vantage6-algorithm-store (4.13.3rc2), vantage6-node (4.13.3rc2) +1 more potentially affected by CVE-2024-24769 via vantage6 (4.13.3rc2)

vantage6 PYPI version 4.13.3rc2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.13.3rc2 - vantage6-node 4.13.3rc2 - vantage6-server 4.13.3rc2 Source cves: CVE-2024-24769 Source advisory:...

vantage6-node (3.2.0rc5), vantage6-server (3.2.0rc5) potentially affected by CVE-2024-24769 via vantage6 (3.2.0rc5)

vantage6 PYPI version 3.2.0rc5 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.2.0rc5 - vantage6-server 3.2.0rc5 Source cves: CVE-2024-24769 Source advisory: OSV:PYSEC-2026-3399...

vantage6-node (3.7.0), vantage6-server (3.7.0) potentially affected by CVE-2024-24769 via vantage6 (3.7.0)

vantage6 PYPI version 3.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.7.0 - vantage6-server 3.7.0 Source cves: CVE-2024-24769 Source advisory: OSV:PYSEC-2026-3399...

vantage6-node (3.11.1), vantage6-server (3.11.1) potentially affected by CVE-2024-24769 via vantage6 (3.11.1)

vantage6 PYPI version 3.11.1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.11.1 - vantage6-server 3.11.1 Source cves: CVE-2024-24769 Source advisory: OSV:PYSEC-2026-3399...

vantage6-node (3.1.0rc1), vantage6-server (3.1.0rc1) potentially affected by CVE-2024-27928 via vantage6 (3.1.0rc1)

vantage6 PYPI version 3.1.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.1.0rc1 - vantage6-server 3.1.0rc1 Source cves: CVE-2024-27928 Source advisory: OSV:PYSEC-2026-3398...

vantage6-algorithm-store (4.6.0rc7), vantage6-node (4.6.0rc7) +1 more potentially affected by CVE-2024-24769 via vantage6 (4.6.0rc7)

vantage6 PYPI version 4.6.0rc7 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.6.0rc7 - vantage6-node 4.6.0rc7 - vantage6-server 4.6.0rc7 Source cves: CVE-2024-24769 Source advisory:...

vantage6-algorithm-store (>=5.0.0a0, <=5.0.0rc91), vantage6-hq (>=5.0.0b2, <=5.0.0rc91) +2 more potentially affected by CVE-2024-24769 via vantage6 (>=5.0.0a0, <=5.0.0rc91)

vantage6 PYPI version =5.0.0a0, =5.0.0a0, =5.0.0b2, =5.0.0a0, =5.0.0a0, =5.0.0b1 Source cves: CVE-2024-24769 Source advisory: OSV:PYSEC-2026-3399...

vantage6-node (4.2.3), vantage6-server (4.2.3) potentially affected by CVE-2024-24769 via vantage6 (4.2.3)

vantage6 PYPI version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 4.2.3 - vantage6-server 4.2.3 Source cves: CVE-2024-24769 Source advisory: OSV:PYSEC-2026-3399...

vantage6-node (3.11.0rc1), vantage6-server (3.11.0rc1) potentially affected by CVE-2024-27928 via vantage6 (3.11.0rc1)

vantage6 PYPI version 3.11.0rc1 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.11.0rc1 - vantage6-server 3.11.0rc1 Source cves: CVE-2024-27928 Source advisory: OSV:PYSEC-2026-3398...

vantage6-node (3.4.0), vantage6-server (3.4.0) potentially affected by CVE-2024-27928 via vantage6 (3.4.0)

vantage6 PYPI version 3.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-node 3.4.0 - vantage6-server 3.4.0 Source cves: CVE-2024-27928 Source advisory: OSV:PYSEC-2026-3398...

vantage6-algorithm-store (4.13.0rc2), vantage6-node (4.13.0rc2) +1 more potentially affected by CVE-2024-24769 via vantage6 (4.13.0rc2)

vantage6 PYPI version 4.13.0rc2 is affected by a known vulnerability. The following packages have a transitive dependency on vantage6 and may be impacted: - vantage6-algorithm-store 4.13.0rc2 - vantage6-node 4.13.0rc2 - vantage6-server 4.13.0rc2 Source cves: CVE-2024-24769 Source advisory:...

dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summaryrundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independent...

PYSEC-2026-2444 dbt MCP Server has an Argument Injection in dbt CLI Tool Wrappers via node_selection and resource_type Parameters

Discovered through manual source code review. Verified by PoC execution against a local dbt-mcp v1.15.1 installation. Summary rundbtcommand in src/dbtmcp/dbtcli/tools.py constructs the dbt subprocess argument list by appending user-supplied MCP tool parameters without sanitization. Two independen...

PYSEC-2026-2548 Keylime has a hardcoded attestation challenge nonce that allows replay attacks

CVE-2026-6420: Hardcoded attestation challenge nonce allows replay attacks Impact The CertificationParameters.generatechallenge method in the push attestation protocol uses a hardcoded challenge nonce instead of generating a cryptographically random value. This removes the nonce-based replay...

EUVD-2026-43500

In the Apache Airflow FAB auth manager, a DAG whose dagid is DAGs collided with the global all-DAGs permission resource name produced by resourcename, so a user granted per-DAG accesscontrol on that one DAG was silently granted the global all-DAGs permission privilege escalation. The escalation...

sprinter (1.4.2), uranium (>=0.2.8, <=0.2.22) +1 more potentially affected by CVE-2026-6357 via pip (7.1.0)

pip PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - sprinter 1.4.2 - uranium =0.2.8, =0.2.22 - yt-formula-node 0.0.4 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

sprinter (1.4.2), uranium (>=0.2.8, <=0.2.22) +1 more potentially affected by CVE-2026-3219 via pip (7.1.0)

pip PYPI version 7.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - sprinter 1.4.2 - uranium =0.2.8, =0.2.22 - yt-formula-node 0.0.4 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

Malicious Package

Overview polymarket-kelly-math-stake is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

PYSEC-2026-2638 FoundationAgents MetaGPT vulnerable to eval injection

A flaw has been found in FoundationAgents MetaGPT up to 0.8.1. This vulnerability affects the function ActionNode.xmlfill of the file metagpt/actions/actionnode.py of the component XML Handler. Executing a manipulation can lead to improper neutralization of directives in dynamically evaluated cod...

Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters

SummaryGraphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.nodelabels were concatenated directly into Cypher label expressions without validation.In M...