MAL-2026-17639 Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

folio-migration-tools (>=1.0.2, <=1.5.0), lore (0.5.13) +1 more potentially affected by CVE-2026-59890 via setuptools (60.6.0)

setuptools PYPI version 60.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - folio-migration-tools =1.0.2, =1.10.0, =1.11.17 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

lore (0.5.12) potentially affected by CVE-2026-59890 via setuptools (60.7.0)

setuptools PYPI version 60.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - lore 0.5.12 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

folio-migration-tools (>=1.0.2, <=1.5.0), lore (0.5.13) +1 more potentially affected by CVE-2026-59890 via setuptools (60.6.0)

setuptools PYPI version 60.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - folio-migration-tools =1.0.2, =1.10.0, =1.11.17 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

lore (0.5.12) potentially affected by CVE-2026-59890 via setuptools (60.7.0)

setuptools PYPI version 60.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - lore 0.5.12 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

asekuro (>=0.0.4, <=0.0.5), box-oauth (>=0.2.5, <=0.3.1) +3 more potentially affected by CVE-2025-30167 via jupyter-core (4.4.0)

jupyter-core PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - asekuro =0.0.4, =0.2.5, =0.3.4, =0.5.10, =0.5.24 - sphinx-markdown-builder 0.0.5 Source cves: CVE-2025-30167 Source advisory:...

lore (0.5.12) potentially affected by CVE-2024-6345 via setuptools (60.7.0)

setuptools PYPI version 60.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - lore 0.5.12 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

folio-migration-tools (>=1.0.2, <=1.5.0), lore (0.5.13) +1 more potentially affected by CVE-2024-6345 via setuptools (60.6.0)

setuptools PYPI version 60.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - folio-migration-tools =1.0.2, =1.10.0, =1.11.17 Source cves: CVE-2024-6345 Source advisory: OSV:PYSEC-2026-1918...

boss-cli (>=1.0.0a18, <=1.0.3), lore (0.4.36) +1 more potentially affected by CVE-2026-28684 via python-dotenv (0.6.5)

python-dotenv PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - boss-cli =1.0.0a18, =0.1.16, =0.1.20 Source cves: CVE-2026-28684 Source advisory: OSV:GHSA-MF9W-MJ56-HR94...

boss-cli (>=1.0.0a18, <=1.0.3), lore (0.4.36) +1 more potentially affected by CVE-2026-28684 via python-dotenv (0.6.5)

python-dotenv PYPI version 0.6.5 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - boss-cli =1.0.0a18, =0.1.16, =0.1.20 Source cves: CVE-2026-28684 Source advisory: OSV:PYSEC-2026-2270...

enforcer (1.0.1), gpipe (>=0.0.1, <=0.0.10) +4 more potentially affected by CVE-2026-28684 via python-dotenv (0.7.1)

python-dotenv PYPI version 0.7.1 is affected by a known vulnerability. The following packages have a transitive dependency on python-dotenv and may be impacted: - enforcer 1.0.1 - gpipe =0.0.1, =0.4.37, =0.0.1, =0.0.39 Source cves: CVE-2026-28684 Source advisory: OSV:PYSEC-2026-2270...

CVE-2025-62614

BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in the BookMediaController allows any unauthenticated user to access and download book covers, thumbnails, and complete PDF/CBX page content...

EUVD-2006-2833

Malware in sbrugna...

EUVD-2008-3340

Malware in sbrugna...

EUVD-2005-3983

Malware in sbrugna...

asekuro (>=0.0.4, <=0.0.5), box-oauth (>=0.2.5, <=0.3.1) +3 more potentially affected by CVE-2025-30167 via jupyter-core (4.4.0)

jupyter-core PYPI version 4.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-core and may be impacted: - asekuro =0.0.4, =0.2.5, =0.3.4, =0.5.10, =0.5.24 - sphinx-markdown-builder 0.0.5 Source cves: CVE-2025-30167 Source advisory:...

lore (0.5.12) potentially affected by CVE-2025-47273 via setuptools (60.7.0)

setuptools PYPI version 60.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - lore 0.5.12 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

folio-migration-tools (>=1.0.2, <=1.5.0), lore (0.5.13) +1 more potentially affected by CVE-2025-47273 via setuptools (60.6.0)

setuptools PYPI version 60.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - folio-migration-tools =1.0.2, =1.10.0, =1.11.17 Source cves: CVE-2025-47273 Source advisory: OSV:GHSA-5RJG-FVGR-3XXF...

lore (0.5.12) potentially affected by CVE-2025-47273 via setuptools (60.7.0)

setuptools PYPI version 60.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - lore 0.5.12 Source cves: CVE-2025-47273 Source advisory: OSV:PYSEC-2025-49...