ROOT-APP-PYPI-CVE-2026-41066 CVE-2026-41066 in lxml - Patched by Root

Root has patched CVE-2026-41066 in the lxml package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-59204 CVE-2026-59204 in pillow - Patched by Root

Root has patched CVE-2026-59204 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-44271 CVE-2023-44271 in pillow - Patched by Root

Root has patched CVE-2023-44271 in the pillow package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-34993 CVE-2026-34993 in aiohttp - Patched by Root

Root has patched CVE-2026-34993 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2023-49082 CVE-2023-49082 in aiohttp - Patched by Root

Root has patched CVE-2023-49082 in the aiohttp package for Root:PyPI. Multiple fixed versions available...

MAL-2026-13682 Malicious code in btcflx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...

EUVD-2025-27054

Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...

ROOT-APP-PYPI-CVE-2026-28684 CVE-2026-28684 in python-dotenv - Patched by Root

Root has patched CVE-2026-28684 in the python-dotenv package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-67221 CVE-2025-67221 in orjson - Patched by Root

Root has patched CVE-2025-67221 in the orjson package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-56201 CVE-2024-56201 in Jinja2 - Patched by Root

Root has patched CVE-2024-56201 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2024-34064 CVE-2024-34064 in Jinja2 - Patched by Root

Root has patched CVE-2024-34064 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-27516 CVE-2025-27516 in Jinja2 - Patched by Root

Root has patched CVE-2025-27516 in the Jinja2 package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-41182 CVE-2026-41182 in langsmith - Patched by Root

Root has patched CVE-2026-41182 in the langsmith package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2026-48775 CVE-2026-48775 in langgraph-checkpoint - Patched by Root

Root has patched CVE-2026-48775 in the langgraph-checkpoint package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in langchain - Patched by Root

Root has patched GHSA-gr75-jv2w-4656 in the langchain package for Root:PyPI. Multiple fixed versions available...

ROOT-APP-PYPI-CVE-2025-69277 CVE-2025-69277 in PyNaCl - Patched by Root

Root has patched CVE-2025-69277 in the PyNaCl package for Root:PyPI. Multiple fixed versions available...

MAL-2026-11519 Malicious code in launchdarkly-ai-server-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 460d36c416400537f8c90171c7821b191e0af69df3ec9f0c906300f50b0ea93f launchdarkly-ai-server-sdk 1.0.1 pypi was scanned across 7 files with no a static rule matches and no traced behavior of concern. No install-time or...

CVE-2026-67338

A flaw was found in JupyterLab. The Extension Manager fails to validate URI protocols in package metadata URLs. This allows attackers to publish malicious PyPI packages containing javascript: URLs in their project metadata. When a user clicks on the extension name, arbitrary JavaScript code can b...

ROOT-APP-PYPI-CVE-2026-28802 CVE-2026-28802 in Authlib - Patched by Root

Root has patched CVE-2026-28802 in the Authlib package for Root:PyPI. Multiple fixed versions available...

Malicious Package

Overview trongriden is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...