CVE-2026-65010 Datasets Symlink-following Arbitrary File Write via Extractor.extract()

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...

EUVD-2026-48361

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...

PT-2026-64148

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...

castor-extractor (>=0.21.7, <=0.21.9), ledfx (2.0.105) +3 more potentially affected by CVE-2026-59890 via setuptools (75.3.4)

setuptools PYPI version 75.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - castor-extractor =0.21.7, =3.41.0, =0.27.0, =0.1.0, =0.1.6 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

Malicious code in photo-extractor (PyPI)

Source: kam193 67f3f604528f125e85fb7be00bb17d7cf2abc5cdb20a12cbcbb38633f5877f14 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files through a Telegram as C2 channel. The package installs a gener...

aebo (>=0.3.0, <=0.9.0), aebo-pi (>=0.1.0, <=0.8.0) +173 more potentially affected by CVE-2026-59199 via pillow (9.0.1)

pillow PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aebo =0.3.0, =0.1.0, =1.3.0, =1.0.0, =0.4.10, =2.1.0, =0.5.3, =2.6.9, =0.2.3rc4, =1.1.1, =0.5.17, =1.0.0, =22.9.1, =0.3.2b20220226, =0.5.3 and more...

aebo (>=0.3.0, <=0.9.0), aebo-pi (>=0.1.0, <=0.8.0) +173 more potentially affected by CVE-2026-54059 via pillow (9.0.1)

pillow PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aebo =0.3.0, =0.1.0, =1.3.0, =1.0.0, =0.4.10, =2.1.0, =0.5.3, =2.6.9, =0.2.3rc4, =1.1.1, =0.5.17, =1.0.0, =22.9.1, =0.3.2b20220226, =0.5.3 and more...

aebo (>=0.3.0, <=0.9.0), aebo-pi (>=0.1.0, <=0.8.0) +173 more potentially affected by CVE-2026-59199 via pillow (9.0.1)

pillow PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aebo =0.3.0, =0.1.0, =1.3.0, =1.0.0, =0.4.10, =2.1.0, =0.5.3, =2.6.9, =0.2.3rc4, =1.1.1, =0.5.17, =1.0.0, =22.9.1, =0.3.2b20220226, =0.5.3 and more...

socid-extractor v0.1.1

socidextractor Turn any public profile page into a structured account record — usernames, display names, bios, avatars, locations, joined-at dates, follower counts, external links, and the stable internal identifiers that uniquely pin an account across renames, redesigns, and deletions...

yark (>=1.2.11, <=1.2.12), yt-dlp-transcript (0.1.18) +2 more potentially affected by CVE-2026-50574 via yt-dlp (2024.10.7)

yt-dlp PYPI version 2024.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - yark =1.2.11, =1.2.12 - yt-dlp-transcript 0.1.18 - yt-text-extractor 0.1.0 - ytdl-sub 2024.10.9 Source cves: CVE-2026-50574 Source advisory:...

admin-api-lib (>=3.2.0, <=3.4.0), extractor-api-lib (>=3.2.0, <=3.3.0) +2 more potentially affected by CVE-2026-26013 via langchain-core (0.3.77)

langchain-core PYPI version 0.3.77 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - admin-api-lib =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.4.0 Source cves: CVE-2026-26013 Source advisory: OSV:PYSEC-2026-2562...

castor-extractor (>=0.21.7, <=0.21.9), ledfx (2.0.105) +3 more potentially affected by CVE-2026-59890 via setuptools (75.3.4)

setuptools PYPI version 75.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - castor-extractor =0.21.7, =3.41.0, =0.27.0, =0.1.0, =0.1.6 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

geometron (>=0.0.1.dev7, <=0.0.3), jupyter-cell-extractor (>=0.1.0, <=1.0.0) potentially affected by CVE-2025-53000 via nbconvert (6.2.0)

nbconvert PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - geometron =0.0.1.dev7, =0.1.0, =1.0.0 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...

bbtext (0.1.0), casparser (0.5.4) +10 more potentially affected by CVE-2025-70559 via pdfminer-six (20211012.0.0)

pdfminer-six PYPI version 20211012.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - bbtext 0.1.0 - casparser 0.5.4 - core-dev =0.1.0, =0.9.0, =2.3.0, =12.7.1, =0.5.7, =0.16.0, =1.66.13, =0.1.1, =0.3.1 Source cves:...

amms-planop2xls (0.7.3), drunken-child-in-the-fog (>=0.1.0, <=0.3.1) +1 more potentially affected by CVE-2025-70559 via pdfminer-six (20170419.0.0)

pdfminer-six PYPI version 20170419.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - amms-planop2xls 0.7.3 - drunken-child-in-the-fog =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2025-70559 Source advisory:...

agentic-framework (>=0.2.0, <=0.2.5), bormeparser (>=0.4.0, <=0.4.1) +14 more potentially affected by CVE-2025-70559 via pdfminer-six (20181108.0.0)

pdfminer-six PYPI version 20181108.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - agentic-framework =0.2.0, =0.4.0, =0.0.1, =7.3.0, =0.2.0, =0.0.1, =1.0.0rc1, =0.3.0, =0.5.15, =0.2.0, =0.1.2, =1.0.0, =1.2.0 -...

amms-planop2xls (0.7.3), drunken-child-in-the-fog (>=0.1.0, <=0.3.1) +1 more potentially affected by CVE-2025-64512 via pdfminer-six (20170419.0.0)

pdfminer-six PYPI version 20170419.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - amms-planop2xls 0.7.3 - drunken-child-in-the-fog =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2025-64512 Source advisory:...

ak-frame-extractor (>=1.0.0, <=1.1.0), systembridgebackend (>=3.0.0.dev1, <=3.0.7) +2 more potentially affected by CVE-2025-59042 via pyinstaller (5.0.1)

pyinstaller PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - ak-frame-extractor =1.0.0, =3.0.0.dev1, =3.0.0.dev1, =3.0.0.dev1, =3.0.7 Source cves: CVE-2025-59042 Source advisory: OSV:PYSEC-2026-1813...

garmindb (3.2.8), geometron (>=0.0.1.dev7, <=0.0.3) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.8.1)

jupyter-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - garmindb 3.2.8 - geometron =0.0.1.dev7, =0.1.0, =1.0.0 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

ImpactThe Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases.To pass extra control data between...