CVE-2026-85694

LaVague 0.2.35 is vulnerable to remote code execution via its PythonFromMarkdownExtractor.extract_as_object function, which uses eval on untrusted language model output derived from web page content. An attacker can perform indirect prompt injection through a web page to inject malicious Python c...

Malicious code in api-extractor-lib4-test (npm)

Source: ossf-package-analysis 659516491da5eda94919af0b09a941720c55632d3a7c3ced84c056da49b4e504 The OpenSSF Package Analysis project identified 'api-extractor-lib4-test' @ 99.0.9 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with maliciou...

Malicious code in api-extractor-model (npm)

--- Credit: OpenSSF source...

Malicious code in api-extractor-lib5-test (npm)

The package communicates with a domain associated with malicious activity. --- Credit: OpenSSF source...

magic-extractor v1.3.1

Magic Extractor Description Magic Extractor is a universal extraction tool for Windows that identifies a file with several detectors and routes it to the right bundled extractor. It aims to cover mainstream compression formats, the installers you actually see today, and a range of less common...

CVE-2026-66152: Path Traversal: '\..\filename'

A Path traversal vulnerability in the SonicWall NetExtender Linux client file extractor component allows an attacker to write arbitrary file as root...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-7808 via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-7808 Source advisory: MEND:CVE-2026-7808...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-77088 via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-77088 Source advisory: MEND:CVE-2026-77088...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-6827 via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-6827 Source advisory: MEND:CVE-2026-6827...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +3 more potentially affected by CVE-2026-74793 via justhtml (>=0.35.0, <=1.23.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.2.0, =0.1.0, =0.1.5 - projectify-app 2026.7.26 Source cves: CVE-2026-74793 Source advisory: MEND:CVE-2026-74793...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) potentially affected by CVE-2026-5751 via justhtml (>=0.35.0, <=1.13.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.5.9 Source cves: CVE-2026-5751 Source advisory: MEND:CVE-2026-5751...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-5388 via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-5388 Source advisory: MEND:CVE-2026-5388...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-4671 via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-4671 Source advisory: MEND:CVE-2026-4671...

PT-2026-80285

Summary An Improper Neutralization of Input During Web Page Generation issue in the site extractor component allows an attacker-controlled attribute value to be injected into output HTML without escaping. An attacker who crafts a malicious HTML page or controls content on a matching domain can...

magic-extractor v1.3.0

Magic Extractor Description Magic Extractor is a universal extraction tool for Windows that identifies a file with several detectors and routes it to the right bundled extractor. It aims to cover mainstream compression formats, the installers you actually see today, and a range of less common...

esco-skill-extractor (>=0.1.9, <=0.1.10), graphreader (0.0.1) +2 more potentially affected by CVE-2026-68770 via sentence-transformers (3.2.0)

sentence-transformers PYPI version 3.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on sentence-transformers and may be impacted: - esco-skill-extractor =0.1.9, =0.1.10, =0.1.11 - openexcept 0.1.0 Source cves: CVE-2026-68770 Source advisory:...

SUSE CVE-2026-40344

MinIO is a high-performance object storage system. Starting in RELEASE.2023-05-18T00-05-36Z and prior to RELEASE.2026-04-11T03-20-12Z, an authentication bypass vulnerability in MinIO's Snowball auto-extract handler PutObjectExtractHandler allows any user who knows a valid access key to write...

CVE-2026-65010

A flaw was found in Hugging Face Datasets through 5.00 in Extractor.extract. When archive contents are extracted to predictable output paths, the extractor follows pre-planted symlinks instead of confining writes to the intended directory. A local attacker who can place those symlinks can redirec...

yark (>=1.2.11, <=1.2.12), yt-dlp-transcript (0.1.18) +2 more potentially affected by CVE-2026-55404 via yt-dlp (2024.10.7)

yt-dlp PYPI version 2024.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - yark =1.2.11, =1.2.12 - yt-dlp-transcript 0.1.18 - yt-text-extractor 0.1.0 - ytdl-sub 2024.10.9 Source cves: CVE-2026-55404 Source advisory:...

CVE-2026-65010 Datasets Symlink-following Arbitrary File Write via Extractor.extract()

Datasets through 5.00, fixed in commit ad2d853, contains a symlink-following vulnerability in Extractor.extract that allows local attackers to write arbitrary files by pre-planting symlinks at predictable output paths. Attackers can redirect archive extraction to arbitrary filesystem locations in...