MAL-2026-7467 Malicious code in scanvia (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7465 Malicious code in quatre (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7464 Malicious code in pygremlinbox-malware-network-indicators (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7462 Malicious code in pygremlinbox-malware-cryptomining-indicators (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7463 Malicious code in pygremlinbox-malware-install-execution (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7460 Malicious code in pygremlinbox-malware-code-obfuscation (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7459 Malicious code in pygremlinbox-malware-c2-beacon (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7458 Malicious code in pycryptoshuffle (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in pycryptoshuffle (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7457 Malicious code in piirgg (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7456 Malicious code in notrandompacketname (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7455 Malicious code in myproject234 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7454 Malicious code in cyberday26szymon-payments (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7453 Malicious code in cyberday26szymon-logging (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7452 Malicious code in cyberday26szymon-auth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1826 PyMongo Out-of-bounds Read in the bson module

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...

MLFlow unsafe deserialization

Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploaded PyFunc model to run arbitrary code on an end user’s system when interacted with...

PYSEC-2026-1292 dbt allows Binding to an Unrestricted IP Address via socketsocket

Summary Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the risk of unauthorized access. While doing some static analysis and code inspection, I found the following code binding a socket to INADDRANY by passing "" as the address. This...

PYSEC-2026-1887 sagemaker-python-sdk Command Injection vulnerability

Impact The capturedependencies function in sagemaker.serve.saveretrive.version100.save.utils module before version 2.214.3 allows for potentially unsafe Operating System OS Command Injection if inappropriate command is passed as the “requirementspath” parameter. This consequently may allow an...

python-multipart vulnerable to Content-Type Header ReDoS

SummaryWhen using form data, python-multipart uses a Regular Expression to parse the HTTP Content-Type header, including options.An attacker could send a custom-made Content-Type option that is very difficult for the RegEx to process, consuming CPU resources and stalling indefinitely minutes or...