MAL-2026-7023 Malicious code in dbzy-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0432a46ed92acb897826fc16d26cba900bd3d18f0de5baa7f2909a44d9ec625 The package advertises itself as a network debugging tool but its CLI and modules compose a remote-access toolkit. The dbzy-tools console entry calls...

DEBIAN-CVE-2026-54590

AsyncSSH is a Python package which provides an asynchronous client and server implementation of the SSHv2 protocol on top of the Python asyncio framework. Version 2.23.0 contains an incomplete fix for CVE-2026-45309 in SSHServerConfig.settokens that blocks /, , and .. before %u substitution in...

UBUNTU-CVE-2026-55195

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expan...

UBUNTU-CVE-2026-55206

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo.read in archiveinfo.py used an On^2 cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted...

GHSA-P4GQ-832X-FM9V vulnerabilities

Vulnerabilities for packages: open-webui, py3-nltk...

CVE-2026-12243 vulnerabilities

Vulnerabilities for packages: py3-nltk...

CVE-2026-55206 py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, PackInfo.read in archiveinfo.py used an On^2 cumulative sum pattern for attacker-controlled numstreams values parsed from archive headers, allowing a crafted...

CVE-2026-55195 py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size

py7zr is a Python-based library and utility to support 7zip archive compression, decompression, encryption and decryption. Prior to 1.1.3, py7zr's Worker.decompress extracted archive entries without tracking total decompressed size, allowing a crafted .7z file such as a 15.6 KB archive that expan...

GHSA-G4RG-993R-MGX7 vulnerabilities

Vulnerabilities for packages: py3-captum...

GHSA-MP2F-45PM-3CG9 vulnerabilities

Vulnerabilities for packages: py3-captum...

GHSA-F8Q6-P94X-37V3 vulnerabilities

Vulnerabilities for packages: py3-captum...

GHSA-Q5H6-FCF5-49G9 vulnerabilities

Vulnerabilities for packages: py3-nltk...

CVE-2026-53486 vulnerabilities

Vulnerabilities for packages: py3-captum...

GHSA-W8QV-6JWH-64R5 vulnerabilities

Vulnerabilities for packages: arangodb, py3-captum...

CVE-2021-42740 vulnerabilities

Vulnerabilities for packages: py3-captum...

CVE-2021-23337 vulnerabilities

Vulnerabilities for packages: py3-captum...

GHSA-P4GQ-832X-FM9V vulnerabilities

Vulnerabilities for packages: py3-nltk, apache-beam-python-3.11-sdk, nemo, apache-beam-python-3.13-sdk, open-webui, apache-beam-python-3.12-sdk, label-studio...

CVE-2026-54293 vulnerabilities

Vulnerabilities for packages: py3-nltk, apache-beam-python-3.11-sdk, nemo, apache-beam-python-3.13-sdk, open-webui, apache-beam-python-3.12-sdk, label-studio...

PYSEC-2026-2323

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...

UBUNTU-CVE-2026-58501

Zeep is a Python SOAP client. From 4.0.0 before 4.3.3, Settings.forbidexternal is defined but not enforced when parsing WSDL or XSD documents, allowing transitive xsd:import, xsd:include, wsdl:import, and lxml entity or DTD references to fetch attacker-chosen HTTP or HTTPS URLs. This issue is fix...