hlvox (0.3.10), python-whiteprint (0.7.0) +2 more potentially affected by CVE-2026-102938 via virtualenv (20.16.5)

virtualenv PYPI version 20.16.5 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hlvox 0.3.10 - python-whiteprint 0.7.0 - traffic-guardian =1.0.1, =0.1.9, =0.3.7 Source cves: CVE-2026-102938 Source advisory:...

python-webex-bot (0.51.0) potentially affected by CVE-2026-102938 via virtualenv (16.4.3)

virtualenv PYPI version 16.4.3 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - python-webex-bot 0.51.0 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

cateye (>=0.3.4, <=0.3.8), edx-completion (>=0.0.1, <=0.1.1) +4 more potentially affected by CVE-2026-102938 via virtualenv (15.1.0)

virtualenv PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cateye =0.3.4, =0.0.1, =0.5.7, =1.0.0rc1, =1.2.0, =1.7.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

dcoscli (>=0.1.9, <=0.4.6), python-mu (>=1.0.1, <=1.0.3) +1 more potentially affected by CVE-2026-102938 via virtualenv (13.1.2)

virtualenv PYPI version 13.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dcoscli =0.1.9, =1.0.1, =0.2.23, =0.2.34 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

c2cciutils (>=1.1.47, <=1.1.58), dai-python-commons (5.4.16) +4 more potentially affected by CVE-2026-102938 via virtualenv (20.26.6)

virtualenv PYPI version 20.26.6 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - c2cciutils =1.1.47, =0.20.0, =0.20.1 - rosettapy 0.2.3rc181.post1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-102938 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

limbo (8.6.1), python-thingiverse (>=0.0.6rc1.dev0, <=0.0.7.dev0) +1 more potentially affected by CVE-2026-102938 via virtualenv (20.13.1)

virtualenv PYPI version 20.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - limbo 8.6.1 - python-thingiverse =0.0.6rc1.dev0, =0.26.0, =0.26.1 Source cves: CVE-2026-102938 Source advisory: OSV:GHSA-9H9J-4VRJ-GF7G...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-100689 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-100689 Source advisory: OSV:GHSA-59CR-6R3X-644W...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-87819 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-87819 Source advisory: OSV:GHSA-G5VV-9GXW-82HX...

cabrita (>=2.2.2b1, <=2.2.2b2), cico (>=0.1.0, <=0.1.8) +4 more potentially affected by CVE-2026-87817 via gitpython (2.1.10)

gitpython PYPI version 2.1.10 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - cabrita =2.2.2b1, =0.1.0, =0.1.0, =3.11.1, =0.9.0, =0.9.7.2 Source cves: CVE-2026-87817 Source advisory: OSV:GHSA-239G-WHFQ-7XJ9...

sealights-python-agent (>=0.2.213, <=0.2.247) potentially affected by CVE-2026-87817 via gitpython (2.1.13)

gitpython PYPI version 2.1.13 is affected by a known vulnerability. The following packages have a transitive dependency on gitpython and may be impacted: - sealights-python-agent =0.2.213, =0.2.247 Source cves: CVE-2026-87817 Source advisory: OSV:GHSA-239G-WHFQ-7XJ9...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

Arbitrary Code Injection

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Arbitrary Code Injection via the executepythoncode function. An attacker can execute arbitrary Python code in the service environment by sending crafted WebSocket...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), acapy-agent (>=1.5.1rc0, <=1.7.0) +308 more potentially affected by CVE-2026-103001 via pyjwt (>=2.11.0, <=2.13.0)

pyjwt PYPI version =2.11.0, =0.5.3, =1.5.1rc0, =0.1.8, =0.0.116, =1.5.0a9, =0.7.0rc9, =1.405.15, =26.2.0, =4.1.102, =1.2.1, =0.0.17, =0.23.0, =0.51.0, =0.62.0 and more Source cves: CVE-2026-103001 Source advisory: SNYK:PYTHON-PYJWT-20341561...

AZL-105642 CVE-2026-103001 affecting package python-jwt for versions less than 2.15.1-1

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

UBUNTU-CVE-2026-103001

PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT.mergeoptions method can modify a caller-supplied mutable options mapping when verifysignature is false. If an application reuses that same mapping for a later decode or decodecomplete call and...

python: Quadratic complexity in os.path.expandvars() with user-controlled template

A vulnerability in Python’s os.path.expandvars function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denia...

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit CPU resources. This leads to...

CVE-2026-51857

In camel-ai camel 0.2.91a1, v0.2.91a2 and v0.2.91a3, CodeExecutionToolkit can run model-produced Python code through SubprocessInterpreter without an approval boundary...

CVE-2026-51853

agent-zero 1.7, 1.8, 1.9, and 1.10 is vulnerable to Directory Traversal in python/helpers/filebrowser.py:FileBrowser.init. The FileBrowser class initializes with the host root directory as the workspace, allowing the agent to access any file on the system without restriction...