ai-parrot (>=0.5.0, <=0.5.17), aiagents4pharma (>=0.0.0, <=1.49.1) +4 more potentially affected by CVE-2026-26013 via langchain-core (0.3.40)

langchain-core PYPI version 0.3.40 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - ai-parrot =0.5.0, =0.0.0, =0.0.18, =0.0.21 Source cves: CVE-2026-26013 Source advisory: OSV:GHSA-2G6R-C272-W58R...

pdd-cli (>=0.0.28, <=0.0.94) potentially affected by CVE-2026-26013 via langchain-core (0.3.56)

langchain-core PYPI version 0.3.56 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - pdd-cli =0.0.28, =0.0.94 Source cves: CVE-2026-26013 Source advisory: OSV:GHSA-2G6R-C272-W58R...

datasetpipeline (>=0.1.7, <=0.2.1), document-qa-engine (>=0.5.1, <=0.6.0) +2 more potentially affected by CVE-2026-26013 via langchain-core (0.3.61)

langchain-core PYPI version 0.3.61 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - datasetpipeline =0.1.7, =0.5.1, =0.1.1, =0.1.7 Source cves: CVE-2026-26013 Source advisory: OSV:GHSA-2G6R-C272-W58R...

Malicious code in node-dotenv-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b47bebee6a74c00d3be10fad072e05074a62b29205377f682463290bad39c3 The package node-dotenv-cli was found to contain malicious code. Source: ghsa-malware 5bb66069e2bde985ae448962eaaf6373cd54aa2cd51fb20a0fef26ecb5dee2d...

MAL-2026-853 Malicious code in node-dotenv-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76b47bebee6a74c00d3be10fad072e05074a62b29205377f682463290bad39c3 The package node-dotenv-cli was found to contain malicious code. Source: ghsa-malware 5bb66069e2bde985ae448962eaaf6373cd54aa2cd51fb20a0fef26ecb5dee2d...

Malicious Package

Overview node-dotenv-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in node-dotenv-cli

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2026-25918

unity-cli is a command line utility for the Unity Game Engine. Prior to 1.8.2 , the sign-package command in @rage-against-the-pixel/unity-cli logs sensitive credentials in plaintext when the --verbose flag is used. Command-line arguments including --email and --password are output via...

[SECURITY] Fedora 42 Update: rust-oo7-cli-0.3.3-5.fc42

System keyring access from the terminal...

CVE-2026-26029: Improper Neutralization of Special Elements used in an OS Command

sf-mcp-server is an implementation of Salesforce MCP server for Claude for Desktop. A command injection vulnerability exists in sf-mcp-server due to unsafe use of childprocess.exec when constructing Salesforce CLI commands with user-controlled input. Successful exploitation allows attackers to...

azure-cli (>=2.0.58, <=2.0.66), azure-cli-appservice (>=0.2.13, <=0.2.20) +27 more potentially affected by CVE-2026-26007 via cryptography (2.4.2)

cryptography PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - azure-cli =2.0.58, =0.2.13, =1.5.5, =1.0.0b6, =18.4.0, =0.3.0rc1, =1.0.3, =0.1.0, =1.2.8, =1.0.5, =2.1.12 and more Source cves:...

agent-nebula-platform (>=5.0.0, <=5.0.1), agent-nebula-sdk (>=5.0.0, <=5.0.2) +151 more potentially affected by CVE-2026-26007 via cryptography (>=46.0.0, <=46.0.4)

cryptography PYPI version =46.0.0, =5.0.0, =5.0.0, =0.5.0rc4, =0.0.1, =0.13.12, =3.8.9, =0.2.50, =0.7.0, =3.0.0a1, =0.4.6, =0.4.7 - azure-quantum 3.13.0 and more Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

moca (0.3.3), oraclebmc (>=1.1.0, <=1.1.1) +2 more potentially affected by CVE-2026-26007 via cryptography (1.5.2)

cryptography PYPI version 1.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - moca 0.3.3 - oraclebmc =1.1.0, =2.1.0, =2.1.3 - teamvault 0.6.1 Source cves: CVE-2026-26007 Source advisory: OSV:PYSEC-2026-2141...

