MAL-2026-17419 Malicious code in friendly-tools (PyPI)

friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendlygreeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copi...

abracadabra (>=0.0.0, <=0.0.7), ac-solver (0.1.0) +645 more potentially affected by CVE-2026-103262 via tornado (>=6.0.0, <=6.5.8)

tornado PYPI version =6.0.0, =0.0.0, =0.7.3, =1.0.0, =1.0.0, =1.3.0, =0.1.23, =0.0.9.1, =0.20.0, =0.9.5, =22.5.13, =0.0.2, =0.0.5 and more Source cves: CVE-2026-103262 Source advisory: MEND:CVE-2026-103262...

agntspace (1.156.1), friday-chat (>=0.1.0a1, <=0.1.0a2) +8 more potentially affected by unknown CVE via litellm (>=1.94.0, <=1.94.1)

litellm PYPI version =1.94.0, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a1, =0.1.0a2 - litellm-routing-testbed 0.1.0 Source cves: unknown CVE Source advisory: MEND:WS-2026-0150...

arthur-common (2.4.67), benchflow (>=0.6.1, <=0.6.5) +27 more potentially affected by unknown CVE via litellm (>=1.89.0, <=1.89.3)

litellm PYPI version =1.89.0, =0.6.1, =0.6.5 - cognee-community-graph-adapter-arcadedb 0.2.0 - cognee-community-graph-adapter-memgraph 0.2.0 - cognee-community-graph-adapter-networkx 1.1.0 - cognee-community-graph-adapter-pggraph 0.2.0 - cognee-community-graph-adapter-spanner 0.2.0 -...

PT-2026-105811

JupyterLab's PyPI extension manager runs python -m pip uninstall with the extension name taken from the request body. ExtensionHandler.post validates the name for cmd=install but not for cmd=uninstall, so a name that begins with - reaches the command line and pip reads it as an option rather than...

agentcore-metering (>=0.1.0, <=0.3.2), benchflow (>=0.6.6, <=0.7.9.dev2354) +13 more potentially affected by unknown CVE via litellm (>=1.91.0, <=1.91.4)

litellm PYPI version =1.91.0, =0.1.0, =0.6.6, =0.7.7, =0.1.0, =0.5.2, =2.1.7, =1.0.0, =0.4.9, =0.2.1, =0.3.0 - vikingbot 0.1.3 Source cves: unknown CVE Source advisory: MEND:WS-2026-0150...

arthur-common (2.4.68), cisco-ai-mcp-scanner (>=4.8.1, <=4.8.5) +6 more potentially affected by unknown CVE via litellm (1.93.0)

litellm PYPI version 1.93.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - arthur-common 2.4.68 - cisco-ai-mcp-scanner =4.8.1, =0.0.0, =2.2.87, =0.1.0, =2.2.100, =0.40.0, =0.41.0 Source cves: unknown CVE Source advisory:...

Linux Distros Unpatched Vulnerability : CVE-2026-102904

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5....

dharta-runtime (>=0.6.77, <=0.6.78), graphrag (>=3.1.1, <=3.1.2) +2 more potentially affected by unknown CVE via litellm (1.92.0)

litellm PYPI version 1.92.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - dharta-runtime =0.6.77, =3.1.1, =3.1.1, =0.6.66, =0.6.76 Source cves: unknown CVE Source advisory: MEND:WS-2026-0150...

dai-python-commons (>=5.4.17, <=5.4.18), foundation-cancer-image-biomarker (>=1.0.1a4, <=1.0.1a5) +6 more potentially affected by CVE-2026-102930 via virtualenv (20.27.1)

virtualenv PYPI version 20.27.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - dai-python-commons =5.4.17, =1.0.1a4, =0.1.0, =0.1.1, =0.1.0, =0.1.3 - python-rektor-monitor 0.1.1 - pyxote 0.1.0 Source cves:...

delete-branches (1.2.15), delete-workflow-runs (1.2.33) +12 more potentially affected by CVE-2026-102930 via virtualenv (20.35.4)

virtualenv PYPI version 20.35.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-branches 1.2.15 - delete-workflow-runs 1.2.33 - elroy =0.0.62, =0.0.1b1, =0.6.0, =2.2.1, =6.0.0, =1.2.3, =0.6.2, =0.7.0 Source cves...

aprsd (>=1.5.0, <=1.5.1), ttp-sros-parser (>=0.0.1, <=0.1.4) potentially affected by CVE-2026-102930 via virtualenv (20.2.2)

virtualenv PYPI version 20.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aprsd =1.5.0, =0.0.1, =0.1.4 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

limbo (8.6.1), python-thingiverse (>=0.0.6rc1.dev0, <=0.0.7.dev0) +1 more potentially affected by CVE-2026-102930 via virtualenv (20.13.1)

virtualenv PYPI version 20.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - limbo 8.6.1 - python-thingiverse =0.0.6rc1.dev0, =0.26.0, =0.26.1 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

cabrita (>=2.2.2b1, <=2.2.2b2), kaze-python (>=0.7.8, <=0.8.9) +2 more potentially affected by CVE-2026-102930 via virtualenv (16.0.0)

virtualenv PYPI version 16.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cabrita =2.2.2b1, =0.7.8, =0.7.2, =1.7.2, =1.11.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

delete-workflow-runs (>=1.0.0, <=1.1.6), edx-repo-tools (3.1.0) +2 more potentially affected by CVE-2026-102930 via virtualenv (20.33.1)

virtualenv PYPI version 20.33.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - delete-workflow-runs =1.0.0, =1.1.0, =1.3.0 - setup-badge 1.0.11 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

aeso-mcp (>=0.2.0, <=0.3.0), aia-read-svc (>=0.5.1, <=0.6.2) +467 more potentially affected by CVE-2026-102930 via virtualenv (20.39.1)

virtualenv PYPI version 20.39.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - aeso-mcp =0.2.0, =0.5.1, =2023.2.21, =0.12.0, =0.1.0, =0.2.0, =0.2.0, =0.2.1, =0.2.1, =0.6.4, =0.2.0rc3, =0.1.0, =0.1.8 - api-buddy 0.5.0...

cinemator (0.1.3), gsy-frameworke (>=1.2.0, <=5.0.2) +1 more potentially affected by CVE-2026-102930 via virtualenv (20.10.0)

virtualenv PYPI version 20.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - cinemator 0.1.3 - gsy-frameworke =1.2.0, =5.0.2 - limbo 8.6.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

5gasp-cli (>=0.1.0, <=0.4.0), appcensus-dynamic-repos (0.6.1.91) +33 more potentially affected by CVE-2026-102930 via virtualenv (20.21.1)

virtualenv PYPI version 20.21.1 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - 5gasp-cli =0.1.0, =1.1.2, =1.3.0rc1, =1.5.9, =2.3.0, =0.0.88, =0.7.7, =1.0.3, =24.9.958497, =0.5.2, =0.6.0, =0.6.4 and more Source cves:...

debpackager (>=0.1.0, <=0.2.1), scriptworker (0.2.1) +1 more potentially affected by CVE-2026-102930 via virtualenv (15.0.2)

virtualenv PYPI version 15.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - debpackager =0.1.0, =0.2.35, =1.1.0 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...

chemscad (>=2.0.1.post4, <=2.0.2) potentially affected by CVE-2026-102930 via virtualenv (20.0.31)

virtualenv PYPI version 20.0.31 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - chemscad =2.0.1.post4, =2.0.2 Source cves: CVE-2026-102930 Source advisory: OSV:GHSA-94P9-XGH2-XP45...