5944 matches found
MAL-2026-6648 Malicious code in @shopbop/api-models (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1e5f6c38f5d8b7befd57a2236e32bc2bc940467d300734af69b97f0b219cf2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview @shopbop/api-models is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2026-2635 via mlflow (1.7.2)
mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2026-2635 Source advisory: OSV:PYSEC-2026-421...
faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2026-2635 via mlflow (1.2.0)
mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2026-2635 Source advisory: OSV:PYSEC-2026-421...
aait (>=1.0.4, <=1.0.5), adess (1.0.0) +225 more potentially affected by CVE-2026-31235 via imgaug (>=0.2.5, <=0.4.0)
imgaug PYPI version =0.2.5, =1.0.4, =0.1.0, =0.10.0, =0.1.0, =1.3.0, =0.5.0, =0.3.2, =0.7.0.dev134, =0.1.4, =0.1.0, =0.5.2, =2.0.4, =2.0.7 and more Source cves: CVE-2026-31235 Source advisory: OSV:PYSEC-2026-356...
mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...
PYSEC-2026-406 mamba language model framework vulnerable to insecure deserialization when loading pre-trained models from HuggingFace Hub
The mamba language model framework thru 2.2.6 is vulnerable to insecure deserialization CWE-502 when loading pre-trained models from HuggingFace Hub. The MambaLMHeadModel.frompretrained method uses torch.load to load the pytorchmodel.bin weight file without enabling the security-restrictive...
faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2026-0545 via mlflow (1.7.2)
mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2026-0545 Source advisory: OSV:PYSEC-2026-419...
faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2026-0545 via mlflow (1.2.0)
mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2026-0545 Source advisory: OSV:PYSEC-2026-419...
faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2025-15036 via mlflow (1.7.2)
mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2025-15036 Source advisory: OSV:PYSEC-2026-425...
faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2026-0596 via mlflow (1.7.2)
mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2026-0596 Source advisory: OSV:PYSEC-2026-424...
faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2025-15379 via mlflow (1.7.2)
mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2025-15379 Source advisory: OSV:PYSEC-2026-423...
faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2025-15036 via mlflow (1.2.0)
mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2025-15036 Source advisory: OSV:PYSEC-2026-425...
faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2025-15379 via mlflow (1.2.0)
mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2025-15379 Source advisory: OSV:PYSEC-2026-423...
faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2026-0596 via mlflow (1.2.0)
mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2026-0596 Source advisory: OSV:PYSEC-2026-424...
faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2023-6975 via mlflow (1.2.0)
mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2023-6975 Source advisory: OSV:PYSEC-2026-422...
faculty-models (>=0.1.0, <=0.1.1), mlflow-faculty (>=0.4.0, <=0.4.3) potentially affected by CVE-2023-6974 via mlflow (1.2.0)
mlflow PYPI version 1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models =0.1.0, =0.4.0, =0.4.3 Source cves: CVE-2023-6974 Source advisory: OSV:PYSEC-2026-416...
faculty-models (0.2.0), mlflow-faculty (0.5.0) potentially affected by CVE-2023-6975 via mlflow (1.7.2)
mlflow PYPI version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - faculty-models 0.2.0 - mlflow-faculty 0.5.0 Source cves: CVE-2023-6975 Source advisory: OSV:PYSEC-2026-422...