agntspace (1.156.1), friday-chat (>=0.1.0a1, <=0.1.0a2) +8 more potentially affected by CVE-2026-84377 via litellm (>=1.94.0, <=1.94.1)

litellm PYPI version =1.94.0, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a2 - litellm-routing-testbed 0.1.0 Source cves: CVE-2026-84377 Source advisory: GHSA-3CV6-JPF6-8222...

gllm-multimodal-binary (>=0.2.9b1, <=0.3.22), hubzoid (>=0.7.15, <=1.0.3) +6 more potentially affected by CVE-2026-84377 via litellm (1.95.0)

litellm PYPI version 1.95.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - gllm-multimodal-binary =0.2.9b1, =0.7.15, =0.1.0.8.11, =0.1.0.9 - pbi-agent 0.14.0 - pilottai-tools 0.1.0 - pr-agent 0.42.0 Source cves:...

arthur-common (2.4.69) potentially affected by CVE-2026-84377 via litellm (1.96.0)

litellm PYPI version 1.96.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - arthur-common 2.4.69 Source cves: CVE-2026-84377 Source advisory: GHSA-3CV6-JPF6-8222...

open-interpreter (>=0.1.12, <=0.1.17), promptmodel (>=0.0.25, <=0.0.31) potentially affected by CVE-2026-84377 via litellm (0.13.2)

litellm PYPI version 0.13.2 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - open-interpreter =0.1.12, =0.0.25, =0.0.31 Source cves: CVE-2026-84377 Source advisory: OSV:GHSA-3CV6-JPF6-8222...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +129 more potentially affected by CVE-2026-103241 via vllm (>=0.1.3, <=0.26.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.2, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =0.1.0, =0.1.15rc1, =0.1.0, =0.1.0, =0.0.1, =0.0.38 and more Source cves: CVE-2026-103241 Source advisory: OSV:PYSEC-2026-4186...

aleph-alpha-inference (1.0.0), evoke-vllm (>=0.1.0, <=0.1.1) +7 more potentially affected by CVE-2026-103241 via vllm (>=0.22.0, <=0.29.0)

vllm PYPI version =0.22.0, =0.1.0, =2.8.0, =2.1.3, =0.1.10, =0.1.0, =0.1.4 Source cves: CVE-2026-103241 Source advisory: MEND:CVE-2026-103241...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +519 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =1.4.0a20260110, =1.5.0a20260122 and more Source cves: CVE-2026-97688 Source advisory: GHSA-GH4C-6FX4-QH6G...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +519 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =1.4.0a20260110, =1.5.0a20260122 and more Source cves: CVE-2026-97688 Source advisory: OSV:GHSA-GH4C-6FX4-QH6G...

SUSE CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +14428 more potentially affected by CVE-2026-97689 via urllib3 (>=1.10.4, <=2.7.0)

urllib3 PYPI version =1.10.4, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.2, =0.0.5, =0.0.7 - a-texam 1.1.0 and more Source cves: CVE-2026-97689 Source advisory: GHSA-VXQ7-64XX-V4GW...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +11271 more potentially affected by CVE-2026-97687 via urllib3 (>=1.26.0, <=2.7.0)

urllib3 PYPI version =1.26.0, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.8.2 and more Source cves: CVE-2026-97687 Source advisory: OSV:GHSA-8988-9CW3-XX77...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +11271 more potentially affected by CVE-2026-97687 via urllib3 (>=1.26.0, <=2.7.0)

urllib3 PYPI version =1.26.0, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.8.2 and more Source cves: CVE-2026-97687 Source advisory: GHSA-8988-9CW3-XX77...

aiohttp-ext-auth (>=0.1.1, <=0.1.2), ais-dom (>=0.76.5, <=0.91.5) +34 more potentially affected by CVE-2026-102270 via pyjwt (1.6.4)

pyjwt PYPI version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aiohttp-ext-auth =0.1.1, =0.76.5, =0.0.1, =0.0.1, =0.4.0, =1.0.0, =0.0.19, =0.5.0, =1.1.7, =0.31.0, =0.0.1, =0.0.2, =0.1.0 and more Source cves:...

Malicious code in friendly-greeting-tools (PyPI)

Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...

MAL-2026-17416 Malicious code in friendly-greeting-tools (PyPI)

Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...

OESA-2026-4167 python-jupyterlab security update

JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface. Security Fixes: JupyterLab versions...

Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

MAL-2026-17417 Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

Malicious code in cleanup-string (PyPI)

Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the implementation is standard-library only. However,...

Malicious code in cleanup-string (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 844c5afa9f00c02149f4f6314447c5738e04ed419014809c1df83f31aa012525 The package advertises itself as a pure-Python string helper strip, slugify, case conversion, whitespace collapse and its README states the...