docindex (>=0.8.0, <=0.9.0) potentially affected by CVE-2026-12770 via litellm (0.1.2291)

litellm PYPI version 0.1.2291 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - docindex =0.8.0, =0.9.0 Source cves: CVE-2026-12770 Source advisory: OSV:PYSEC-2026-4068...

Malicious code in friendly-tools (PyPI)

Source: kam193 969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381 The package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest. --- Category: MALICIOUS -...

a2 (>=0.1.0, <=0.6.1), aaa-ml-datasets-course (1.0.0) +574 more potentially affected by CVE-2026-102830 via jupyterlab (>=3.0.0, <=4.5.8)

jupyterlab PYPI version =3.0.0, =0.1.0, =0.1.0b0, =0.1.0b0, =0.1.0b0, =0.1.0, =0.5.5, =2.0.0, =0.1.1, =0.1.0, =3.0.0, =4.33.0, =5.0.0 - arcor2-calibration 0.8.0 and more Source cves: CVE-2026-102830 Source advisory: GHSA-3JQQ-PW4J-PQCJ...

EUVD-2026-89459

JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs...

GHSA-3325-V43H-43RV JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLs

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

aaa-ml-datasets-course (1.0.0), aerocm (0.1.0b0) +148 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.0.0, <=4.5.8)

jupyterlab PYPI version =4.0.0, =0.5.5, =2.0.0, =4.33.0, =1.0.1, =0.1.0, =1.6.4b1, =0.0.1, =1.8.2, =0.0.1, =0.3.1, =0.1.0, =0.1.4 - cad-viewer-widget 3.0.2 and more Source cves: CVE-2026-102904 Source advisory: OSV:GHSA-3325-V43H-43RV...

aaa-ml-datasets-course (1.0.0), aerocm (0.1.0b0) +148 more potentially affected by CVE-2026-102904 via jupyterlab (>=4.0.0, <=4.5.8)

jupyterlab PYPI version =4.0.0, =0.5.5, =2.0.0, =4.33.0, =1.0.1, =0.1.0, =1.6.4b1, =0.0.1, =1.8.2, =0.0.1, =0.3.1, =0.1.0, =0.1.4 - cad-viewer-widget 3.0.2 and more Source cves: CVE-2026-102904 Source advisory: GHSA-3325-V43H-43RV...

datasetinsights (>=0.2.4, <=0.2.5), dotpack (>=0.3.0, <=0.3.6) +6 more potentially affected by CVE-2026-102831 via notebook (>=7.5.5, <=7.5.8)

notebook PYPI version =7.5.5, =0.2.4, =0.3.0, =0.0.1, =0.1.0, =1.0.2, =1.0.4 Source cves: CVE-2026-102831 Source advisory: OSV:GHSA-6966-VJJ6-99XV...

ale-uy (1.5.0), amphi-etl (>=0.9.2a3, <=0.9.8) +11 more potentially affected by CVE-2026-102831 via jupyterlab (>=4.5.0, <=4.5.8)

jupyterlab PYPI version =4.5.0, =0.9.2a3, =0.2.4, =0.0.1, =0.3.0, =2512.2.0, =1.4.0, =0.1.0, =2.0.0, =2.1.2 Source cves: CVE-2026-102831 Source advisory: GHSA-6966-VJJ6-99XV...

cabrita (>=2.2.2b1, <=2.2.2b2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-102925 via virtualenv (16.0.0)

virtualenv PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cabrita =2.2.2b1, =0.7.8, =0.7.2, =1.7.2, =1.11.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

backlogapi (>=0.1.3, <=0.1.5), dcoscli (>=0.4.10, <=0.6.1) +1 more potentially affected by CVE-2026-102925 via virtualenv (15.2.0)

virtualenv PYPI version 15.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - backlogapi =0.1.3, =0.4.10, =0.6.7, =0.7.1 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

debpackager (>=0.1.0, <=0.2.1), scriptworker (0.2.1) +1 more potentially affected by CVE-2026-102925 via virtualenv (15.0.2)

virtualenv PYPI version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - debpackager =0.1.0, =0.2.35, =1.1.0 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

chemscad (>=2.0.1.post4, <=2.0.2) potentially affected by CVE-2026-102925 via virtualenv (20.0.31)

virtualenv PYPI version 20.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad =2.0.1.post4, =2.0.2 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

pattooshared (>=0.0.95, <=0.0.120) potentially affected by CVE-2026-102925 via virtualenv (20.0.30)

virtualenv PYPI version 20.0.30 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - pattooshared =0.0.95, =0.0.120 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

5gasp-cli (>=0.1.0, <=0.4.0), appcensus-dynamic-repos (0.6.1.91) +33 more potentially affected by CVE-2026-102925 via virtualenv (20.21.1)

virtualenv PYPI version 20.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - 5gasp-cli =0.1.0, =1.1.2, =1.3.0rc1, =1.5.9, =2.3.0, =0.0.88, =0.7.7, =1.0.3, =24.9.958497, =0.5.2, =0.6.0, =0.6.4 and more Source cves:...

ablator (0.0.1b3), apollo-sdk (>=0.2.0, <=0.2.11) +29 more potentially affected by CVE-2026-102925 via virtualenv (20.21.0)

virtualenv PYPI version 20.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - ablator 0.0.1b3 - apollo-sdk =0.2.0, =0.8.3b20231012, =0.8.3b20231012, =0.6.1, =1.2.1, =0.1.3, =0.7.2, =0.2.8, =0.0.1, =1.7.16, =0.4.0rc6,...

aeso-mcp (>=0.2.0, <=0.3.0), aia-read-svc (>=0.5.1, <=0.6.2) +468 more potentially affected by CVE-2026-102925 via virtualenv (20.39.1)

virtualenv PYPI version 20.39.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aeso-mcp =0.2.0, =0.5.1, =2023.2.21, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.2.1, =0.2.1, =0.6.4, =0.2.0rc3, =0.1.0, =0.1.8 - api-buddy 0.5.0...

appcensus-dynamic-repos (>=2.0.113, <=2.1.117), microscopemetrics (0.2.4) +11 more potentially affected by CVE-2026-102925 via virtualenv (20.32.0)

virtualenv PYPI version 20.32.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - appcensus-dynamic-repos =2.0.113, =0.6.0, =1.0.0, =0.1.1, =0.5.4, =1.0.1, =1.0.119 Source cves: CVE-2026-102925 Source advisory:...

nova-prompt-optimizer (>=1.0.48, <=1.1.0), pkg-15903 (>=0.1.20, <=0.1.55) +9 more potentially affected by CVE-2026-102925 via virtualenv (20.31.2)

virtualenv PYPI version 20.31.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - nova-prompt-optimizer =1.0.48, =0.1.20, =0.1.1, =0.1.0, =1.0.0, =0.4.9, =0.5.3 Source cves: CVE-2026-102925 Source advisory:...

hatch (>=1.0.0rc2, <=1.0.0rc8) potentially affected by CVE-2026-102925 via virtualenv (20.11.2)

virtualenv PYPI version 20.11.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - hatch =1.0.0rc2, =1.0.0rc8 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...