PYSEC-2026-1584 Remote Code Execution in create_conda_env function in lollms

A remote code execution vulnerability exists in the createcondaenv function of the parisneo/lollms repository. The vulnerability arises from the use of shell=True in the subprocess.Popen function, which allows an attacker to inject arbitrary commands by manipulating the envname and pythonversion...

ROOT-APP-PYPI-CVE-2026-27932 CVE-2026-27932 in rootio-joserfc - Patched by Root

Root has patched CVE-2026-27932 in the rootio-joserfc package for Root:PyPI. Multiple fixed versions available...

MAL-2026-7466 Malicious code in scan-checker (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7467 Malicious code in scanvia (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7465 Malicious code in quatre (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7464 Malicious code in pygremlinbox-malware-network-indicators (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7462 Malicious code in pygremlinbox-malware-cryptomining-indicators (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7463 Malicious code in pygremlinbox-malware-install-execution (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7460 Malicious code in pygremlinbox-malware-code-obfuscation (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7459 Malicious code in pygremlinbox-malware-c2-beacon (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7458 Malicious code in pycryptoshuffle (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in pycryptoshuffle (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7457 Malicious code in piirgg (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7456 Malicious code in notrandompacketname (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7455 Malicious code in myproject234 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7454 Malicious code in cyberday26szymon-payments (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7453 Malicious code in cyberday26szymon-logging (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7452 Malicious code in cyberday26szymon-auth (PyPI)

--- -= Per source details. Do not edit below this line.=-...

PYSEC-2026-1826 PyMongo Out-of-bounds Read in the bson module

Versions of the package pymongo before 4.6.3 are vulnerable to Out-of-bounds Read in the bson module. Using the crafted payload the attacker could force the parser to deserialize unmanaged memory. The parser tries to interpret bytes next to buffer and throws an exception with string. If the...

PYSEC-2026-1292 dbt allows Binding to an Unrestricted IP Address via socketsocket

Summary Binding to INADDRANY 0.0.0.0 or IN6ADDRANY :: exposes an application on all network interfaces, increasing the risk of unauthorized access. While doing some static analysis and code inspection, I found the following code binding a socket to INADDRANY by passing "" as the address. This...