agent-nebula-platform (>=5.0.0, <=5.0.1), agent-nebula-sdk (>=5.0.0, <=5.0.2) +151 more potentially affected by CVE-2026-26007 via cryptography (>=46.0.0, <=46.0.4)

cryptography PYPI version =46.0.0, =5.0.0, =5.0.0, =0.5.0rc4, =0.0.1, =0.13.12, =3.8.9, =0.2.50, =0.7.0, =3.0.0a1, =0.4.6, =0.4.7 - azure-quantum 3.13.0 and more Source cves: CVE-2026-26007 Source advisory: GHSA-R6PH-V2QM-Q3C2...

airflow-run (0.4.9), ais-dom (>=0.117.0b0, <=2021.2.4) +49 more potentially affected by CVE-2026-26007 via cryptography (3.2.0)

cryptography PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - airflow-run 0.4.9 - ais-dom =0.117.0b0, =2.0.1.dev14, =2.0.2 - azureml-accel-models 1.23.0 - azureml-cli-common 1.23.0 -...

agent-nebula-platform (>=5.0.0, <=5.0.1), agent-nebula-sdk (>=5.0.0, <=5.0.2) +151 more potentially affected by CVE-2026-26007 via cryptography (>=46.0.0, <=46.0.4)

cryptography PYPI version =46.0.0, =5.0.0, =5.0.0, =0.5.0rc4, =0.0.1, =0.13.12, =3.8.9, =0.2.50, =0.7.0, =3.0.0a1, =0.4.6, =0.4.7 - azure-quantum 3.13.0 and more Source cves: CVE-2026-26007 Source advisory: OSV:GHSA-R6PH-V2QM-Q3C2...

biweeklybudget (>=0.1.0, <=0.7.0), crossbar (17.3.1) +6 more potentially affected by CVE-2026-26007 via cryptography (1.8.1)

cryptography PYPI version 1.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - biweeklybudget =0.1.0, =1.6.0, =1.1.2, =2.2.0, =0.3.4, =0.3.5 - typtop 0.2.11 Source cves: CVE-2026-26007 Source advisory:...

3lc (>=2.3.84, <=2.11.2), aba-cli-scrapper (>=0.1.0, <=0.5.6) +898 more potentially affected by CVE-2026-26007 via cryptography (42.0.8)

cryptography PYPI version 42.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - 3lc =2.3.84, =0.1.0, =2.3.57, =0.1.0, =0.4.0, =0.1.0, =0.0.1, =0.1.1, =1.0.0a1, =4.3.0, =0.12.0, =0.0.1rc1, =6.6.0rc1 and more Source...

ali2b-cli-scrapper (>=1.0.0, <=1.0.1), ambient-edge-server (>=0.1.2, <=0.2.4) +64 more potentially affected by CVE-2026-26007 via cryptography (42.0.7)

cryptography PYPI version 42.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ali2b-cli-scrapper =1.0.0, =0.1.2, =0.2.13, =0.1.10, =2.1.0rc1, =0.3.0, =0.3.9, =2.7.0, =0.1.2, =0.1.3 - edx-repo-tools 1.0.0 and more...

ais-dom (>=0.96.10, <=0.98.9), ali-cli (>=0.5.1, <=0.7.2) +52 more potentially affected by CVE-2026-26007 via cryptography (2.7.0)

cryptography PYPI version 2.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on cryptography and may be impacted: - ais-dom =0.96.10, =0.5.1, =0.0.1, =0.5.0, =1.0.1, =1.0.1, =0.0.5a0, =0.2.12, =2.5.6, =0.1.0, =0.5.1, =0.5.2 - duo-universal 1.0.1 -...