0xpwn (0.1.1), a2a-acl (>=0.0.14, <=0.1.1) +819 more potentially affected by CVE-2026-84377 via litellm (>=1.0.0, <=1.88.1)

litellm PYPI version =1.0.0, =0.0.14, =0.0.14, =0.3.5, =0.7.3, =0.1.0, =0.4.0, =0.1.0, =0.1.39, =0.2.1, =0.1.0, =0.1.1 and more Source cves: CVE-2026-84377 Source advisory: GHSA-3CV6-JPF6-8222...

airlock-llm (>=0.1.1, <=0.5.15), gllm-multimodal-binary (>=0.2.9b1, <=0.3.22) +7 more potentially affected by CVE-2026-84377 via litellm (1.95.0)

litellm PYPI version 1.95.0 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - airlock-llm =0.1.1, =0.2.9b1, =0.7.15, =0.1.0.8.11, =0.1.0.9 - pbi-agent 0.14.0 - pilottai-tools 0.1.0 - pr-agent 0.42.0 Source cves:...

0xpwn (0.1.1), a2a-acl (>=0.0.14, <=0.1.1) +819 more potentially affected by CVE-2026-84377 via litellm (>=1.0.0, <=1.88.1)

litellm PYPI version =1.0.0, =0.0.14, =0.0.14, =0.3.5, =0.7.3, =0.1.0, =0.4.0, =0.1.0, =0.1.39, =0.2.1, =0.1.0, =0.1.1 and more Source cves: CVE-2026-84377 Source advisory: OSV:GHSA-3CV6-JPF6-8222...

agentcore-metering (>=0.1.0, <=0.3.2), benchflow (>=0.6.6, <=0.7.9.dev2354) +13 more potentially affected by CVE-2026-84377 via litellm (>=1.91.0, <=1.91.4)

litellm PYPI version =1.91.0, =0.1.0, =0.6.6, =0.7.7, =0.1.0, =0.5.2, =2.1.7, =1.0.0, =0.4.9, =0.2.1, =0.3.0 - vikingbot 0.1.3 Source cves: CVE-2026-84377 Source advisory: OSV:GHSA-3CV6-JPF6-8222...

aiconsole (>=0.2.0, <=0.2.7), fastrepl (>=0.0.19, <=0.0.20) potentially affected by CVE-2026-84377 via litellm (0.6.6)

litellm PYPI version 0.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - aiconsole =0.2.0, =0.0.19, =0.0.20 Source cves: CVE-2026-84377 Source advisory: OSV:GHSA-3CV6-JPF6-8222...

autogpt-forge (>=0.1.0, <=0.1.3), cosmoai (>=0.6.0, <=0.6.6) +12 more potentially affected by CVE-2026-84377 via litellm (0.1.7713)

litellm PYPI version 0.1.7713 is affected by a known vulnerability. The following packages have a transitive dependency on litellm and may be impacted: - autogpt-forge =0.1.0, =0.6.0, =0.2.4, =0.1.11, =0.0.1, =0.1.7, =0.1.0, =0.1.2, =0.0.2, =0.0.3 - yival 0.1.0a4 Source cves: CVE-2026-84377 Sourc...

arthur-common (2.4.67), benchflow (>=0.6.1, <=0.6.5) +27 more potentially affected by CVE-2026-84377 via litellm (>=1.89.0, <=1.89.3)

litellm PYPI version =1.89.0, =0.6.1, =0.6.5 - cognee-community-graph-adapter-arcadedb 0.2.0 - cognee-community-graph-adapter-memgraph 0.2.0 - cognee-community-graph-adapter-networkx 1.1.0 - cognee-community-graph-adapter-pggraph 0.2.0 - cognee-community-graph-adapter-spanner 0.2.0 -...

aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +131 more potentially affected by CVE-2026-103241 via vllm (>=0.1.3, <=0.26.0)

vllm PYPI version =0.1.3, =0.2.1, =1.2.2, =0.0.0, =2.3.5.dev0, =0.0.1b1, =0.2.2, =0.2.4, =0.1.0, =0.1.15rc1, =0.1.0, =0.1.0, =0.2.1 and more Source cves: CVE-2026-103241 Source advisory: OSV:PYSEC-2026-4186...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +589 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =0.0.2, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =2.22.0 and more Source cves: CVE-2026-97688 Source advisory: GHSA-GH4C-6FX4-QH6G...

