13345 matches found
ROOT-APP-PYPI-CVE-2026-59204 CVE-2026-59204 in pillow - Patched by Root
Root has patched CVE-2026-59204 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-JM82-FX9C-MX94 GHSA-jm82-fx9c-mx94 in pypdf - Patched by Root
Root has patched GHSA-jm82-fx9c-mx94 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-27026 CVE-2026-27026 in pypdf - Patched by Root
Root has patched CVE-2026-27026 in the pypdf package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-956X-8GVW-WG5V GHSA-956x-8gvw-wg5v in GitPython - Patched by Root
Root has patched GHSA-956x-8gvw-wg5v in the GitPython package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-44271 CVE-2023-44271 in pillow - Patched by Root
Root has patched CVE-2023-44271 in the pillow package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2023-49082 CVE-2023-49082 in aiohttp - Patched by Root
Root has patched CVE-2023-49082 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2024-23829 CVE-2024-23829 in aiohttp - Patched by Root
Root has patched CVE-2024-23829 in the aiohttp package for Root:PyPI. Multiple fixed versions available...
GHSA-79QM-7RJ5-M7R9 vulnerabilities
Vulnerabilities for packages: langfuse...
PraisonAI CodeAgent 1.6.77 Remote Code Execution
The CodeAgent.executepython in PraisonAI executes LLM-generated code without sandboxing, AST validation, or import restrictions. This allows full environment secret exfiltration and arbitrary code execution via prompt injection. Versions 1.6.77 and below are affected. !/usr/bin/env python3 Exploi...
cbtham-feast-az-provider (0.2.299), elemeno-ai-sdk (>=0.0.5, <=0.6.11) +25 more potentially affected by CVE-2026-18947 via feast (>=0.9.3, <=0.65.0)
feast PYPI version =0.9.3, =0.0.5, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.1, =0.1.0rc3, =0.0.2, =1.0.0, =1.0.0, =0.1.0, =0.4.0 - mlops-ods 0.1.202406281646 and more Source cves: CVE-2026-18947 Source advisory: SNYK:PYTHON-FEAST-18612610...
MAL-2026-13682 Malicious code in btcflx (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 839c411e8d33badaebd5e59b2d966dc000e631843a49ce9352caafd1b7dd9e12 Package advertises itself as an HTTP speed-up library but on import of the top-level module unconditionally locates the user's Monero wallet director...
MAL-2026-13683 Malicious code in kotoraka (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0b7d2fa2d2e401d5ca6c2cc4bb07964a955afa5e532e3947fdcfd6395570dd6 On import, kotoraka decodes base64-obfuscated filesystem paths pointing at the user's Monero wallet directory Windows: C:\Users\Documents\Monero;...
EulerOS 2.0 SP11 : python-pip (EulerOS-SA-2026-3148)
According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...
EUVD-2025-27054
Frappe is a full-stack web application framework. Versions 14.96.9 and below, and 15.0.0 through 15.71.0 have an insecure endpoint parameter that is vulnerable to error-based SQL Injection through lack of validation. Sensitive information such as versioning can be retrieved. This issue is fixed i...
MAL-2026-13606 Malicious code in cdktn-provider-azurerm (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e647bdd78382c54b0565b5bde30513112aaebc17e80019da2ebfe1cfe3f9a14e Package name and branding closely mimic HashiCorp's legitimate cdktf-provider-azurerm CDK for Terraform, with a single-character substitution cdktf →...
pip absolute path traversal during download from malicious package indexes
...
MAL-2026-13380 Malicious code in uncrypt (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61fc5c3033efaa35a8eae7781fa0fc4b300f753c5b0d56e07adcc0557e9b648f The package presents itself as a trivial Python XOR/hex helper, but uncrypt/init.py executes runsecuritylauncher at module top level, which...
ROOT-APP-PYPI-CVE-2026-28684 CVE-2026-28684 in python-dotenv - Patched by Root
Root has patched CVE-2026-28684 in the python-dotenv package for Root:PyPI. Multiple fixed versions available...