any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-16083990...

Amazon Linux 2023 : tracker-miners (ALAS2023-2026-1580)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1580 advisory. A flaw was found in GNOME localsearch MP3 Extractor. When processing specially crafted MP3 files containing ID3v2.4 tags, a missing bounds check in the extractperformerstags function can lead ...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) +1 more potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.14.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.1.0, =0.1.5 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-16032358...

article-extractor (>=0.5.8, <=0.5.9) potentially affected by unknown CVE via justhtml (1.13.0)

justhtml PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - article-extractor =0.5.8, =0.5.9 Source cves: unknown CVE Source advisory: GHSA-R758-8HXW-4845...

any2htpy (>=0.2.1, <=0.2.2), article-extractor (>=0.5.8, <=0.5.9) potentially affected by unknown CVE via justhtml (>=1.1.0, <=1.13.0)

justhtml PYPI version =1.1.0, =0.2.1, =0.5.8, =0.5.9 Source cves: unknown CVE Source advisory: SNYK:PYTHON-JUSTHTML-15928878...

article-extractor (>=0.5.8, <=0.5.9) potentially affected by CVE-2026-5751 via justhtml (1.13.0)

justhtml PYPI version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on justhtml and may be impacted: - article-extractor =0.5.8, =0.5.9 Source cves: CVE-2026-5751 Source advisory: OSV:GHSA-R758-8HXW-4845...

CVE-2026-5470

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...

ShieldNet: Network-Level Guardrails against Emerging Supply-Chain Injections in Agentic Systems

Existing research on LLM agent security mainly focuses on prompt injection and unsafe input/output behaviors. However, as agents increasingly rely on third-party tools and MCP servers, a new class of supply-chain threats has emerged, where malicious behaviors are embedded in seemingly benign tool...

Malicious code in photo-extractor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67f3f604528f125e85fb7be00bb17d7cf2abc5cdb20a12cbcbb38633f5877f14 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files...

EUVD-2026-18798

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...

Server-side Request Forgery (SSRF)

Overview google-search-mcp is a Google Search MCP Server for Claude Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the extractContent function. An attacker can access internal resources or perform unauthorized requests by supplying crafted URLs to the...

CVE-2026-5470

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...

CVE-2026-5470 mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...

CVE-2026-5470

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...

CVE-2026-5470 mixelpixx Google-Research-MCP Model Context Protocol content-extractor.service.ts extractContent server-side request forgery

A security vulnerability has been detected in mixelpixx Google-Research-MCP 1e062d7bd887bfe5f6e582b6cc288bb897b35cf2/ca613b736ab787bc926932f59cddc69457185a83. This issue affects the function extractContent of the file src/services/content-extractor.service.ts of the component Model Context Protoc...

CVE-2026-5470

Consolidated details from connected sources confirm CVE-2026-5470 affects mixelpixx Google-Research-MCP; specifically the function extractContent in src/services/content-extractor.service.ts of the Model Context Protocol Handler. The vulnerability is a server-side request forgery (SSRF) caused by...

Rollup module extractor Path Traversal

The vulnerability of the Rollup module extractor is related to an incorrect limitation on the path name to the catalog. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

admin-api-lib (>=3.2.0, <=3.4.0), extractor-api-lib (>=3.2.0, <=3.3.0) +2 more potentially affected by CVE-2026-34070 via langchain-core (0.3.77)

langchain-core PYPI version 0.3.77 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - admin-api-lib =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.4.0 Source cves: CVE-2026-34070 Source advisory: OSV:PYSEC-2026-2193...

admin-api-lib (>=3.2.0, <=3.4.0), extractor-api-lib (>=3.2.0, <=3.3.0) +2 more potentially affected by CVE-2026-34070 via langchain-core (0.3.77)

langchain-core PYPI version 0.3.77 is affected by a known vulnerability. The following packages have a transitive dependency on langchain-core and may be impacted: - admin-api-lib =3.2.0, =3.2.0, =3.2.0, =3.2.0, =3.4.0 Source cves: CVE-2026-34070 Source advisory: OSV:GHSA-QH6H-P6C9-FF54...

📄 textract 2.5.0 Command Injection

textract through version 2.5.0 allows OS command injection through the file path supplied to multiple extractors. Several code paths pass that file path into childprocess.exec with inadequate sanitization. An attacker who can influence the file name or path can break out of the command line and r...