360solutions-bc-mcp (>=0.5.3, <=0.5.7), adversarial-workflow (>=0.4.0, <=0.9.8) +589 more potentially affected by CVE-2026-97688 via urllib3 (>=2.6.2, <=2.7.0)

urllib3 PYPI version =2.6.2, =0.5.3, =0.4.0, =0.1.0, =0.5.0rc4, =0.1.0, =0.20.3, =0.0.2, =1.3.0, =0.1.0, =0.5.0, =1.1.0, =2.22.0 and more Source cves: CVE-2026-97688 Source advisory: OSV:GHSA-GH4C-6FX4-QH6G...

SUSE CVE-2026-102904

JupyterLab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From JupyterLab 4.0.0 until 4.5.11 and 4.6.4, the PyPI Extension Manager uninstall request reaches ExtensionHandler.post, which validates extension names for installatio...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +14501 more potentially affected by CVE-2026-97689 via urllib3 (>=1.10.4, <=2.7.0)

urllib3 PYPI version =1.10.4, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.2, =0.0.5, =0.0.7 - a-texam 1.1.0 and more Source cves: CVE-2026-97689 Source advisory: GHSA-VXQ7-64XX-V4GW...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +11338 more potentially affected by CVE-2026-97687 via urllib3 (>=1.26.0, <=2.7.0)

urllib3 PYPI version =1.26.0, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.8.2 and more Source cves: CVE-2026-97687 Source advisory: GHSA-8988-9CW3-XX77...

0xdegenmo-lighter-mcp (0.1.1), 1337x (1.2.5) +11338 more potentially affected by CVE-2026-97687 via urllib3 (>=1.26.0, <=2.7.0)

urllib3 PYPI version =1.26.0, =0.3.0, =0.5.3, =0.0.1a0, =2.3.84, =0.1.0, =1.1.2, =0.1.0, =0.1.0, =0.0.5, =0.1.0, =0.8.2 and more Source cves: CVE-2026-97687 Source advisory: OSV:GHSA-8988-9CW3-XX77...

aiohttp-ext-auth (>=0.1.1, <=0.1.2), ais-dom (>=0.76.5, <=0.91.5) +34 more potentially affected by CVE-2026-102270 via pyjwt (1.6.4)

pyjwt PYPI version 1.6.4 is affected by a known vulnerability. The following packages have a transitive dependency on pyjwt and may be impacted: - aiohttp-ext-auth =0.1.1, =0.76.5, =0.0.1, =0.0.1, =0.4.0, =1.0.0, =0.0.19, =0.5.0, =1.1.7, =0.31.0, =0.0.1, =0.0.2, =0.1.0 and more Source cves:...

MAL-2026-17416 Malicious code in friendly-greeting-tools (PyPI)

Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...

Malicious code in friendly-greeting-tools (PyPI)

Versions 0.1.0 through 0.3.6 of friendly-greeting-tools disguise encoded Snowflake credential and data theft routines as a hello-world demo. In versions through 0.3.5, the default rundemo payload reads the Snowflake session token, connection configuration, dbt profiles, and pip configuration, the...

OESA-2026-4167 python-jupyterlab security update

JupyterLab is the next-generation user interface for Project Jupyter offering all the familiar building blocks of the classic Jupyter Notebook notebook, terminal, text editor, file browser, rich outputs, etc. in a flexible and powerful user interface. Security Fixes: JupyterLab versions...

MAL-2026-17417 Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...

Malicious code in beautifytext (PyPI)

beautifytext 1.0.3 imports beautifyText/compat.py from its init.py and from a setup.py install hook. That module starts a detached background process that registers the host hostname, user, OS, working directory with https://bleodw.wisp.uno, then polls it for jobs to run shell commands or read an...