13223 matches found
ROOT-APP-PYPI-CVE-2025-4565 CVE-2025-4565 in protobuf - Patched by Root
Root has patched CVE-2025-4565 in the protobuf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-34993 CVE-2026-34993 in aiohttp - Patched by Root
Root has patched CVE-2026-34993 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-67221 CVE-2025-67221 in orjson - Patched by Root
Root has patched CVE-2025-67221 in the orjson package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-41066 CVE-2026-41066 in lxml - Patched by Root
Root has patched CVE-2026-41066 in the lxml package for Root:PyPI. Multiple fixed versions available...
CVE-2026-69146
creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:05+00:00| published-proof-of-concept| https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00|...
ROOT-APP-PYPI-CVE-2025-6176 CVE-2025-6176 in Brotli - Patched by Root
Root has patched CVE-2025-6176 in the Brotli package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-59204 CVE-2026-59204 in pillow - Patched by Root
Root has patched CVE-2026-59204 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-JM82-FX9C-MX94 GHSA-jm82-fx9c-mx94 in pypdf - Patched by Root
Root has patched GHSA-jm82-fx9c-mx94 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-27026 CVE-2026-27026 in pypdf - Patched by Root
Root has patched CVE-2026-27026 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-956X-8GVW-WG5V GHSA-956x-8gvw-wg5v in GitPython - Patched by Root
Root has patched GHSA-956x-8gvw-wg5v in the GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-44271 CVE-2023-44271 in pillow - Patched by Root
Root has patched CVE-2023-44271 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-49082 CVE-2023-49082 in aiohttp - Patched by Root
Root has patched CVE-2023-49082 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-23829 CVE-2024-23829 in aiohttp - Patched by Root
Root has patched CVE-2024-23829 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
GHSA-79QM-7RJ5-M7R9 vulnerabilities
Vulnerabilities for packages: langfuse...
PraisonAI CodeAgent 1.6.77 Remote Code Execution
The CodeAgent.executepython in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection. Versions 1.6.77 and below are affected. !/usr/bin/env python3 Exploi...
MAL-2026-13682 Malicious code in btcflx (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...
MAL-2026-13683 Malicious code in kotoraka (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...
EUVD-2025-27054
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...
MAL-2026-13606 Malicious code in cdktn-provider-azurerm (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...