (PyPI)

Source: kam193 668e6c74d0665065f6c75fb03d82071cda10cea3ad8f1cd20068cbe2c702d728 Versions published since 2026-07 contain a stub 'share compute swarm' functionality for 'faster results'. The functionality was not fully implemented - the package only reports home on every run - but the other packag...

Malicious code in ai-perf-toolkit (PyPI)

Source: kam193 41d25387636c9b0b89a404304d079c30ad28bda33bb551e551cb9e15a75c00ba During import, the package starts cryptomining for a hardcoded wallet. The mining software has to already be installed. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

voice-agent-tequity (>=0.1.0, <=0.1.1) potentially affected by CVE-2026-62663 via banks (2.2.0)

banks PYPI version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on banks and may be impacted: - voice-agent-tequity =0.1.0, =0.1.1 Source cves: CVE-2026-62663 Source advisory: MEND:CVE-2026-62663...

quantguard (>=0.1.37, <=0.1.38), superset-sqlalchemy-gizmosql-adbc-dialect (>=0.0.3, <=0.0.9) potentially affected by CVE-2026-23981 via apache-superset (>=4.1.4, <=5.0.0)

apache-superset PYPI version =4.1.4, =0.1.37, =0.0.3, =0.0.9 Source cves: CVE-2026-23981 Source advisory: MEND:CVE-2026-23981...

Malicious code in phabricator-client (PyPI)

Source: kam193 1e92e5b2c5182be4ddf6a9acced6db4e6bb3c7413970c931b4abd47910b1bb26 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

safe-chain v1.5.14

Aikido Safe Chain ✅ Block malware on developer laptops and CI/CD ✅ Supports npm and PyPI more package managers coming ✅ Blocks packages newer than 48 hours without breaking your build ✅ Tokenless, free, no build data shared Need protection beyond npm & PyPI? Aikido Device Protection builds on Saf...

bravoserver (3.1.1), c2cciutils (>=1.1.0.dev20260322010408, <=1.1.75) +24 more potentially affected by CVE-2026-13346 via pip (>=26.0.0, <=26.1.2)

pip PYPI version =26.0.0, =1.1.0.dev20260322010408, =26.6.0, =2.38.0, =0.1.1, =0.9.478, =2602.1.0, =0.1.0, =0.1.0, =0.1.0, =1.6.1 and more Source cves: CVE-2026-13346 Source advisory: SNYK:PYTHON-PIP-18426311...

clai (>=2.0.0b1, <=2.4.0), email-to-calendar (>=1.0.67, <=20260703001012.0.0.dev0) +8 more potentially affected by CVE-2026-65975 via pydantic-ai-slim (>=2.0.0b1, <=2.4.0)

pydantic-ai-slim PYPI version =2.0.0b1, =2.0.0b1, =1.0.67, =1.0.0, =2.0.0b1, =2.0.0b1, =2.0.0b1, =1.0.1, =0.0.3a20, =2.48.1, =2.50.0 Source cves: CVE-2026-65975 Source advisory: SNYK:PYTHON-PYDANTICAISLIM-20877472...

python-dev-tools (>=2019.4.24, <=2019.5.3) potentially affected by CVE-2026-13346 via pip (19.1.0)

pip PYPI version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.4.24, =2019.5.3 Source cves: CVE-2026-13346 Source advisory: OSV:GHSA-QWM4-QH6W-59XR...

chalice (>=1.9.0, <=1.9.1), corgy-erp (>=0.0.1, <=1.0.7) potentially affected by CVE-2026-13346 via pip (19.2.0)

pip PYPI version 19.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - chalice =1.9.0, =0.0.1, =1.0.7 Source cves: CVE-2026-13346 Source advisory: OSV:GHSA-QWM4-QH6W-59XR...

