addownloader (0.2.11), airosentris (>=0.1.8, <=0.1.31) +207 more potentially affected by CVE-2026-54059 via pillow (11.0.0)

pillow PYPI version 11.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - addownloader 0.2.11 - airosentris =0.1.8, =0.0.0, =24.11.0, =3.0.0.dev38, =0.4.0rc6, =0.2.2b2, =0.1.2, =4.2.1, =0.8.26, =0.2.0, =0.4.0, =0.60.2,...

Amazon Linux 2023 : python3, python3-devel, python3-idle (ALAS2023-2026-1933)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1933 advisory. The tarfile module would still apply normalization of AREGTYPE \x00 blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPELONGNAME or GNUTYPELONGLINK. This could result ...

CVE-2026-11972 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-4360 vulnerabilities

Vulnerabilities for packages: python...

GHSA-G345-7JG6-M22P vulnerabilities

Vulnerabilities for packages: python...

GHSA-GF2W-JQMQ-FCM8 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-0864 vulnerabilities

Vulnerabilities for packages: python...

GHSA-9MC4-RQMQ-H467 vulnerabilities

Vulnerabilities for packages: python...

GHSA-WQXF-PJXH-HH4H vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-4360 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-11940 vulnerabilities

Vulnerabilities for packages: python...

GHSA-G345-7JG6-M22P vulnerabilities

Vulnerabilities for packages: python...

agatta (>=0.9.1, <=0.9.4), automate3 (2023.11.7) +5 more potentially affected by CVE-2026-54531 via pypdf (3.17.0)

pypdf PYPI version 3.17.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - agatta =0.9.1, =1698926697.0.0, =9.2.3, =9.2.6 - uniflow 0.0.7 Source cves: CVE-2026-54531 Source advisory: OSV:PYSEC-2026-3022...

dagster-mlflow (>=0.19.11, <=0.21.4), databricks-session (0.1.9) +14 more potentially affected by CVE-2025-15031 via mlflow (1.27.0)

mlflow PYPI version 1.27.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - dagster-mlflow =0.19.11, =0.3.0, =0.0.4.dev3, =3.0.1, =4.0.2, =0.1.0, =3.2.18, =0.1.0, =0.0.1.dev202206240024, =0.1.0, =0.1.5 and more Source cves:...

abba-python (>=0.1.6, <=0.3.0), adversal-embedding (>=0.0.1, <=0.0.7) +52 more potentially affected by CVE-2022-35971 via tensorflow (1.15.0)

tensorflow PYPI version 1.15.0 is affected by a known vulnerability. The following packages have a transitive dependency on tensorflow and may be impacted: - abba-python =0.1.6, =0.0.1, =0.2.6, =2023.1.0, =0.2.11, =0.0.4, =0.10.0, =0.10.1 - deepaclive 0.1.0 and more Source cves: CVE-2022-35971...

CVE-2026-59890

setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages. Prior to 83.0.0, FileList applied MANIFEST.in exclude, global-exclude, recursive-exclude, and prune directives by matching compiled glob patterns against on-disk file names without Unico...

aiomisc-pytest (1.2.1), bayesnestor (0.1.8) +23 more potentially affected by CVE-2025-71176 via pytest (8.2.0)

pytest PYPI version 8.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on pytest and may be impacted: - aiomisc-pytest 1.2.1 - bayesnestor 0.1.8 - camel-oasis =0.0.1, =0.1.21, =2.0.0.1, =4.3.0, =0.1.0, =0.1.0, =0.9.0b13, =0.2.0, =0.1.0, =0.3.3 and more...

django-freeradius (0.1.0), genalog (>=0.1.0rc4, <=0.1.0) +6 more potentially affected by CVE-2026-49452 via weasyprint (51.0.0)

weasyprint PYPI version 51.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on weasyprint and may be impacted: - django-freeradius 0.1.0 - genalog =0.1.0rc4, =0.1.0, =0.0.8, =3.4.0, =0.0.3, =1.0.0, =1.1.1 Source cves: CVE-2026-49452 Source advisory:...

MAL-2026-6751 Malicious code in bytekit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bbaea22b635a4a8425964572b733b806f45714a9090492d1c39d545088fe336 The package was found to contain malicious code or consuming dependency that contains malicious code Source: kam193...

LLM-Enhanced Hierarchical Heterogeneous Graph Representation Learning for Malicious Python Package Detection

Malicious Python packages have become a major threat to software supply chain ecosystems due to the widespread adoption of open-source repositories such as PyPI. Existing learning-based detection methods struggle to capture the hierarchical organization and heterogeneous interactions among...