External Control of File Name or Path

Overview nltk is a Natural Language Toolkit NLTK is a Python package for natural language processing. Affected versions of this package are vulnerable to External Control of File Name or Path through the CorpusReader.init constructor and the LinThesaurusCorpusReader and PanLexLiteCorpusReader...

Malicious code in py-devoli-common (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33a1bb1bf9c4c225131c5ad323e7b0c1a9f29f34aea30a496ac77661ea05605d The package was found to contain malicious code or consuming dependency that contains malicious code...

ROOT-APP-PYPI-CVE-2025-4565 CVE-2025-4565 in protobuf - Patched by Root

Root has patched CVE-2025-4565 in the protobuf package for Root:PyPI. Multiple fixed versions available...

CVE-2026-69146

creationtimestamp| type| source ---|---|--- 2026-08-17 22:35:05+00:00| published-proof-of-concept| https://github.com/mlflow/mlflow/security/advisories/GHSA-3p64-6gvh-82v5 2026-08-17 23:31:40+00:00| seen| https://gist.github.com/alon710/bb0c1f0112166e936833a909d435a77a 2026-08-18 00:01:16+00:00|...

Information Exposure

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Protection Mechanism Failure

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Protection Mechanism Failure

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

ROOT-APP-PYPI-CVE-2025-6176 CVE-2025-6176 in Brotli - Patched by Root

Root has patched CVE-2025-6176 in the Brotli package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-JM82-FX9C-MX94 GHSA-jm82-fx9c-mx94 in pypdf - Patched by Root

Root has patched GHSA-jm82-fx9c-mx94 in the pypdf package for Root:PyPI. Multiple fixed versions available...

airi-test-task (0.1.0), dtaledesktop (>=0.0.1, <=0.1.3) +13 more potentially affected by CVE-2026-19896 via dtale (>=2.2.0, <=3.22.0)

dtale PYPI version =2.2.0, =0.0.1, =0.1.0, =0.0.0.35, =0.1.1, =0.0.14, =0.0.5, =0.0.10, =1.0.0, =0.3.3, =0.1.0, =0.1.5 Source cves: CVE-2026-19896 Source advisory: SNYK:PYTHON-DTALE-18912865...

airi-test-task (0.1.0), dtaledesktop (>=0.0.1, <=0.1.3) +13 more potentially affected by CVE-2026-19897 via dtale (>=2.2.0, <=3.22.0)

dtale PYPI version =2.2.0, =0.0.1, =0.1.0, =0.0.0.35, =0.1.1, =0.0.14, =0.0.5, =0.0.10, =1.0.0, =0.3.3, =0.1.0, =0.1.5 Source cves: CVE-2026-19897 Source advisory: SNYK:PYTHON-DTALE-18912883...

ROOT-APP-PYPI-CVE-2026-27026 CVE-2026-27026 in pypdf - Patched by Root

Root has patched CVE-2026-27026 in the pypdf package for Root:PyPI. Multiple fixed versions available...

External Control of File Name or Path

Overview dspy is a DSPy Affected versions of this package are vulnerable to External Control of File Name or Path via the parsing of untrusted output fields in the Image and Audio adapters. An attacker can access arbitrary local files by injecting a filesystem path into the url field, causing the...

GHSA-79QM-7RJ5-M7R9 vulnerabilities

Vulnerabilities for packages: langfuse...

PraisonAI CodeAgent 1.6.77 Remote Code Execution

The CodeAgent.executepython in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection. Versions 1.6.77 and below are affected. !/usr/bin/env python3 Exploi...

MAL-2026-13682 Malicious code in btcflx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...

MAL-2026-13683 Malicious code in kotoraka (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...

EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2026-3148)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

EUVD-2025-27054

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...

MAL-2026-13606 Malicious code in cdktn-provider-azurerm (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...