17757 matches found
PYSEC-2026-1784 Picklescan has a missing detection when calling built-in python idlelib.autocomplete.AutoComplete.get_entity
Summary Using idlelib.autocomplete.AutoComplete.getentity, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.autocomplete.AutoComplete.getentity functio...
Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
SummaryUsing idlelib.calltip.Calltip.fetchtip, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to idlelib.calltip.Calltip.fetchtip function in reduce methodThen wh...
PYSEC-2026-1781 Picklescan has a missing detection when calling built-in python idlelib.debugobj.ObjectTreeItem
Summary Using idlelib.debugobj.ObjectTreeItem.SetText, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.debugobj.ObjectTreeItem.SetText function in...
Picklescan is missing detection when calling built-in python ensurepip._run_pip
SummaryUsing ensurepip.runpip function, which is a built-in python library function to execute remote pickle file. DetailsThe attack payload executes in the following steps:First, the attacker craft the payload by calling to ensurepip.runpip function in reduce methodThen when the victim after...
PYSEC-2026-1786 Picklescan has a missing detection when calling built-in python idlelib.calltip.Calltip
Summary Using idlelib.calltip.Calltip.fetchtip, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to idlelib.calltip.Calltip.fetchtip function in reduce method The...
PYSEC-2026-1792 Picklescan is missing detection when calling built-in python ensurepip._run_pip
Summary Using ensurepip.runpip function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to ensurepip.runpip function in reduce method Then when the victim after...
PYSEC-2026-1985 Transformers vulnerable to ReDoS attack through its get_imports() function
A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically in the getimports function within dynamicmoduleutils.py. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular...
forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2025-32962 via flask-appbuilder (1.10.0)
flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2025-32962 Source advisory: OSV:PYSEC-2026-1379...
PYSEC-2026-1069 Malicious code in instructor-mcp (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of instructor-mcp were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials...
Malicious code in dreamgen (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08,malicious phantom releases of dreamgen were published to PyPI using stolencredentials. The package executes a bundled JavaScript payload via the Bunruntime on import that harvests and exfiltrates credentials and...
PYSEC-2026-1068 Malicious code in dreamgen (PyPI)
Part of the "Hades" wave of the Shai-Hulud supply-chain campaign. On 2026-06-08, malicious phantom releases of dreamgen were published to PyPI using stolen credentials. The package executes a bundled JavaScript payload via the Bun runtime on import that harvests and exfiltrates credentials and...
cklauth (>=0.1.0, <=0.3.0), django-models-logging (1.0.0) +9 more potentially affected by CVE-2026-53877 via django (2.0.0)
django PYPI version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - cklauth =0.1.0, =0.1.0, =1.7.0, =1.7.2 - djangotheming 0.1.0 - fastaudiovisal 0.0.1 - fastaudiovisual 0.0.1 - ip2l 8.5.1 - prediction 0.0.3 -...
@edgebrix-sdk/react (>=0.0.58, <=0.0.74), @kimia_software/tellair-wc (0.0.0) +16 more potentially affected by CVE-2026-56812 via phoenix (>=1.6.2, <=1.6.16)
phoenix NPM version =1.6.2, =0.0.58, =0.8.10, =0.1.8, =0.1.5, =0.1.0-rc0, =0.8.1, =0.0.1, =0.0.1, =0.0.0-PR-1--182e1d3, =19.0.0-beta.1, =1.0.23, =0.3.0, =0.1.1, =0.1.6 and more Source cves: CVE-2026-56812 Source advisory: OSV:EEF-CVE-2026-56812...
Malicious code in chai-chain-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1964693dd7c2bdd9ca7ae20eb441597571b1b78a689bd97648998c6442bda99 Package impersonates the pino logger exports module.exports.pino, README uses pino badge, keywords mimic pino but its actual behavior is a remote cod...
Malware in chai-chain-dom
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2026-6919 Malicious code in chai-chain-dom (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1964693dd7c2bdd9ca7ae20eb441597571b1b78a689bd97648998c6442bda99 Package impersonates the pino logger exports module.exports.pino, README uses pino badge, keywords mimic pino but its actual behavior is a remote cod...
forge-event-chain (>=0.1.1, <=0.27.0) potentially affected by CVE-2024-45314 via flask-appbuilder (1.10.0)
flask-appbuilder PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on flask-appbuilder and may be impacted: - forge-event-chain =0.1.1, =0.27.0 Source cves: CVE-2024-45314 Source advisory: OSV:PYSEC-2026-1382...
CLSA-2026-1783433790 Fix CVE(s): CVE-2026-22016
OpenJDK 8u492 release + CVE-2026-22007: enhance crypto algorithm support + CVE-2026-22013: improve Kerberos credentialing + CVE-2026-22016: enhance Path Factories Redux + CVE-2026-22018: enhance Zip file reading + CVE-2026-22021: enhance certificate chain validation + CVE-2026-23865: update...