MAL-2026-7464 Malicious code in pygremlinbox-malware-network-indicators (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7462 Malicious code in pygremlinbox-malware-cryptomining-indicators (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7463 Malicious code in pygremlinbox-malware-install-execution (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7460 Malicious code in pygremlinbox-malware-code-obfuscation (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7459 Malicious code in pygremlinbox-malware-c2-beacon (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7458 Malicious code in pycryptoshuffle (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in pycryptoshuffle (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7457 Malicious code in piirgg (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7456 Malicious code in notrandompacketname (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7455 Malicious code in myproject234 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7454 Malicious code in cyberday26szymon-payments (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7453 Malicious code in cyberday26szymon-logging (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7452 Malicious code in cyberday26szymon-auth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1826 PyMongo Out-of-bounds Read in the bson module

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...

PYSEC-2026-1292 dbt allows Binding to an Unrestricted IP Address via socketsocket

Summary Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the risk of unauthorized access. While doing some static analysis and code inspection, I found the following code binding a socket to INADDRANY by passing "" as the address. This...

PYSEC-2026-1887 sagemaker-python-sdk Command Injection vulnerability

Impact The capturedependencies function in sagemaker.serve.saveretrive.version100.save.utils module before version 2.214.3 allows for potentially unsafe Operating System OS Command Injection if inappropriate command is passed as the “requirementspath” parameter. This consequently may allow an...

python-multipart vulnerable to Content-Type Header ReDoS

SummaryWhen using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options.An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely minutes or...

PYSEC-2026-1850 python-multipart vulnerable to Content-Type Header ReDoS

Summary When using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options. An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely minutes or...

PYSEC-2026-1283 Python Cryptography package vulnerable to Bleichenbacher timing oracle attack

A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data...

PYSEC-2026-1405 glance-store logs s3 access keys

A vulnerability was found in python-glance-store. The issue occurs when the package logs the accesskey for the glance-store when the DEBUG log level is enabled...