Malicious code in databaserobooms (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 193ce4e29885d967183910228ce00d02b4380d25ff1a9b342b1fb5b4c124e3ca During installation package downloads and runs a malicious executable. Likely continuation of 2026-03-rowrap. The campaign is built over a malicious Roblox API...

MAL-2026-2488 Malicious code in photo-extractor (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 67f3f604528f125e85fb7be00bb17d7cf2abc5cdb20a12cbcbb38633f5877f14 Clones of legitimate libraries with malicious modifications intended to download malicious remote code. The remote script allows executing arbitrary files...

Malicious code in gangomodule (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 8117683c90fb188f9fc013b3b3006dc5e31269d2511dd7c80eea9ac7b6892d09 During installation, obfuscated code validates the environment against typical sandboxing signs and attempts to download the next stages from remote sources. T...

CVE-2026-4224 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-3644 vulnerabilities

Vulnerabilities for packages: python...

GHSA-VF33-88PF-HWP3 vulnerabilities

Vulnerabilities for packages: python...

GHSA-H46W-FFVP-4PW5 vulnerabilities

Vulnerabilities for packages: python...

aark-sdk (>=0.1.2 <=0.1.9), abi-maker (=0.1.2) +404 more potentially affected by CVE-2026-40072 via web3 (>=6.0.0b3 <=7.14.1)

web3 PYPI version =6.0.0b3, =0.1.2, =0.1.7, =2.6.0, =1.1.0, =1.0.0, =0.2.1, =0.1.0, =0.7.2, =0.3.0, =0.4.0a1, =0.1.0b1, =0.1.22, =0.4.0, =0.7.0, =0.7.1 and more Source cves: CVE-2026-40072 Source advisory: SNYK:PYTHON-WEB3-15907867...

web3.py: SSRF via CCIP Read (EIP-3668) OffchainLookup URL handling

Summary web3.py implements CCIP Read / OffchainLookup EIP-3668 by performing HTTP requests to URLs supplied by smart contracts in offchainlookuppayload"urls". The implementation uses these contract-supplied URLs directly after sender / data template substitution without any destination validation...

Claude SDK For Python: Memory Tool Path Validation Race Condition Allows Sandbox Escape

The async local filesystem memory tool in the Anthropic Python SDK validated that model-supplied paths resolved inside the sandboxed memory directory, but then returned the unresolved path for subsequent file operations. A local attacker able to write to the memory directory could retarget a...

Insecure File Permissions

Claude SDK for Python is vulnerable to insecure file permissions. The vulnerability is due to the memory tool creating files with mode 0o666, where the files are world‑readable on systems with a standard umask and world‑writable in environments with a permissive umask, and a local attacker on a...

Server-side Request Forgery (SSRF)

Overview pyload-ng is a The free and open-source Download Manager written in pure Python Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the parseurls API function. An attacker can access internal network resources, read local files, enumerate file existenc...

GHSA-HQMJ-H5C6-369M vulnerabilities

Vulnerabilities for packages: py3-onnx...

CVE-2026-4224 vulnerabilities

Vulnerabilities for packages: python...

GHSA-VF33-88PF-HWP3 vulnerabilities

Vulnerabilities for packages: python...

GHSA-H46W-FFVP-4PW5 vulnerabilities

Vulnerabilities for packages: python...

CVE-2026-3644 vulnerabilities

Vulnerabilities for packages: python...

[SECURITY] Fedora 42 Update: python3.14-3.14.3-2.fc42

Python 3.14 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.14 package provides the "python3.14" executable:...

[SECURITY] Fedora 42 Update: python3.9-3.9.25-7.fc42

Python 3.9 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.9, see other distributions that support it, such as CentOS or RHEL or older Fedo...

[SECURITY] Fedora 42 Update: python3.12-3.12.13-2.fc42

Python 3.12 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.12 package provides the "python3.12" executable:...