junctionart (>=0.1.0, <=0.1.2) potentially affected by CVE-2026-13346 via pip (20.3.1)

pip PYPI version 20.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - junctionart =0.1.0, =0.1.2 Source cves: CVE-2026-13346 Source advisory: OSV:GHSA-QWM4-QH6W-59XR...

agave (>=0.1.8, <=0.2.2), argnorm (0.0.1rc1) +6 more potentially affected by CVE-2026-13346 via pip (21.2.4)

pip PYPI version 21.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - agave =0.1.8, =0.2.1, =1.24.1, =0.1.6, =1.0.2, =0.1.0, =0.1.5 Source cves: CVE-2026-13346 Source advisory: OSV:GHSA-QWM4-QH6W-59XR...

agave (0.2.3.dev0), ai-shell-agent (>=0.2.0, <=0.2.2) +30 more potentially affected by CVE-2026-13346 via pip (25.0.1)

pip PYPI version 25.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - agave 0.2.3.dev0 - ai-shell-agent =0.2.0, =0.74.3, =0.1.1, =1.31.4, =0.0.1, =0.0.1, =4.4.3, =0.1.0, =0.1.1 - iflow-mcp-iflytek-ifly-workflow-mcp-server...

agave (>=0.1.1, <=0.1.7), bankruptcy (>=0.0.2, <=0.0.5) +10 more potentially affected by CVE-2026-13346 via pip (21.0.1)

pip PYPI version 21.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - agave =0.1.1, =0.0.2, =0.2.0, =1.22.1, =0.0.60, =1.0.2, =2.0.3, =0.6.3, =0.0.7, =0.0.39, =0.5.0, =0.5.1 Source cves: CVE-2026-13346 Source advisory:...

aadetools (>=0.0.3, <=0.0.5), autocut3d (0.1.0) +14 more potentially affected by CVE-2026-13346 via pip (19.2.3)

pip PYPI version 19.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aadetools =0.0.3, =1.10.0, =0.1.4, =0.4.2, =2.0.0, =0.0.4, =0.2.4, =2019.9.2, =2019.10.22 - rtopy 0.1.0 - student-mixture 0.1.10 and more Source cves:...

codecraft-chat (>=0.82.4.dev64, <=0.82.4.dev69), cryptobot-python (0.1.9) +2 more potentially affected by CVE-2026-13346 via pip (25.1.0)

pip PYPI version 25.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - codecraft-chat =0.82.4.dev64, =0.0.21, =0.2.8 Source cves: CVE-2026-13346 Source advisory: OSV:GHSA-QWM4-QH6W-59XR...

adversarial-insight-ml (0.1.0), aiorobonect (>=0.2.6, <=0.2.8) +20 more potentially affected by CVE-2026-13346 via pip (23.2.1)

pip PYPI version 23.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - adversarial-insight-ml 0.1.0 - aiorobonect =0.2.6, =2.0.3, =1.2.0, =1.0.0, =4.2.0, =0.0.2, =0.0.2, =0.0.5 - musclex 1.23.0 and more Source cves:...

cherrypick (>=0.1.0, <=0.2.1), espercli (>=0.0.13, <=0.0.14) +2 more potentially affected by CVE-2026-13346 via pip (21.1.0)

pip PYPI version 21.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cherrypick =0.1.0, =0.0.13, =0.0.5, =0.0.8 Source cves: CVE-2026-13346 Source advisory: OSV:GHSA-QWM4-QH6W-59XR...

bravoserver (3.1.1), c2cciutils (>=1.1.0.dev20260322010408, <=1.1.75) +24 more potentially affected by CVE-2026-13346 via pip (>=26.0.0, <=26.1.2)

pip PYPI version =26.0.0, =1.1.0.dev20260322010408, =26.6.0, =2.38.0, =0.1.1, =0.9.478, =2602.1.0, =0.1.0, =0.1.0, =0.1.0, =1.6.1 and more Source cves: CVE-2026-13346 Source advisory: GHSA-QWM4-QH6W-59XR...