backend-ai-accelerator-cuda-open (>=25.6.3, <=26.8.3), backend-ai-accelerator-graphcore-ipu (>=25.19.0, <=26.4.3) +6 more potentially affected by CVE-2026-59890 via setuptools (80.0.1)

setuptools PYPI version 80.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - backend-ai-accelerator-cuda-open =25.6.3, =25.19.0, =25.6.3, =25.6.3, =25.6.3, =25.6.3, =6.0.3, =6.0.4 Source cves: CVE-2026-59890 Source...

aquests (>=0.7.16.17, <=0.7.16.18), backend-ai-common (1.3.1) +6 more potentially affected by CVE-2026-0994 via protobuf (3.5.2.post1)

protobuf PYPI version 3.5.2.post1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aquests =0.7.16.17, =1.3.2, =1.1.0, =0.4.1, =0.0.4, =0.8.2, =0.11.0 Source cves: CVE-2026-0994 Source advisory: OSV:PYSEC-2026-1805...

aiogremlin (3.2.6rc1), aiopogo (>=2.0.2, <=2.0.4) +22 more potentially affected by CVE-2025-69229 via aiohttp (2.2.5)

aiohttp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin 3.2.6rc1 - aiopogo =2.0.2, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =2.1.0rc1, =2.0.0, =0.51.0, =0.2.0, =0.0.0, =0.1.1, =1.6.2, =1.6.6 and more...

aiogremlin (3.2.6rc1), aiopogo (>=2.0.2, <=2.0.4) +22 more potentially affected by CVE-2025-53643 via aiohttp (2.2.5)

aiohttp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin 3.2.6rc1 - aiopogo =2.0.2, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =2.1.0rc1, =2.0.0, =0.51.0, =0.2.0, =0.0.0, =0.1.1, =1.6.2, =1.6.6 and more...

aquests (>=0.7.16.17, <=0.7.16.18), backend-ai-common (1.3.1) +6 more potentially affected by CVE-2025-4565 via protobuf (3.5.2.post1)

protobuf PYPI version 3.5.2.post1 is affected by a known vulnerability. The following packages have a transitive dependency on protobuf and may be impacted: - aquests =0.7.16.17, =1.3.2, =1.1.0, =0.4.1, =0.0.4, =0.8.2, =0.11.0 Source cves: CVE-2025-4565 Source advisory: OSV:PYSEC-2026-1806...

PYSEC-2026-1210 Backend.AI Missing Authorization vulnerability

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI. NOTE: The maintainers of BackendAI do not consider this report to fit...

Backend.AI Missing Authorization vulnerability

Missing Authorization in Lablup's BackendAI allows attackers to takeover all active sessions; Accessing, stealing, or altering any data accessible in the session. This vulnerability exists in all current versions of BackendAI.NOTE: The maintainers of BackendAI do not consider this report to fit...

aiogremlin (3.2.6rc1), aiopogo (>=2.0.2, <=2.0.4) +22 more potentially affected by CVE-2026-54277 via aiohttp (2.2.5)

aiohttp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin 3.2.6rc1 - aiopogo =2.0.2, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =2.1.0rc1, =2.0.0, =0.51.0, =0.2.0, =0.0.0, =0.1.1, =1.6.2, =1.6.6 and more...

arlbench (0.1.3), backend-ai-appproxy-coordinator (>=25.13.0rc1, <=26.8.3) +3 more potentially affected by CVE-2026-32722 via memray (>=1.12.0, <=1.17.2)

memray PYPI version =1.12.0, =25.13.0rc1, =25.13.0rc1, =26.2.0rc1, =26.4.4rc8 - feluda-image-vec-rep-resnet 0.1.0 Source cves: CVE-2026-32722 Source advisory: OSV:GHSA-R5PR-887V-M2W9...

EUVD-2025-17555

Malicious code in bioql PyPI...

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function due to missing authentication in the registration feature. An attacker with a registered user account can create user accounts that can access private data even when registration is disabled...

aiogremlin (3.2.6rc1), aiopogo (>=2.0.2, <=2.0.4) +22 more potentially affected by CVE-2024-23829 via aiohttp (2.2.5)

aiohttp PYPI version 2.2.5 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiogremlin 3.2.6rc1 - aiopogo =2.0.2, =0.1.1, =1.0.1, =1.0.0, =1.0.0, =2.1.0rc1, =2.0.0, =0.51.0, =0.2.0, =0.0.0, =0.1.1, =1.6.2, =1.6.6 and more...