agentlightning (>=1.0.0, <=1.0.2), aiagents4pharma (>=0.0.0, <=1.49.1) +222 more potentially affected by CVE-2026-106441 via hydra-core (>=1.0.0rc4, <=1.3.5)

hydra-core PYPI version =1.0.0rc4, =1.0.0, =0.0.0, =0.1.5, =1.0.0rc1, =0.2.126, =1.0.0, =0.7.0, =0.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-106441 Source advisory: OSV:PYSEC-2026-4221...

phijax (0.1.0b1) potentially affected by CVE-2026-106442 via hydra-core (1.3.5)

hydra-core PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - phijax 0.1.0b1 Source cves: CVE-2026-106442 Source advisory: OSV:PYSEC-2026-4223...

phijax (>=0.1.0b1, <=0.2.0b5) potentially affected by CVE-2026-106439 via hydra-core (>=1.3.5, <=1.3.6)

hydra-core PYPI version =1.3.5, =0.1.0b1, =0.2.0b5 Source cves: CVE-2026-106439 Source advisory: OSV:PYSEC-2026-4222...

omegaflow (>=0.2.0, <=0.4.0) potentially affected by CVE-2026-106441 via hydra-core (1.4.0.dev5)

hydra-core PYPI version 1.4.0.dev5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - omegaflow =0.2.0, =0.4.0 Source cves: CVE-2026-106441 Source advisory: OSV:PYSEC-2026-4221...

omegaflow (>=0.2.0, <=0.4.0) potentially affected by CVE-2026-106439 via hydra-core (1.4.0.dev5)

hydra-core PYPI version 1.4.0.dev5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - omegaflow =0.2.0, =0.4.0 Source cves: CVE-2026-106439 Source advisory: OSV:PYSEC-2026-4222...

omegaflow (>=0.2.0, <=0.4.0) potentially affected by CVE-2026-106442 via hydra-core (1.4.0.dev5)

hydra-core PYPI version 1.4.0.dev5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - omegaflow =0.2.0, =0.4.0 Source cves: CVE-2026-106442 Source advisory: OSV:PYSEC-2026-4223...

borisml (>=0.0.2, <=0.1.11), camphr (>=0.5.2, <=0.8.9) +13 more potentially affected by CVE-2026-106441 via hydra-core (0.11.3)

hydra-core PYPI version 0.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - borisml =0.0.2, =0.5.2, =0.1.2, =0.3.18, =1.0.0, =23.3.0, =1.0.0, =0.1.0a2, =2.0.0, =0.0.1, =0.1.0.dev1, =1.3.0 Source cves: CVE-2026-10644...

GHSA-MWJ6-RFH8-7QF4 Hydra: Mutable instantiate policy sets allow target blocklist bypass

Summary Hydra's legacy instantiate target blocklists and related execution-policy collections are stored in mutable module-level state. Because locate can resolve attributes on imported objects, a configuration can resolve a mutation method such as .discard, modify the active policy, and then...

phijax (>=0.1.0b1, <=0.2.0b5) potentially affected by CVE-2026-106439 via hydra-core (>=1.3.5, <=1.3.6)

hydra-core PYPI version =1.3.5, =0.1.0b1, =0.2.0b5 Source cves: CVE-2026-106439 Source advisory: OSV:GHSA-MWJ6-RFH8-7QF4...

phijax (>=0.1.0b1, <=0.2.0b5) potentially affected by CVE-2026-106439 via hydra-core (>=1.3.5, <=1.3.6)

hydra-core PYPI version =1.3.5, =0.1.0b1, =0.2.0b5 Source cves: CVE-2026-106439 Source advisory: GHSA-MWJ6-RFH8-7QF4...

omegaflow (>=0.2.0, <=0.4.0) potentially affected by CVE-2026-106439 via hydra-core (1.4.0.dev5)

hydra-core PYPI version 1.4.0.dev5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - omegaflow =0.2.0, =0.4.0 Source cves: CVE-2026-106439 Source advisory: OSV:GHSA-MWJ6-RFH8-7QF4...

omegaflow (>=0.2.0, <=0.4.0) potentially affected by CVE-2026-106439 via hydra-core (1.4.0.dev5)

hydra-core PYPI version 1.4.0.dev5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - omegaflow =0.2.0, =0.4.0 Source cves: CVE-2026-106439 Source advisory: GHSA-MWJ6-RFH8-7QF4...

CVE-2026-106441

A flaw was found in hydra-core. An attacker who supplies or controls a malicious logging configuration can trigger arbitrary code execution by specifying unauthorized Python classes or factory functions. Because Hydra passes logging configuration directly to Python's logging system without...

borisml (>=0.0.2, <=0.1.11), camphr (>=0.5.2, <=0.8.9) +13 more potentially affected by CVE-2026-106441 via hydra-core (0.11.3)

hydra-core PYPI version 0.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - borisml =0.0.2, =0.5.2, =0.1.2, =0.3.18, =1.0.0, =23.3.0, =1.0.0, =0.1.0a2, =2.0.0, =0.0.1, =0.1.0.dev1, =1.3.0 Source cves: CVE-2026-10644...

agentlightning (>=1.0.0, <=1.0.2), aiagents4pharma (>=0.0.0, <=1.49.1) +222 more potentially affected by CVE-2026-106441 via hydra-core (>=1.0.0rc4, <=1.3.5)

hydra-core PYPI version =1.0.0rc4, =1.0.0, =0.0.0, =0.1.5, =1.0.0rc1, =0.2.126, =1.0.0, =0.7.0, =0.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-106441 Source advisory: OSV:GHSA-C3WX-C55W-PXJQ...

agentlightning (>=1.0.0, <=1.0.2), aiagents4pharma (>=0.0.0, <=1.49.1) +222 more potentially affected by CVE-2026-106441 via hydra-core (>=1.0.0rc4, <=1.3.5)

hydra-core PYPI version =1.0.0rc4, =1.0.0, =0.0.0, =0.1.5, =1.0.0rc1, =0.2.126, =1.0.0, =0.7.0, =0.0.0, =0.1.0, =0.1.2 and more Source cves: CVE-2026-106441 Source advisory: GHSA-C3WX-C55W-PXJQ...

omegaflow (>=0.2.0, <=0.4.0) potentially affected by CVE-2026-106441 via hydra-core (1.4.0.dev5)

hydra-core PYPI version 1.4.0.dev5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - omegaflow =0.2.0, =0.4.0 Source cves: CVE-2026-106441 Source advisory: OSV:GHSA-C3WX-C55W-PXJQ...

omegaflow (>=0.2.0, <=0.4.0) potentially affected by CVE-2026-106441 via hydra-core (1.4.0.dev5)

hydra-core PYPI version 1.4.0.dev5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - omegaflow =0.2.0, =0.4.0 Source cves: CVE-2026-106441 Source advisory: GHSA-C3WX-C55W-PXJQ...

phijax (0.1.0b1) potentially affected by CVE-2026-106442 via hydra-core (1.3.5)

hydra-core PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - phijax 0.1.0b1 Source cves: CVE-2026-106442 Source advisory: OSV:GHSA-RQX7-P7VV-W7HR...

phijax (0.1.0b1) potentially affected by CVE-2026-106442 via hydra-core (1.3.5)

hydra-core PYPI version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on hydra-core and may be impacted: - phijax 0.1.0b1 Source cves: CVE-2026-106442 Source advisory: GHSA-RQX7-P7VV-W7HR...