dagtool (>=0.0.8, <=0.0.11) potentially affected by CVE-2026-81914 via apache-airflow-providers-google (15.1.0)

apache-airflow-providers-google PYPI version 15.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - dagtool =0.0.8, =0.0.11 Source cves: CVE-2026-81914 Source advisory: OSV:PYSEC-2026-4187...

airflow-parse-bench (>=0.0.1, <=1.0.1), airflow-toolkit (0.13.3) +2 more potentially affected by CVE-2026-81914 via apache-airflow-providers-google (10.26.0)

apache-airflow-providers-google PYPI version 10.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow-providers-google and may be impacted: - airflow-parse-bench =0.0.1, =0.11.1, =0.1.0, =0.1.1 Source cves: CVE-2026-81914 Source advisory:...

Malicious code in aseitylab (PyPI)

Source: kam193 24b99c2059065cbe44f7dac2f1d2878b237c58150c0890baa1856852e76fcb24 During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

CVE-2026-102904: Improper Neutralization of Argument Delimiters in a Command

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

PT-2026-102922

Name of the Vulnerable Software and Affected Versions JupyterLab versions 4.0.0 through 4.5.10 JupyterLab versions 4.6.0 through 4.6.3 Description In the PyPI Extension Manager, the ExtensionHandler.post function validates extension names during installation but fails to reject option-like values...

aad-fastapi-dl37 (>=1.0.0, <=1.0.2), agentstack-cli (>=0.4.0rc1, <=0.7.1) +301 more potentially affected by CVE-2026-96760 via authlib (>=1.0.0b2, <=1.8.0)

authlib PYPI version =1.0.0b2, =1.0.0, =0.4.0rc1, =0.1.0, =2.0.0, =2.0.0, =0.1.0, =0.5.0, =1.3.0a20250904, =1.2.0a20250730, =1.2.0a20250730, =0.0.0, =0.9.5, =1.7.0, =0.0.1, =0.1.0 and more Source cves: CVE-2026-96760 Source advisory: SNYK:PYTHON-AUTHLIB-20257410...

Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

MAL-2026-17240 Malicious code in aseitylab (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b47f0f7a0776cad3d4c83604d35a0023a250d2f035e58129233095aa2b110a3 aseitylab/shimdata.py contains a large base85-encoded, zlib-compressed blob stored as DATA. aseitylab/compat.py defines ensurecompat, which...

360solutions-bc-mcp (0.5.7), acapy-agent (>=1.6.1rc0, <=1.7.0) +199 more potentially affected by CVE-2026-102272 via pyjwt (2.13.0)

pyjwt PYPI version 2.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - 360solutions-bc-mcp 0.5.7 - acapy-agent =1.6.1rc0, =0.1.8, =0.0.116, =1.420.5, =26.6.0, =0.25.0, =0.57.0, =0.1.0, =0.1.0, =1.1.0, =0.11.0, =3.8.0,...

1xn-vmcp (>=0.5.2, <=0.6.1), a2c-smcp (>=0.1.1rc0, <=0.1.5) +1308 more potentially affected by unknown CVE via mcp (>=1.0.0, <=1.29.1)

mcp PYPI version =1.0.0, =0.5.2, =0.1.1rc0, =0.0.2, =0.2.0, =0.1.0, =0.1.7rc1, =0.1.7, =1.2.3, =0.5.0, =0.1.1, =0.1.19 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-MCP-20417226...

5mghost-rover (>=0.0.1, <=0.0.3), a11y-computer-use (>=0.1.1, <=0.4.76) +484 more potentially affected by unknown CVE via mcp (>=2.0.0b1, <=2.1.1)

mcp PYPI version =2.0.0b1, =0.0.1, =0.1.1, =0.6.0, =0.1.0, =0.1.0a1, =0.32.1, =0.1.0, =0.21.0, =0.8.0, =0.10.0 - agentic-resume-builder 0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-MCP-20417226...

Malicious code in azure-langchain-example (PyPI)

Source: kam193 59c10650dde5db077b435212025a4cb48ab69daf76022cb932dfec98beea4479 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

MAL-2026-17213 Malicious code in azure-langchain-example (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1cffc3a51858b1b7a17ff0edfd2eeae6383e83b4eff5bc078f7b1d4f5ba36ad2 On import azurelangchainexample, the package's init.py starts a background daemon thread that issues a GET request to...

1xn-vmcp (>=0.5.2, <=0.6.1), a2c-smcp (>=0.1.1rc0, <=0.1.5) +1129 more potentially affected by unknown CVE via mcp (>=1.9.1, <=1.29.1)

mcp PYPI version =1.9.1, =0.5.2, =0.1.1rc0, =0.0.2, =0.1.0, =0.1.7rc1, =0.1.7, =1.2.3, =0.5.0, =0.1.1, =0.11.3, =0.11.10 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0089...

5mghost-rover (>=0.0.1, <=0.0.3), a4ui-agent (0.1.0) +430 more potentially affected by unknown CVE via mcp (>=2.0.0, <=2.1.1)

mcp PYPI version =2.0.0, =0.0.1, =0.6.0, =0.1.0, =0.1.0a1, =0.32.1, =0.1.0, =0.21.0, =0.8.0, =0.10.0, =0.21.0 and more Source cves: unknown CVE Source advisory: MEND:WS-2026-0089...

langchain-utcp (0.1.0), utcp-agent (>=1.0.0, <=1.0.3) potentially affected by CVE-2026-101057 via utcp-mcp (1.0.2)

utcp-mcp PYPI version 1.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on utcp-mcp and may be impacted: - langchain-utcp 0.1.0 - utcp-agent =1.0.0, =1.0.3 Source cves: CVE-2026-101057 Source advisory: MEND:CVE-2026-101057...

Malicious code in aseity (PyPI)

Source: kam193 cf65ea5c0fe1eeef9f47a75d65e291a715094076714694247ad03714eabc53ca During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data a...

MAL-2026-17199 Malicious code in scrapetools2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 44124d389269a5e4dc8801d3af1afeb08aee57313fcc7082570c5890e7d89233 scrapetools2 1.2.1 ships an auto-update mechanism in downloader.py that fetches tar.gz payloads from public IPFS gateways eu.orbitor.dev, dget.top,...

MAL-2026-17200 Malicious code in aseity (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d65d0df302f9fdd618d08a8bc095702f5b6594712ba82205c758c710fee9006e setup.py invokes aseity.compat.ensurecompat, which base64+zlib-decodes the DATA constant shipped in aseity/shimdata.py and passes the resulting Pytho...