Malicious code in spo365-graph (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b SPO365-GRAPH presents itself as a SharePoint Online Graph client, but the shipped library module SPO365GRAPH/SPO365GRAPH.py consists entirely of stub...

MAL-2026-17421 Malicious code in spo365-graph (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 091649f7b927b27a5bd7a35b53784433050bf58e0dc11acc95316b650a13f60b SPO365-GRAPH presents itself as a SharePoint Online Graph client, but the shipped library module SPO365GRAPH/SPO365GRAPH.py consists entirely of stub...

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

here-search-demo (>=0.17.4, <=0.17.6) potentially affected by CVE-2026-102831 via jupyterlite (0.7.6)

jupyterlite PYPI version 0.7.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlite and may be impacted: - here-search-demo =0.17.4, =0.17.6 Source cves: CVE-2026-102831 Source advisory: OSV:PYSEC-2026-4058...

ale-uy (1.5.0), amphi-etl (>=0.9.2a3, <=0.9.8) +11 more potentially affected by CVE-2026-102831 via jupyterlab (>=4.5.0, <=4.5.8)

jupyterlab PYPI version =4.5.0, =0.9.2a3, =0.2.4, =0.0.1, =0.3.0, =2512.2.0, =1.4.0, =0.1.0, =2.0.0, =2.1.2 Source cves: CVE-2026-102831 Source advisory: OSV:PYSEC-2026-4057...

a2 (>=0.1.0, <=0.6.1), aaa-ml-datasets-course (1.0.0) +575 more potentially affected by CVE-2026-102830 via jupyterlab (>=3.0.0, <=4.5.8)

jupyterlab PYPI version =3.0.0, =0.1.0, =0.1.0b0, =0.1.0b0, =0.1.0b0, =0.1.0, =0.5.5, =2.0.0, =0.1.1, =0.1.0, =3.0.0, =4.33.0, =5.0.0 - arcor2-calibration 0.8.0 and more Source cves: CVE-2026-102830 Source advisory: OSV:PYSEC-2026-4056...

PYSEC-2026-4055 JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

pspdfutils (>=3.0.5, <=3.0.7) potentially affected by CVE-2026-102999 via pypdf (3.10.0)

pypdf PYPI version 3.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pspdfutils =3.0.5, =3.0.7 Source cves: CVE-2026-102999 Source advisory: OSV:PYSEC-2026-4159...

5mghost-rover (>=0.0.1, <=0.0.3), ace-framework (>=0.6.0, <=0.7.3) +212 more potentially affected by CVE-2026-102997 via pypdf (>=6.0.0, <=6.18.0)

pypdf PYPI version =6.0.0, =0.0.1, =0.6.0, =0.1.0, =0.0.2, =0.1.0, =0.0.24, =0.0.0, =1.1.0, =0.1.2, =0.0.1.dev0, =1.0.0, =1.0.0a3, =1.0.0a4 and more Source cves: CVE-2026-102997 Source advisory: OSV:PYSEC-2026-4156...

pymorant (>=1.0.145, <=1.0.156) potentially affected by CVE-2026-103000 via pypdf (3.16.1)

pypdf PYPI version 3.16.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - pymorant =1.0.145, =1.0.156 Source cves: CVE-2026-103000 Source advisory: OSV:PYSEC-2026-4160...

automateboringstuff3 (2024.10.1), calibreweb (0.6.24) +6 more potentially affected by CVE-2026-102998 via pypdf (5.0.1)

pypdf PYPI version 5.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - automateboringstuff3 2024.10.1 - calibreweb 0.6.24 - forgy =0.1.0, =0.1.0rc1, =0.0.12, =0.0.16 Source cves: CVE-2026-102998 Source advisory:...

docvec-cli (0.1.0), ingenious (>=0.1.0, <=0.1.3) +3 more potentially affected by CVE-2026-102998 via pypdf (5.5.0)

pypdf PYPI version 5.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - docvec-cli 0.1.0 - ingenious =0.1.0, =0.1.3b1, =0.2.6, =29.1.3, =30.0.4 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

chellow (>=1688456919.0.0, <=1692616986.0.0), cybrex (>=1.0.1, <=1.0.7) potentially affected by CVE-2026-102998 via pypdf (3.12.0)

pypdf PYPI version 3.12.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - chellow =1688456919.0.0, =1.0.1, =1.0.7 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

bondai (>=0.1.0, <=0.3.0b2) potentially affected by CVE-2026-102998 via pypdf (3.15.1)

pypdf PYPI version 3.15.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - bondai =0.1.0, =0.3.0b2 Source cves: CVE-2026-102998 Source advisory: OSV:PYSEC-2026-4157...

aiexec-base (0.6.4), ano-code (>=0.1.6, <=0.1.11) +39 more potentially affected by CVE-2026-102998 via pypdf (5.1.0)

pypdf PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - aiexec-base 0.6.4 - ano-code =0.1.6, =0.0.1, =1.0.0, =0.6.0, =0.0.3, =0.1.0, =0.3.1, =3.3.6, =1.0.16, =0.2.37, =1.0.0, =0.1.11, =0.1.24 and more Sourc...

add-staves (>=0.1.1, <=0.2.4), agentix-agent-sdk (0.1.0) +137 more potentially affected by CVE-2026-102998 via pypdf (4.3.1)

pypdf PYPI version 4.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - add-staves =0.1.1, =0.0.1, =0.0.1.dev1, =3.0.0, =0.1.0, =1.0.0, =0.3.8.0, =0.3.2, =0.1.6, =1725528079.0.0, =0.1.4, =0.1.9 and more Source cves:...

genai-4-dps-helper (0.2.31), news-scraper-pdf (1.1.6) +6 more potentially affected by CVE-2026-102994 via pypdf (5.3.0)

pypdf PYPI version 5.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - genai-4-dps-helper 0.2.31 - news-scraper-pdf 1.1.6 - polytext =0.1.0, =0.1.0, =0.1.10 - python-pdf-toolkit 0.1.1 - synforge 0.1.0 - ta-using-llms 0.0....

smart-pdf (2023.9.11.1) potentially affected by CVE-2026-102994 via pypdf (3.16.0)

pypdf PYPI version 3.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - smart-pdf 2023.9.11.1 Source cves: CVE-2026-102994 Source advisory: OSV:PYSEC-2026-4153...

airlock-llm (>=0.1.1, <=0.5.15), gllm-multimodal-binary (>=0.2.9b1, <=0.3.22) +7 more potentially affected by CVE-2026-84377 via litellm (1.95.0)

litellm PYPI version 1.95.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - airlock-llm =0.1.1, =0.2.9b1, =0.7.15, =0.1.0.8.11, =0.1.0.9 - pbi-agent 0.14.0 - pilottai-tools 0.1.0 - pr-agent 0.42.0 Source cves:...

agntspace (1.156.1), friday-chat (>=0.1.0a1, <=0.1.0a2) +8 more potentially affected by CVE-2026-84377 via litellm (>=1.94.0, <=1.94.1)

litellm PYPI version =1.94.0, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a2 - litellm-routing-testbed 0.1.0 Source cves: CVE-2026-84377 Source advisory: OSV:PYSEC-2026-4066...