13223 matches found
ROOT-APP-PYPI-CVE-2025-69277 CVE-2025-69277 in PyNaCl - Patched by Root
Root has patched CVE-2025-69277 in the PyNaCl package for Root:PyPI. Multiple fixed versions available...
MAL-2026-11519 Malicious code in launchdarkly-ai-server-sdk (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 460d36c416400537f8c90171c7821b191e0af69df3ec9f0c906300f50b0ea93f launchdarkly-ai-server-sdk 1.0.1 pypi was scanned across 7 files with no a static rule matches and no traced behavior of concern. No install-time or...
Malicious code in psbt-utils (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40293a9b1851f25decc83d08f82fab01f1f373d95e13dc937575b7182d470720 psbt-utils presents itself as a PSBT/Bitcoin wallet signing library handling WIF and hex private keys. update.py contains a fetchanddecrypt loader th...
OPENSUSE-SU-2026:11451-1 python311-pip-26.2-1.1 on GA media
These are all security issues fixed in the python311-pip-26.2-1.1 package on the GA media of openSUSE Tumbleweed...
Linux Distros Unpatched Vulnerability : CVE-2026-47764
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pdm is a Python package and dependency manager supporting the latest PEP standards. Versions prior to 2.27.0 are vulnerable to path traversal through writetofs...
Linux Distros Unpatched Vulnerability : CVE-2026-47781
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PDM is a Python package and dependency manager. In versions up to and including 2.26.9, PDM automatically loads project-local plugins from a .pdm-plugins...
Important: python
Issue Overview: CR/LF bytes were not rejected by HTTP client proxy tunnel headers or host. CVE-2026-1502 The incremental HTML parser html.parser.HTMLParser allows for CPU denial-of-service through repeated unterminated markup declarations when processing uncontrolled data. CVE-2026-15308 When...
CVE-2026-67338
A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...
ROOT-APP-PYPI-CVE-2026-44681 CVE-2026-44681 in Authlib - Patched by Root
Root has patched CVE-2026-44681 in the Authlib package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-28802 CVE-2026-28802 in Authlib - Patched by Root
Root has patched CVE-2026-28802 in the Authlib package for Root:PyPI. Multiple fixed versions available...
Malicious Package
Overview trongriden is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
MAL-2026-11429 Malicious code in trongriden (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 dfb2a16e0023940b622e66acf21c1597d4127d94fb730610f509960e49754c3f Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX Tron / Tronix. Some...
CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
UBUNTU-CVE-2026-67338
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
EUVD-2026-51849
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338 JupyterLab before 4.5.9 Stored XSS via Extension Manager
JupyterLab before 4.5.9 contains a stored cross-site scripting vulnerability in the Extension Manager that fails to validate URI protocols in package metadata URLs. Attackers can publish malicious PyPI packages with javascript: URLs in project metadata that execute arbitrary JavaScript in the...
CVE-2026-67338
CVE-2026-67338 affects JupyterLab prior to 4.5.9. A stored cross-site scripting vulnerability resides in the Extension Manager where URI protocols in package metadata URLs are not validated. This allows an attacker to publish malicious PyPI packages with javascript: URLs in project metadata, enab...
MAL-2026-11425 Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...
Malicious code in nvtorch-oot-nightly (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d92503f2178663997d57ffa45fbb89f4a55de70e94f66745b4edf283a98e830f The package's setup.py issues an install-time HTTP request to the hardcoded bare-IP URL http://167.233.212.138/cb/db27bcff144c059f/nvtorchootnightly...