confused

Confused A tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python pypi requirements.txt, JavaScript npm package.json, PHP composer composer.json or MVN maven pom.xml. What is this all about? On 9th of February 2021, a security...

llama-index-llms-openllm (>=0.0.1, <=0.4.0) potentially affected by CVE-2026-15035 via openllm (>=0.4.44, <=0.6.30)

openllm PYPI version =0.4.44, =0.0.1, =0.4.0 Source cves: CVE-2026-15035 Source advisory: SNYK:PYTHON-OPENLLM-17895040...

128autograder-ipython (1.0.0rc2), 3-04-2025-ttm (0.1.0) +6277 more potentially affected by CVE-2026-6658 via nbconvert (>=4.2.0, <=7.17.1)

nbconvert PYPI version =4.2.0, =0.5.0a0, =0.1.0, =1.0.3, =0.1.8, =0.1.0, =0.0.0, =1.0.0, =0.11.0, =0.11.2 and more Source cves: CVE-2026-6658 Source advisory: SNYK:PYTHON-NBCONVERT-17707798...

mrbios (0.1.0) potentially affected by unknown CVE via executor-http (0.1.2)

executor-http PYPI version 0.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on executor-http and may be impacted: - mrbios 0.1.0 Source cves: unknown CVE Source advisory: SNYK:PYTHON-EXECUTORHTTP-17220138...

agent-vm-hermes-adapter (>=0.0.116, <=0.0.132), apify-hermes-agent-plugin (>=0.1.0, <=0.1.1) +17 more potentially affected by CVE-2026-10221 via hermes-agent (>=0.13.0, <=0.19.0)

hermes-agent PYPI version =0.13.0, =0.0.116, =0.1.0, =0.1.3, =0.1.0, =3.0.0, =0.1.2, =2.5.17, =0.3.0, =0.9.0, =0.1.0a16, =1.0.1, =1.0.0, =1.0.2, =1.0.20 and more Source cves: CVE-2026-10221 Source advisory: SNYK:PYTHON-HERMESAGENT-18507994...

mailman-web (>=0.0.5, <=0.0.9) potentially affected by CVE-2026-44742 via postorius (>=1.3.10, <=1.3.13)

postorius PYPI version =1.3.10, =0.0.5, =0.0.9 Source cves: CVE-2026-44742 Source advisory: SNYK:PYTHON-POSTORIUS-16635974...

Malicious code in blastchamber-python-pypi (PyPI)

--- -= Per source details. Do not edit below this line.=-...

builder-addon-pca (>=0.0.1, <=0.0.3), configparser-crypt (>=0.6.2, <=1.1.0) +5 more potentially affected by CVE-2025-63675 via cryptidy (1.2.4)

cryptidy PYPI version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on cryptidy and may be impacted: - builder-addon-pca =0.0.1, =0.6.2, =1.4.0, =0.2.0, =2.2.0rc6, =0.9.0, =0.0.4, =1.0.6 Source cves: CVE-2025-63675 Source advisory:...

EUVD-2022-0380

Malicious code in bioql PyPI...

21cmpsdenoiser (>=1.0.0, <=1.0.2), 2404-segmentation-pipeline (>=0.1.0, <=1.0.0) +27998 more potentially affected by CVE-2025-55554 via torch (>=1.0.0, <=2.13.0)

torch PYPI version =1.0.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =2.13.0, =0.1.0, =0.1.0, =0.1.3, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.16 and more Source cves: CVE-2025-55554 Source advisory: SNYK:PYTHON-TORCH-13052969...

MAL-2025-6611 Malicious code in tulipgui-python (PyPI)

--- -= Per source details. Do not edit below this line.=-...

autoxx (>=0.0.11, <=0.0.13), vuln-demo-math-ops (1.0.0) potentially affected by CVE-2025-31491 via agpt (0.2.2)

agpt PYPI version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on agpt and may be impacted: - autoxx =0.0.11, =0.0.13 - vuln-demo-math-ops 1.0.0 Source cves: CVE-2025-31491 Source advisory: SNYK:PYTHON-AGPT-9802316...

autoxx (>=0.0.11, <=0.0.13), vuln-demo-math-ops (1.0.0) potentially affected by CVE-2025-31490 via agpt (0.2.2)

agpt PYPI version 0.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on agpt and may be impacted: - autoxx =0.0.11, =0.0.13 - vuln-demo-math-ops 1.0.0 Source cves: CVE-2025-31490 Source advisory: SNYK:PYTHON-AGPT-9802320...

agentverse (0.1.8.1), airoboros (2.1.1) +34 more potentially affected by CVE-2024-10912 via fschat (>=0.2.2, <=0.2.36)

fschat PYPI version =0.2.2, =0.3.0, =0.0.1, =1.1.0, =1.1.0, =0.1.1, =0.1.1, =0.9.0.8, =1.0.0, =1.1.4 and more Source cves: CVE-2024-10912 Source advisory: SNYK:PYTHON-FSCHAT-9553179...

adbdgl-adapter (>=1.0.0, <=3.0.1), alignn (>=2021.9.29, <=2025.4.1) +94 more potentially affected by unknown CVE via dgl (>=0.5.3, <=2.2.1)

dgl PYPI version =0.5.3, =1.0.0, =2021.9.29, =2022.10.23, =0.0.4, =1.0.0a2, =0.1.0, =1.0.21, =0.1.1, =1.0.0b3, =0.0.1, =0.2.0, =0.0.1, =0.1.0 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-DGL-9295806...

Python's PyPI Reveals Its Secrets

GitGuardian is famous for its annual State of Secrets Sprawl report. In their 2023 report, they found over 10 million exposed passwords, API keys, and other credentials exposed in public GitHub commits. The takeaways in their 2024 report did not just highlight 12.8 million new exposed secrets in...

Malicious code in libpipccstudy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3c57613c9f623e1878a14ac9bc02ec184c1a306b709a32361802838c5a9b785d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

CVE-2022-42965 Exponential ReDoS in snowflake-connector-python leads to denial of service

An exponential ReDoS Regular Expression Denial of Service can be triggered in the snowflake-connector-python PyPI package, when an attacker is able to supply arbitrary input to the undocumented getfiletransfertype method...

CVE-2022-42044

The d8s-asns package for Python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-html package. The affected version is 0.1.0...

CVE-2022-30885

The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party. The current version, without this backdoor, is 1.2.0-1.4.2...