MAL-2026-10628 Malicious code in ai-explain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a2b6beb476c828df723da0a2b4b524cf671e2eed9223a6e04c45c0ec4d59172 [email protected] ships a postinstall hook dist/postinstall.js, mirrored from scripts/postinstall.js that, on npm install, collects the installer's OS...

PYSEC-2026-458 Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

Remote Code Execution via Unsafe Deserialization in Pipecat's LivekitFrameSerializer Summary A critical vulnerability exists in Pipecat's LivekitFrameSerializer – an optional, non-default, undocumented frame serializer class now deprecated intended for LiveKit integration. The class's deserialize...

MAL-2026-6561 Malicious code in skillspector (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877 This package presents itself as a redistribution of NVIDIA/skillspector pyproject Homepage points to github.com/NVIDIA/skillspector and the source...

Malicious code in livekit-agents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abf921f58c69745fee91e812853b493a282f3d42f55db38516ba54b827ea35b The unscoped npm package livekit-agents advertises itself in README as the official LiveKit Agents SDK and links to livekit.io documentation, but the...

MAL-2026-6555 Malicious code in livekit-agents (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abf921f58c69745fee91e812853b493a282f3d42f55db38516ba54b827ea35b The unscoped npm package livekit-agents advertises itself in README as the official LiveKit Agents SDK and links to livekit.io documentation, but the...

CVE-2026-53492 vulnerabilities

Vulnerabilities for packages: grype-db, gatekeeper, chartmuseum-fips, cloudbeat, rancher, cluster-api-helm-controller-fips, kube-arangodb, gitlab-rails-ce-fips, crossplane, helm-push, tw, chainctl-fips, kubevela, kube-mgmt-fips, syft, headlamp-fips, kgateway-fips, scorecard, beats-fips,...

GHSA-33VJ-92QQ-66HC vulnerabilities

Vulnerabilities for packages: grype-db, gatekeeper, chartmuseum-fips, cloudbeat, rancher, cluster-api-helm-controller-fips, kube-arangodb, gitlab-rails-ce-fips, crossplane, helm-push, tw, chainctl-fips, kubevela, kube-mgmt-fips, syft, headlamp-fips, kgateway-fips, scorecard, beats-fips,...

CVE-2026-53489 vulnerabilities

Vulnerabilities for packages: grype-db, gatekeeper, chartmuseum-fips, cloudbeat, rancher, cluster-api-helm-controller-fips, kube-arangodb, gitlab-rails-ce-fips, crossplane, helm-push, tw, chainctl-fips, kubevela, kube-mgmt-fips, syft, headlamp-fips, kgateway-fips, scorecard, beats-fips,...

CVE-2026-50195 vulnerabilities

Vulnerabilities for packages: grype-db, gatekeeper, chartmuseum-fips, cloudbeat, rancher, cluster-api-helm-controller-fips, kube-arangodb, gitlab-rails-ce-fips, crossplane, helm-push, tw, chainctl-fips, kubevela, kube-mgmt-fips, syft, headlamp-fips, kgateway-fips, scorecard, beats-fips,...

CVE-2025-62373

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in LivekitFrameSerializer – an optional, non-default, undocumented frame serializer class now deprecated intended for LiveKit...

CVE-2026-46680 vulnerabilities

Vulnerabilities for packages: grype-db, gatekeeper, chartmuseum-fips, cloudbeat, rancher, cluster-api-helm-controller-fips, k8ssandra-client-fips, kube-arangodb, gitlab-rails-ce-fips, containerd-fips, helm-push, tw, chainctl-fips, osv-scanner, kubevela, kube-mgmt-fips, syft, headlamp-fips,...

Deserialization of Untrusted Data

Overview pipecat-ai is an An open source framework for voice and multimodal assistants Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialize function of the LivekitFrameSerializer class, which uses pickle.loads on untrusted data received from...

EUVD-2025-209570

Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer...

GHSA-C2JG-5CP7-6WC7 Pipecat: Remote Code Execution by Pickle Deserialization Through LivekitFrameSerializer

Remote Code Execution via Unsafe Deserialization in Pipecat's LivekitFrameSerializer Summary A critical vulnerability exists in Pipecat's LivekitFrameSerializer – an optional, non-default, undocumented frame serializer class now deprecated intended for LiveKit integration. The class's deserialize...

CVE-2025-62373 Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in LivekitFrameSerializer – an optional, non-default, undocumented frame serializer class now deprecated intended for LiveKit...

CVE-2025-62373 Pipecat vulnerable to Remote Code Execution by Pickle Deserialization via LivekitFrameSerializer

Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Versions 0.0.41 through 0.0.93 have a vulnerability in LivekitFrameSerializer – an optional, non-default, undocumented frame serializer class now deprecated intended for LiveKit...

Pipecat 代码问题漏洞

Pipecat is an open-source development framework developed by Pipecat that supports real-time audio and video stream processing as well as AI-powered dialogue interactions. Versions 0.0.41 to 0.0.93 of Pipecat contain code vulnerabilities. These vulnerabilities stem from the deserialize method of...

CVE-2026-34986 vulnerabilities

Vulnerabilities for packages: boring-registry, openbao-fips, cloudbeat, oauth2-proxy-fips, rancher, gotrue, amazon-ssm-agent, thanos, minio-fips, sops-fips, peerdb-flow, cerbos-fips, skopeo-fips, snyk-cli, restic-fips, falcosidekick, beats-fips, frankenphp-8.5, trivy-operator,...

CVE-2026-34165 vulnerabilities

Vulnerabilities for packages: argo-events-fips, grype-db, cloudbeat, gitlab-rails-ce-fips, crossplane, amazon-ssm-agent, chainctl-fips, cerbos-fips, argo-cd-fips, argo-cd, external-secrets-operator, osv-scanner, amazon-ssm-agent-fips, snyk-cli, kubevela, bom, syft, tfsec, argo-workflows, scorecar...

CVE-2026-33762 vulnerabilities

Vulnerabilities for packages: argo-events-fips, grype-db, cloudbeat, gitlab-rails-ce-fips, crossplane, amazon-ssm-agent, chainctl-fips, cerbos-fips, argo-cd-fips, argo-cd, external-secrets-operator, osv-scanner, amazon-ssm-agent-fips, snyk-cli, kubevela, bom, syft, tfsec, argo-workflows, scorecar...