a2 (>=0.1.0, <=0.7.0), a2grunnerp (>=0.1.0, <=0.1.8) +1534 more potentially affected by CVE-2026-49264 via oauthlib (>=0.6.3, <=3.3.1)

oauthlib PYPI version =0.6.3, =0.1.0, =0.1.0, =1.0.32, =0.1.0, =3.2.1, =0.2.0, =3.2.0, =1.1.0, =0.1.31, =1.0.0, =0.0.8, =0.0.1, =1.1.73b0, =0.1.0, =2.2.0 and more Source cves: CVE-2026-49264 Source advisory: GHSA-HJ66-6F7G-4R5V...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +11308 more potentially affected by CVE-2026-97687 via urllib3 (>=1.26.0, <=2.7.0)

urllib3 PYPI version =1.26.0, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.8.2 and more Source cves: CVE-2026-97687 Source advisory: SNYK:PYTHON-URLLIB3-20302844...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +558 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =0.0.2, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =2.22.0 and more Source cves: CVE-2026-97688 Source advisory: SNYK:PYTHON-URLLIB3-20302845...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +558 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =0.0.2, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =2.22.0 and more Source cves: CVE-2026-97688 Source advisory: MEND:CVE-2026-97688...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +11308 more potentially affected by CVE-2026-97687 via urllib3 (>=1.26.0, <=2.7.0)

urllib3 PYPI version =1.26.0, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.8.2 and more Source cves: CVE-2026-97687 Source advisory: MEND:CVE-2026-97687...

a2grunnerp (>=0.1.0, <=0.1.8), a4t-sale-discount (5.0.2) +2930 more potentially affected by CVE-2026-102598 via werkzeug (>=0.9.4, <=3.1.8)

werkzeug PYPI version =0.9.4, =0.1.0, =1.0.2, =1.0.5, =0.10.3, =1.8.26, =0.3.1, =0.8.44.4rc1, =4.2.0, =2.9.0, =1.0.0, =1.2.0 and more Source cves: CVE-2026-102598 Source advisory: MEND:CVE-2026-102598...

argostranslate (>=1.4.0, <=1.9.5), audim (>=0.0.6, <=0.0.7) +64 more potentially affected by CVE-2026-102567 via ctranslate2 (>=1.20.1, <=4.7.2)

ctranslate2 PYPI version =1.20.1, =1.4.0, =0.0.6, =0.2.1, =2.1.0, =0.0.1, =1.4.0, =0.0.9, =0.1.0, =0.2.0, =0.3.1, =0.0.15, =0.0.30 and more Source cves: CVE-2026-102567 Source advisory: MEND:CVE-2026-102567...

solverforge-pretix (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-101271 via pretix (2026.6.1)

pretix PYPI version 2026.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pretix and may be impacted: - solverforge-pretix =1.0.0, =1.0.1 Source cves: CVE-2026-101271 Source advisory: MEND:CVE-2026-101271...

solverforge-pretix (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-101270 via pretix (2026.6.1)

pretix PYPI version 2026.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pretix and may be impacted: - solverforge-pretix =1.0.0, =1.0.1 Source cves: CVE-2026-101270 Source advisory: MEND:CVE-2026-101270...

solverforge-pretix (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-101269 via pretix (2026.6.1)

pretix PYPI version 2026.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pretix and may be impacted: - solverforge-pretix =1.0.0, =1.0.1 Source cves: CVE-2026-101269 Source advisory: MEND:CVE-2026-101269...

solverforge-pretix (>=1.0.0, <=1.0.1) potentially affected by CVE-2026-101268 via pretix (2026.6.1)

pretix PYPI version 2026.6.1 is affected by a known vulnerability. The following packages have a transitive dependency on pretix and may be impacted: - solverforge-pretix =1.0.0, =1.0.1 Source cves: CVE-2026-101268 Source advisory: MEND:CVE-2026-101268...

airflow-parse-bench (>=0.0.1, <=1.0.1), airflow-toolkit (0.13.3) +2 more potentially affected by CVE-2026-81914 via apache-airflow-providers-google (10.26.0)

apache-airflow-providers-google PYPI version 10.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-parse-bench =0.0.1, =0.11.1, =0.1.0, =0.1.1 Source cves: CVE-2026-81914 Source advisory:...

dagtool (>=0.0.8, <=0.0.11) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (15.1.0)

apache-airflow-providers-google PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dagtool =0.0.8, =0.0.11 Source cves: CVE-2026-81914 Source advisory: OSV:PYSEC-2026-4187...

CVE-2026-102904: Improper Neutralization of Argument Delimiters in a Command

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

PT-2026-102922

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.0.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 Description In the PyPI Extension Manager, the ExtensionHandler.post function validates extension names during installation but fails to reject option-like values...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +302 more potentially affected by CVE-2026-96760 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-96760 Source advisory: SNYK:PYTHON-AUTHLIB-20257410...

MAL-2026-17240 Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +197 more potentially affected by CVE-2026-102272 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =3.8.0, =3.9.3 and...

5mghost-rover (>=0.0.1, <=0.0.3), a11y-computer-use (>=0.1.1, <=0.4.74) +471 more potentially affected by unknown CVE via mcp (>=2.0.0b1, <=2.1.1)

mcp PYPI version =2.0.0b1, =0.0.1, =0.1.1, =0.6.0, =0.1.0, =0.1.0a1, =0.32.1, =0.1.0, =0.21.0, =0.8.0, =0.10.0 - agentic-resume-builder 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-MCP-20417226...