MAL-2026-10911 Malicious code in mysuperlicense (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10910 Malicious code in mysupergoodpython (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-10909 Malicious code in ibreak (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in hello-world-test-mh2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13 setup.py decodes a base64 string and passes the result to exec at install time. The decoded payload is a single print statement that emits a benign...

MAL-2026-10908 Malicious code in hello-world-test-mh3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd Package is a trivial hello-world test artifact. setup.py contains an execbase64.b64decode... call at install time, but the decoded payload is a singl...

Malicious code in hello-world-test-mh3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd Package is a trivial hello-world test artifact. setup.py contains an execbase64.b64decode... call at install time, but the decoded payload is a singl...

MAL-2026-10907 Malicious code in hello-world-test-mh2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13 setup.py decodes a base64 string and passes the result to exec at install time. The decoded payload is a single print statement that emits a benign...

vibesec-static

vibesec-static — static vulnerability auditor for Python A si...

Malicious code in neroteam-v1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8a87642ea3c7a291704b2306a242bb496048571efcafb63835055f0871aed19 Importing the nero package triggers nero/init.py to load nero.main, whose top-level code runs a guard routine before executing a hidden payload. guar...

ROOT-APP-PYPI-CVE-2024-6221 CVE-2024-6221 in rootio-flask-cors - Patched by Root

Root has patched CVE-2024-6221 in the rootio-flask-cors package for Root:PyPI. Multiple fixed versions available...

Malicious code in vantrala (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1a8ea52e1b49fea90687ad77b199bd1ca8eda6666ce05c55e98e52c6da59ec The package presents itself as a 'Python wrapper for the bundled kimichat runtime' but the bundled 32MB ELF at src/vantrala/resources/kimichat is...

MAL-2026-10867 Malicious code in vantrala (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab1a8ea52e1b49fea90687ad77b199bd1ca8eda6666ce05c55e98e52c6da59ec The package presents itself as a 'Python wrapper for the bundled kimichat runtime' but the bundled 32MB ELF at src/vantrala/resources/kimichat is...

MAL-2026-10866 Malicious code in nemopush (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58d2958d0307dfe5b73dc1eef5a46e96c25f94ea31a0b4ab8b43a1878d427d2d The package advertises itself as 'A push notification package' but ships an 8.6 MB opaque ELF x86-64 binary named claude and a start.sh wrapper as...

Malicious code in kimichat (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b57c88bce76fccb6cb2b3a99ef53a62402a8d56b4918ba4c7f2b634036317093 The package presents itself as a 'Python wrapper for the bundled kimichat runtime' and exposes a kimichat-run console script plus kimichat.run...

[SECURITY] Fedora 43 Update: python-asyncssh-2.23.1-1.fc43

Python 3 library for asynchronous client and server-side SSH communication. It uses the Python asyncio module and implements many SSH protocol features such as the various channels, SFTP, SCP, forwarding, session multiplexing over a connection and more...

[SECURITY] Fedora 44 Update: python-asyncssh-2.24.0-1.fc44

Python 3 library for asynchronous client and server-side SSH communication. It uses the Python asyncio module and implements many SSH protocol features such as the various channels, SFTP, SCP, forwarding, session multiplexing over a connection and more...

Fedora 43 : python-pillow (2026-fc2ded926e)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-fc2ded926e advisory. Backport fixes for CVE-2026-59197 and CVE-2026-54058. ---- Fix CVE-2026-55380, CVE-2026-54060, CVE-2026-54059, CVE-2026-55379, CVE-2026-55798 Tenabl...

Fedora 44 : mingw-python-idna (2026-db2b7b6415)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-db2b7b6415 advisory. Update to 3.18. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not tested for this...

Oracle Linux 10 : python-markdown (ELSA-2026-19155)

The remote Oracle Linux 10 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-19155 advisory. 3.5.1-6.1 - Fix CVE-2025-69534 RHEL-153740 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note that...

Amazon Linux 2023 : python3.12, python3.12-devel, python3.12-idle (ALAS2023-2026-1954)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1954 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...