homeassistant-stubs (2021.12.9), pytest-homeassistant-custom-component (0.5.13) potentially affected by CVE-2026-91129 via homeassistant (2021.12.9)

homeassistant PYPI version 2021.12.9 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2021.12.9 - pytest-homeassistant-custom-component 0.5.13 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.2.0b5), pytest-homeassistant-custom-component (0.6.4) potentially affected by CVE-2026-91129 via homeassistant (2022.2.0b5)

homeassistant PYPI version 2022.2.0b5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.2.0b5 - pytest-homeassistant-custom-component 0.6.4 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.3.0b1) potentially affected by CVE-2026-91129 via homeassistant (2022.3.0b1)

homeassistant PYPI version 2022.3.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.3.0b1 Source cves: CVE-2026-91129 Source advisory: OSV:GHSA-4GHV-53CQ-7WP3...

homeassistant-stubs (2022.11.5), hydroqc2mqtt (>=0.5.0, <=0.6.1) +1 more potentially affected by CVE-2026-91129 via homeassistant (2022.11.5)

homeassistant PYPI version 2022.11.5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.5 - hydroqc2mqtt =0.5.0, =0.6.1 - mqtt-hass-base 4.1.1 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.12.0b3), pytest-homeassistant-custom-component (0.12.25) potentially affected by CVE-2026-91129 via homeassistant (2022.12.0b3)

homeassistant PYPI version 2022.12.0b3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.12.0b3 - pytest-homeassistant-custom-component 0.12.25 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2022.12.4), pytest-homeassistant-custom-component (0.12.32) potentially affected by CVE-2026-91129 via homeassistant (2022.12.4)

homeassistant PYPI version 2022.12.4 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.12.4 - pytest-homeassistant-custom-component 0.12.32 Source cves: CVE-2026-91129 Source advisory:...

homeassistant-stubs (2023.2.3), hydroqc2mqtt (>=0.11.2, <=0.11.3) +2 more potentially affected by CVE-2026-91129 via homeassistant (2023.2.3)

homeassistant PYPI version 2023.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.2.3 - hydroqc2mqtt =0.11.2, =0.11.3 - mqtt-hass-base 4.2.0 - pytest-homeassistant-custom-component 0.12.55...

homeassistant-stubs (2023.8.0b2), pytest-homeassistant-custom-component (0.13.47) potentially affected by CVE-2026-91129 via homeassistant (2023.8.0b2)

homeassistant PYPI version 2023.8.0b2 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2023.8.0b2 - pytest-homeassistant-custom-component 0.13.47 Source cves: CVE-2026-91129 Source advisory:...

eq3btsmart (0.0.0) potentially affected by CVE-2026-91129 via homeassistant (2024.12.5)

homeassistant PYPI version 2024.12.5 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - eq3btsmart 0.0.0 Source cves: CVE-2026-91129 Source advisory: OSV:GHSA-4GHV-53CQ-7WP3...

homeassistant-stubs (2022.11.0b1), pytest-homeassistant-custom-component (0.12.12) potentially affected by CVE-2026-91129 via homeassistant (2022.11.0b1)

homeassistant PYPI version 2022.11.0b1 is affected by a known vulnerability. The following packages have a transitive dependency on homeassistant and may be impacted: - homeassistant-stubs 2022.11.0b1 - pytest-homeassistant-custom-component 0.12.12 Source cves: CVE-2026-91129 Source advisory:...

nucypher (>=0.1.0a17, <=0.1.0a20) potentially affected by CVE-2026-77528 via autobahn (19.2.1)

autobahn PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - nucypher =0.1.0a17, =0.1.0a20 Source cves: CVE-2026-77528 Source advisory: OSV:GHSA-HXP9-W8X3-P566...

brokerkit-zerodha (1.0.3), buckets-for-zerodha (0.1.0) +29 more potentially affected by CVE-2026-77528 via autobahn (19.11.2)

autobahn PYPI version 19.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - brokerkit-zerodha 1.0.3 - buckets-for-zerodha 0.1.0 - easy-kite-methods =0.0.1, =0.0.1, =1.0.0, =1.0.2, =0.19.0, =0.0.1, =0.0.1, =0.1.0, =0.1....

ezbeq (>=2.5.0, <=2.8.0), fiduswriter (>=4.1.1, <=5.0.0a3) +5 more potentially affected by CVE-2026-77528 via autobahn (25.12.2)

autobahn PYPI version 25.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on autobahn and may be impacted: - ezbeq =2.5.0, =4.1.1, =1.3.9, =0.28.0, =2.0.0, =2.2.1 - senbai 0.0.1 Source cves: CVE-2026-77528 Source advisory: OSV:GHSA-HXP9-W8X3-P566...

@0xsquid/mpp (>=0.1.1-beta.1, <=0.2.0), @agent-score/pay (>=0.1.0-rc.4, <=0.2.6) +171 more potentially affected by CVE-2026-63627 via mppx (>=0.1.1, <=0.7.0)

mppx NPM version =0.1.1, =0.1.1-beta.1, =0.1.0-rc.4, =0.0.1, =0.0.0-pr-246-20260515203519, =0.1.0, =0.1.0, =0.1.2, =0.1.1, =0.1.1, =0.1.0, =1.0.11, =1.0.0, =1.0.0, =2.4.0 and more Source cves: CVE-2026-63627 Source advisory: OSV:GHSA-727H-3VM5-QWQ6...

Malicious code in oracle-redis (npm)

Source: amazon-inspector c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6 The package publishes as oracle-redis but ships a verbatim copy of the ioredis README, source tree, and repository URL git://github.com/luin/ioredis.git, presenting itself as ioredis under a different name...

Malicious code in oracle-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6 The package publishes as oracle-redis but ships a verbatim copy of the ioredis README, source tree, and repository URL...

MAL-2026-16390 Malicious code in oracle-redis (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c800d0651330b1c1cd5d9c5cb2b6966eecefb2d2c28949d0670f485d820db3a6 The package publishes as oracle-redis but ships a verbatim copy of the ioredis README, source tree, and repository URL...

ac.pao:reports-java-engine (>=1.0.0, <=1.1.0), ae.alphapay:alphapay-gateway-client (2.0.0) +38235 more potentially affected by CVE-2026-89407 via com.fasterxml.jackson.core:jackson-core (>=2.17.1, <=2.18.10)

com.fasterxml.jackson.core:jackson-core MAVEN version =2.17.1, =1.0.0, =1.0.0, =1.0.0, =0.1.1, =0.1.0-rc4, =0.1.0-rc4, =0.1.3, =0.21.0-alpha.1, =0.2.0, =0.2.0, =0.2.0, =0.1.1, =0.86.0, =0.120.0 and more Source cves: CVE-2026-89407 Source advisory: SNYK:JAVA-COMFASTERXMLJACKSONCORE-20059677...

MAL-2026-16386 Malicious code in @mikudeveloper/baileys (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d03bf7166a5353a0b22409ebbb724ee53f24394c9ff340df668c970772796e28 This package is a fork of Baileys that declares libsignal in package.json as github:tenka-san/libsignal-node — a git dependency with no commit SHA,...

Malicious code in @user-services/web-components (npm)

Source: amazon-inspector 02523ee1cb3bbb9119054ec3ed14ffc62d0d33ae3bd44dc29312c772cdba106b @user-services/[email protected] fires a hidden telemetry probe on both the npm install lifecycle node index.js and on every require of the module. The probe in probe/impl.js reads os.userInfo.username,...