Improper Protection of Alternate Path

Overview crewai-tools is a Set of tools for the crewAI framework Affected versions of this package are vulnerable to Improper Protection of Alternate Path due to the blocklist mechanism operating at the import system level rather than accounting for the complete Python runtime. An attacker can...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

Malicious code in invent-with-python-zh (npm)

The package invent-with-python-zh was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in industrial-ivory-python (npm)

Source: amazon-inspector 84f4091b09dd34c2f660257e6736992d2586737212b3178e8e0419ab6aa3be66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in immense-coral-python (npm)

Source: amazon-inspector 269a5211ffbab9b2bba7dbaeb7594cb6e5834f8aa951788ce64d1c4f8b5b57d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

CAPE-parsers v0.1.69

CAPE-parsers CAPE core and community parsers Configs structure CNCs: campaign: str botnet: str dgaseed: hex str version: str mutex: str useragent: str build: str cryptokey: str cryptokeytype: str algorithm. Ex: RC4, RSA public key. salsa20, xchacha20 raw: any other data goes here All CNC entries...

CVE-2026-37008

CrewAI before commit fb2323b contains a sandbox escape vulnerability in its Python blocklist mechanism. The blocklist operates at the import-time level by blocking module names, but this does not address the full availability of Python's object graph. For example, calling ctypes.CDLL(None) loads ...

CVE-2026-37008: Improper Protection of Alternate Path

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

CVE-2026-29811

CyberPanel before 2.4.4 attempts to detect an "alais" domain i.e., a second domain that serves the same content as a primary domain; normally spelled "alias" via an ORM query filter rather than a Python "if" statement...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

Python Import As an Execution Boundary: An Empirical Study of Bugs, Vulnerabilities, and Analysis Gaps

Python import does more than resolve dependencies: it executes code during module and package initialization. This behavior can trigger failures, load dynamic or native code, access resources, or change security-sensitive state before an application calls a package API. Prior work studies package...

PT-2026-90969

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

CVE-2026-37008

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

EUVD-2026-77111

CrewAI before fb2323b offers a Python blocklist approach that operates at the wrong level of abstraction, a different vulnerability than CVE-2026-2275. Import-time blocking of module names does not address the availability of Python's complete object graph. For example, calling ctypes.CDLLNone...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: python-requests (UTSA-2023-002301)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002301 advisory. Requests is a HTTP library. Since Requests 2.3.0, Requests has been leaking Proxy-Authorization headers to destination servers when redirected to an HTTPS endpoint...

shodan-CVE-2018-15473

これはShodanによって参照される100のIPアドレスに対してCVE-2018-15473のエクスプロイトをテストする簡単なスクリプトです。テストされるユーザー名はusers.txtに含まれています。 実行する必要があるファイルはmain.pyです。Linuxで動作し、www.shodan.ioから自身のAPIキーを取得する必要があります。 結果は標準出力にのみ表示されます。ips.txtに保存されるIPリストを期待してください。 CVE攻撃はhttps://github.com/Sait-Nuri/CVE-2018-15473からフォークされました。...

PYSEC-2026-3985

vLLM before 0.28.0 contains a remote code execution vulnerability in the LlavaOnevision2 processor loader that ignores the trustremotecode parameter when loading remote processor classes. Attackers can craft a malicious model with arbitrary code in processingllavaonevision2.py that executes with...

Malicious code in python-fork (PyPI)

Source: kam193 0bff88696e931354b786185cde4b21e28c27407203c5733ac31b52b7186c1e78 Importing the module starts a fork bomb, what can lead to destabilizing the system. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-python-fork Reasons based o...