castor-extractor (>=0.21.7, <=0.21.9), ledfx (2.0.105) +3 more potentially affected by CVE-2026-59890 via setuptools (75.3.4)

setuptools PYPI version 75.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - castor-extractor =0.21.7, =3.41.0, =0.27.0, =0.1.0, =0.1.6 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

geometron (>=0.0.1.dev7, <=0.0.3), jupyter-cell-extractor (>=0.1.0, <=1.0.0) potentially affected by CVE-2025-53000 via nbconvert (6.2.0)

nbconvert PYPI version 6.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on nbconvert and may be impacted: - geometron =0.0.1.dev7, =0.1.0, =1.0.0 Source cves: CVE-2025-53000 Source advisory: OSV:PYSEC-2026-1691...

bbtext (0.1.0), casparser (0.5.4) +10 more potentially affected by CVE-2025-70559 via pdfminer-six (20211012.0.0)

pdfminer-six PYPI version 20211012.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - bbtext 0.1.0 - casparser 0.5.4 - core-dev =0.1.0, =0.9.0, =2.3.0, =12.7.1, =0.5.7, =0.16.0, =1.66.13, =0.1.1, =0.3.1 Source cves:...

amms-planop2xls (0.7.3), drunken-child-in-the-fog (>=0.1.0, <=0.3.1) +1 more potentially affected by CVE-2025-70559 via pdfminer-six (20170419.0.0)

pdfminer-six PYPI version 20170419.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - amms-planop2xls 0.7.3 - drunken-child-in-the-fog =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2025-70559 Source advisory:...

agentic-framework (>=0.2.0, <=0.2.5), bormeparser (>=0.4.0, <=0.4.1) +14 more potentially affected by CVE-2025-70559 via pdfminer-six (20181108.0.0)

pdfminer-six PYPI version 20181108.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - agentic-framework =0.2.0, =0.4.0, =0.0.1, =7.3.0, =0.2.0, =0.0.1, =1.0.0rc1, =0.3.0, =0.5.15, =0.2.0, =0.1.2, =1.0.0, =1.2.0 -...

amms-planop2xls (0.7.3), drunken-child-in-the-fog (>=0.1.0, <=0.3.1) +1 more potentially affected by CVE-2025-64512 via pdfminer-six (20170419.0.0)

pdfminer-six PYPI version 20170419.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pdfminer-six and may be impacted: - amms-planop2xls 0.7.3 - drunken-child-in-the-fog =0.1.0, =0.1.0, =0.1.2 Source cves: CVE-2025-64512 Source advisory:...

ak-frame-extractor (>=1.0.0, <=1.1.0), systembridgebackend (>=3.0.0.dev1, <=3.0.7) +2 more potentially affected by CVE-2025-59042 via pyinstaller (5.0.1)

pyinstaller PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pyinstaller and may be impacted: - ak-frame-extractor =1.0.0, =3.0.0.dev1, =3.0.0.dev1, =3.0.0.dev1, =3.0.7 Source cves: CVE-2025-59042 Source advisory: OSV:PYSEC-2026-1813...

garmindb (3.2.8), geometron (>=0.0.1.dev7, <=0.0.3) +1 more potentially affected by CVE-2025-30167 via jupyter-core (4.8.1)

jupyter-core PYPI version 4.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - garmindb 3.2.8 - geometron =0.0.1.dev7, =0.1.0, =1.0.0 Source cves: CVE-2025-30167 Source advisory: OSV:PYSEC-2026-1477...

yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

ImpactThe Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases.To pass extra control data between...

PYSEC-2026-2063 yt-dlp Generic Extractor MITM Vulnerability via Arbitrary Proxy Injection

Impact The Generic Extractor in yt-dlp is vulnerable to an attacker setting an arbitrary proxy for a request to an arbitrary url, allowing the attacker to MITM the request made from yt-dlp's HTTP session. This could lead to cookie exfiltration in some cases. To pass extra control data between...

aebo (>=0.3.0, <=0.9.0), aebo-pi (>=0.1.0, <=0.8.0) +173 more potentially affected by CVE-2026-55379 via pillow (9.0.1)

pillow PYPI version 9.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - aebo =0.3.0, =0.1.0, =1.3.0, =1.0.0, =0.4.10, =2.1.0, =0.5.3, =2.6.9, =0.2.3rc4, =1.1.1, =0.5.17, =1.0.0, =22.9.1, =0.3.2b20220226, =0.5.3 and more...

acg-feature-extractor (0.0.2), aiographql-client (>=1.0.0, <=1.0.1) +31 more potentially affected by CVE-2022-31117 via ujson (2.0.3)

ujson PYPI version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on ujson and may be impacted: - acg-feature-extractor 0.0.2 - aiographql-client =1.0.0, =2.3.0, =3.7.1, =3.0.2, =3.7.0, =1.2.0, =0.9.20, =0.3.0, =1.0.0 and more Source cves:...

openSUSE 16 Security Update : yt-dlp (openSUSE-SU-2026:21163-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21163-1 advisory. Changes in yt-dlp: - Update to version 2026.06.09 Fixed CVE-2026-50019: File Downloader cookie leak with curl Fixed CVE-2026-50023: Dangerous fi...

AgentTesla Config Extractor

Analyze AgentTesla .NET payloads: locate string-decryption methods, invoke them with IL-derived keys under a watchdog timeout, and extract likely C2 indicators HTTP, SMTP, FTP. Requires pythonnet and dnlib.dll. !/usr/bin/env python3 -- coding: utf-8 -- """ Extract C2 configuration from AgentTesla...

PYSEC-2026-513 Rasa Allows Remote Code Execution via Remote Model Loading

Vulnerability A vulnerability has been identified in Rasa Pro and Rasa Open Source that enables an attacker who has the ability to load a maliciously crafted model remotely into a Rasa instance to achieve Remote Code Execution. The prerequisites for this are: - The HTTP API must be enabled on the...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by CVE-2026-77088 via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: CVE-2026-77088 Source advisory: OSV:GHSA-JF6W-2MVX-633J...

any2htpy (>=0.1.4, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=0.35.0, <=1.14.0)

justhtml PYPI version =0.35.0, =0.1.4, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: GHSA-JF6W-2MVX-633J...

yark (>=1.2.11, <=1.2.12), yt-dlp-transcript (0.1.18) +2 more potentially affected by CVE-2026-50574 via yt-dlp (2024.10.7)

yt-dlp PYPI version 2024.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - yark =1.2.11, =1.2.12 - yt-dlp-transcript 0.1.18 - yt-text-extractor 0.1.0 - ytdl-sub 2024.10.9 Source cves: CVE-2026-50574 Source advisory:...

yark (>=1.2.11, <=1.2.12), yt-dlp-transcript (0.1.18) +2 more potentially affected by CVE-2026-50023 via yt-dlp (2024.10.7)

yt-dlp PYPI version 2024.10.7 is affected by a known vulnerability. The following packages have a transitive dependency on yt-dlp and may be impacted: - yark =1.2.11, =1.2.12 - yt-dlp-transcript 0.1.18 - yt-text-extractor 0.1.0 - ytdl-sub 2024.10.9 Source cves: CVE-2026-50023 Source advisory:...

CVE-2026-1764

A flaw was found in GNOME localsearch previously known as tracker-miners MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the extractperformerstags function can lead to a heap buffer overflow. This vulnerability allows a remote attacker...