ROS-20260728-73-0019

The vulnerability in python-PyPDF2 is related to excessive iteration. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-67182: Inconsistent Interpretation of HTTP Requests

Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass access controls by injecting bare line feed characters 0x0A into client-supplied request header values that are copied verbatim to upstream connections without validation. Attackers...

CVE-2026-54621: Improper Control of Generation of Code

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.60.1, GraphQL Union description values in src/datamodelcodegenerator/model/template/UnionTypeStatement.jinja2 and src/datamodelcodegenerator/model/template/UnionTypeStatement.py312.jinja2 are rendered into...

SUSE SLED15 / SLES15 Security Update : python-soupsieve (SUSE-SU-2026:3240-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3240-1 advisory. This update for python-soupsieve fixes the following issues - CVE-2026-49476: Memory Exhaustion via Large...

PT-2026-65642

Summary A malicious input schema OpenAPI / JSON Schema can execute arbitrary Python code on the machine that imports the generated model. The x-python-import and customTypePath schema extensions flow, unsanitized, into the import statements datamodel-code-generator emits. A newline embedded in th...

CVE-2026-55403: Exposure of Sensitive Information to an Unauthorized Actor

datamodel-code-generator generates Python data models from schema definitions. Prior to 0.63.0, src/datamodelcodegenerator/http.py getbody reuses Authorization, Cookie, and Proxy-Authorization headers when following cross-origin redirects while fetching remote schemas, allowing credentials scoped...

CVE-2026-54656: Improper Control of Generation of Code

datamodel-code-generator generates Pydantic v2 models, dataclasses, TypedDict, and msgspec.Struct from OpenAPI, JSON Schema, GraphQL, Avro, Protobuf, and raw JSON, YAML, or CSV. From 0.52.1 until 0.60.2, datamodel-code-generator interpolates validators from --extra-template-data in...

CVE-2026-54655: Improper Control of Generation of Code

datamodel-code-generator generates Python data models from schema definitions. From 0.51.0 until 0.60.2, x-python-type values parsed by src/datamodelcodegenerator/parser/jsonschema.py in getpythontypeoverride are inserted into generated field annotations without sufficient validation, allowing...

CVE-2026-55390: Improper Limitation of a Pathname to a Restricted Directory

datamodel-code-generator generates Python data models from schema definitions. From 0.59.0 until 0.62.0, XML Schema parsing in src/datamodelcodegenerator/parser/xmlschema.py for --input-file-type xmlschema resolves xs:include, xs:import, xs:redefine, and xs:override schemaLocation values outside...

PT-2026-65665

Summary datamodel-code-generator's built-in HTTP fetcher http.get body issues an httpx.GET against any URL passed to --url or reached via a redirect chain with no allow-list, no deny-list, no IP/host validation, and follow redirects=True. Loopback addresses, RFC1918 ranges, link-local...

Malicious code in sysnode (npm)

Source: amazon-inspector b1f5d271eb72dffa8868b2701aeb4aa7799ee9d7294f342e14682b6675114077 Package self-describes as a 'System binary configuration tool' but on invocation CLI/bin entry or require it silently bootstraps a full surveillance stack on Windows. index.js:42-47 uses winget and, as...

Malicious code in prisma-client-python (npm)

Source: amazon-inspector 4ba0c0f6a1d1bdb5bffb45ca56fb99b8084fba921cc7689b6e8913c0436fe392 The package's CLI flow ppy generate reads dist/index.enc, a 346 KB AES-encrypted blob, decrypts it using a key extracted from dist/key.enc substring 754..799 via crypto-js AES, writes the plaintext to...

Malicious Package

Overview prisma-client-python is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in clipboard-guardian (npm)

Source: amazon-inspector 6cf1e5328821dbb36e54a2d796ad934ebe79257f8927e2ba741016c4a0f2c79d This package is a cryptocurrency clipper masquerading as a clipboard-protection tool. Its postinstall script npm-install.cjs writes 30+ hardcoded attacker-controlled wallet addresses ETH...

Malicious code in coderzero (npm)

Source: amazon-inspector 0bd26d5ae306572deded5926f2a32dd34de72377da3363cafc4c4026b9c5a93d When a user runs the coderzero CLI, the bundled Python client client/noderzero.py starts a clipboard monitor that polls pyperclip.paste every 300ms and POSTs any change 5 characters as JSON to a hardcoded UR...

Malicious code in syspo (npm)

Source: amazon-inspector 6f89c590b7c90182cb86bc3e45f71f2357003f4359b6e94818fc996951762f5c The package is published as a 'System binary configuration tool' but its actual behavior is a covert clipboard/screen-capture overlay. On invocation npx/bin entry, index.js spawns pointer.py, which installs ...

Malicious code in sysau (npm)

Source: amazon-inspector 2b9246e768a775d54485e7208d0ed4fc575af09bc78c3fde95c5cb24ebc2350d Package advertises itself as a 'System binary configuration tool' but ships pointer.py spawned by index.js which hardcodes VERCELAPIURL='https://iq-overlay-pointer.vercel.app/api' and continuously transmits...

Malicious Package

Overview lucy-python-script-2030 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview python-fork is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv [CVE-2026-28684]

Summary IBM Watson Speech Services Cartridge is vulnerable to a security bypass in python-dotenv, due to a flaw allowing a local attacker to overwrite arbitrary files via a crafted symlink when a cross-device rename fallback is triggered. CVE-2026-28684. Python-dotenv is used in our speech...