13417 matches found
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338
CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...
EUVD-2026-51849
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
ROOT-APP-PYPI-CVE-2023-44271 CVE-2023-44271 in rootio-pillow - Patched by Root
Root has patched CVE-2023-44271 in the rootio-pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-JM82-FX9C-MX94 GHSA-jm82-fx9c-mx94 in rootio-pypdf - Patched by Root
Root has patched GHSA-jm82-fx9c-mx94 in the rootio-pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-34993 CVE-2026-34993 in rootio-aiohttp - Patched by Root
Root has patched CVE-2026-34993 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in rootio-langchain - Patched by Root
Root has patched GHSA-gr75-jv2w-4656 in the rootio-langchain package for Root:PyPI. Multiple fixed versions available...
MAL-2026-11198 Malicious code in mcp-search-server (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 75c59285ee1a5a83447815e7402410ccfca6a287e0c36d61bcfda3d55396f608 Versions published in 2026-07 after the package was removed by the original author and the name was re-registered by another contain a stub 'share compute swar...
Malicious code in mcp-search-server (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 75c59285ee1a5a83447815e7402410ccfca6a287e0c36d61bcfda3d55396f608 Versions published in 2026-07 after the package was removed by the original author and the name was re-registered by another contain a stub 'share compute swar...
ROOT-APP-PYPI-CVE-2023-49082 CVE-2023-49082 in rootio-aiohttp - Patched by Root
Root has patched CVE-2023-49082 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-23829 CVE-2024-23829 in rootio-aiohttp - Patched by Root
Root has patched CVE-2024-23829 in the rootio-aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-27026 CVE-2026-27026 in rootio-pypdf - Patched by Root
Root has patched CVE-2026-27026 in the rootio-pypdf package for Root:PyPI. Multiple fixed versions available...
CVE-2026-45309
A flaw was found in AsyncSSH, a Python package for SSHv2 protocol implementation. A remote attacker can exploit a path traversal vulnerability by manipulating the SSH username during pre-authentication. This allows the attacker to read sensitive authorized-keys files from unintended directories,...
MAL-2026-11050 Malicious code in discordnv (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d28ded2ca28c0182385e9dccf5939e883fd5f18dfa702ca912429270a92f3646 The package exfiltrates Roblox cookies and Discord tokens from the victim machine. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...
Malicious code in intel-cicd-repo-infrastructure (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-11046 Malicious code in intel-cicd-repo-infrastructure (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 26e9f9760ea5108609a4a105c621c9ed1ac03930e70fe4cfe400f7c256a7641a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...
MAL-2026-11047 Malicious code in karpatkey (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b434ae7cf6afb9ce18a54757c03069983e404db695d959bd29aa628864b8349c On import karpatkey, the top-level karpatkey/init.py spawns a daemon background thread that walks the installer's home directory and collects SSH...
Malicious code in govapkg (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6960d465fbaca432a24450044c48aaaeb6f4c687171c4c0c4305005cccceffaf govapkg presents itself as a client for pkg.go.dev but on any use of its public API get/package/module invokes an internal helper...
PYSEC-2026-3514 PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage Summary PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.gettools: python ctx = setupdynamiccontext agent = Agent instructions="You are a data analyst.",...