Malicious code in qowa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 650ce7eeda9c50d942912db7495f8108fcc3b8447ff9bae79a1bd1b105c1b0d5 src/qowa/init.py contains calls to socket.gethostname at lines 30, 52, and 247 together with hardcoded Telegram Bot API endpoints...

securitybot

Securitybot Distributed alerting for the masses! Securitybot is an open-source implementation of a distributed alerting chat bot, as described in Ryan Huber's blog post. Distributed alerting improves the monitoring efficiency of your security team and can help you catch security incidents faster...

Idisagree

Idisagree v1.0 Control remote computers using discord bot and python 3. ! If your target is a windows system, you may want to compile your payload. Do this with py2exe or pyinstaller. MAINTAINERS Alisson Moretto | Twitter: @UndeadSec Github: @UndeadSec PREREQUISITES Python 3.x pip3 subprocess fro...

Source

LibreWolf Source Repository This repository contains all the patches and theming that make up LibreWolf, as well as scripts and a Makefile to build LibreWolf. There also is the Settings repository, which contains the LibreWolf preferences. LibreWolf overview graph LR FFSRCFirefox Source...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2026-111064 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2026-111064 Source...

ethereumd-proxy (>=0.1.2, <=0.3.0), homeassistant (>=0.49.0, <=0.50.2) +7 more potentially affected by CVE-2026-111063 via aiohttp (2.2.3)

aiohttp PYPI version 2.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - ethereumd-proxy =0.1.2, =0.49.0, =0.4.4, =0.1.1, =0.1.4, =0.1.0, =0.4.1b17, =0.6.0b3, =0.1.0b11, =0.1.0b19 Source cves: CVE-2026-111063 Source...

chatter

april 9, 2023 abandonware - sorry - busy elsewhere. will recode from scratch in a xplatform language in exchange for tons of money. october 6, 2021 this may soon no longer be abandonware. as for now it is very unstable. i'd like to recode it from scratch. description chatter is a proof of concept...

Malicious code in ukraine69 (PyPI)

Source: kam193 751255a551e996471674b44aea1cac8c92313caeaf22bb1584c96e4be5036b5a During import, package performs actions intended to escape sandbox, find Telegram-bot session files and initiate malicious account deletion. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

Malicious code in ukraine69 (PyPI)

Importing ukraine69 in versions 1.2.0–1.2.2 and 1.2.5–1.2.8 searches for local .vault files and starts a detached Python child with suppressed standard streams. Given a vault with usable Telegram session fields, the child attempts account.deleteAccount using GoyGram, with a Telethon fallback in...

Malicious code in marocolor (PyPI)

Source: kam193 38b0fa2ee77af46ad9daf78c024a0f599fd0798eef7605cb3eed50d8db65fa22 Package is intended for stealing files to a hardcoded location and performing a DoS on the victim's machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

Malicious code in marocolor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8206a6d3278ef99ffe6f33a695ca3dd6b4ed9856912d79f3066a375d95bcd509 On import of marocolor, a daemon thread recursively walks the user's home directory and uploads every file matching...

GHSA-HQM2-CFX2-2VGH Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development endpoints intentionally do not authenticate callers. The runner binds to localhost by default and is designed exclusively for local development. It is...

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat’s built-in development runner exposes endpoints that create bot sessions and, for the Daily transport, paid Daily rooms. These development endpoints intentionally do not authenticate callers. The runner binds to localhost by default and is designed exclusively for local development. It is...

EUVD-2026-101601

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: USB: Gadget: ftcm: Fixed NULL pointer dereferencing in nexus handling The pointer tpg-tpgnexus in the USB Target driver is dynamically managed and tied to userspace configuration via ConfigFS. It can become NULL if the USB host...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ipv6: fixed a lockdep issue in in6dumpaddrs According to reports from syzbot, we should not use rcudereference when rcureadlock is not held. WARNING: Suspicious RCU usage. 5.19.0-rc2-syzkaller 0 Not tainted...

2d6io-cryptobot (0.0.1), almanac-bot (>=0.3.1, <=0.3.2) +19 more potentially affected by CVE-2026-96749 via pymongo (3.5.1)

pymongo PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - 2d6io-cryptobot 0.0.1 - almanac-bot =0.3.1, =0.1.5, =0.1.2a0, =1.1.0, =0.4.11, =1.3.9, =0.43.0, =1.0.0, =1.0.4, =13.0.0, =11.1.0, =0.1.0, =1.0.1,...

2d6io-cryptobot (0.0.1), almanac-bot (>=0.3.1, <=0.3.2) +19 more potentially affected by CVE-2026-88029 via pymongo (3.5.1)

pymongo PYPI version 3.5.1 is affected by a known vulnerability. The following packages have a transitive dependency on pymongo and may be impacted: - 2d6io-cryptobot 0.0.1 - almanac-bot =0.3.1, =0.1.5, =0.1.2a0, =1.1.0, =0.4.11, =1.3.9, =0.43.0, =1.0.0, =1.0.4, =13.0.0, =11.1.0, =0.1.0, =1.0.1,...

CVE-2026-102682

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...

CVE-2026-102682 Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start, /daily, and /daily-dialin-webhook that can create bot...