aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to force expensive parsing of arbitrary JSON payloads that will ultimately be rejected, leading to unnecessary CPU and memory consumption. Version 3.0.7 fixes the issue. Some workarounds are available. Restrict request body size at the reverse proxy or web framework, rate-limit webhook endpoints, and/or reject oversized requests before JSON parsing.
The xAyOuB-XcTxTeaM PyPI package versions 0.1.0, 0.1.1, and 0.1.2 contain malicious code that automatically starts a Flask HTTP server on import, exposing unauthenticated remote control endpoints. This allows remote attackers to cause the package to send abuse traffic from the installer's IP. The package also logs into multiple hardcoded Garena Free Fire guest accounts using embedded credentials and emits invite-spam packets to targets specified by the attacker. TLS verification is disabled for these outbound connections, and sensitive credentials are stored in cleartext within the package.
The decapod-common package on PyPI contains malicious code that exfiltrates the installer's hostname and resolved IP address to a hardcoded external webhook during installation. This behavior occurs automatically during the pip install process via an overridden install command in setup.py. The package does not provide any legitimate functionality beyond this data exfiltration.
The PyPI package 'uncrypt' versions 0.1.0, 0.1.1, and 0.1.2 contains malicious code that executes a bundled native binary upon import. This binary performs host and user enumeration, screen capture, filesystem traversal, and network communication to exfiltrate data such as browser information and system details. The malicious behavior is hidden behind a benign XOR/hex helper facade and includes sandbox detection to evade analysis.
The PyPI package 'numpyp' is a malicious typo-squatting package mimicking the popular 'numpy' library. It exports functions that send any input data provided by the user to a hardcoded external server controlled by the attacker without disclosure. This can lead to inadvertent leakage of sensitive information such as secrets or proprietary data if a developer mistakenly installs and uses 'numpyp' instead of 'numpy'.
The gcli-control package on PyPI contains malicious code that installs a host daemon capable of executing commands received from a shared JSON document. This daemon allows any party with write access to the document to execute arbitrary code remotely, including credential theft, keylogging, webcam capture, and privilege escalation. The package includes hardcoded default identifiers and a bypass mechanism that disables encryption, enabling unauthenticated remote code execution and full remote-access trojan capabilities. Multiple versions of the package are affected.
MLflow AI Gateway versions 3.13.0 through 3.15.2 contain a server-side request forgery (SSRF) vulnerability due to lack of validation on the api_base parameter when creating a gateway secret. Any authenticated user, including those with read-only access, can create a secret with a malicious api_base pointing to internal addresses. This allows the gateway proxy endpoint to issue HTTP requests to arbitrary internal resources, potentially exposing sensitive cloud instance metadata and IAM credentials. The vulnerability arises because the existing SSRF protections are not applied to this code path, and the CreateGatewaySecret action lacks specific permission scope enforcement.
python-cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 42.0.0 through 48.0.0, when resolving invalid certificate chains that include duplicate copies of self-signed certificates, the processing recursively invokes the same candidate, leading to an exponential blowup. Although the limitation that the chain depth cannot exceed a specified maximum depth prevents unbounded recursion and guarantees termination, an attacker-controlled certificate chain can lead the processing to easily take more than 5s to reject in testing. This amplification could form the basis for a resource exhaustion denial of service attack. The core issue arises in the recursive nature of build_chain_inner, which does not de-duplicate against previously analyzed candidates. As the correctness of validation is not affected, the integrity of a system cannot be compromised through this vector, only its availability. This issue is fixed in 49.0.0.
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. In versions 45.0.0 through 48.0.0, if an intermediate constrained CA permits the DNS name foo.example.com, and the leaf certificate has a wildcard in its DNS SAN of *.example.com, python-cryptography's verifier accepts which allows escaping outside of the permitted names. The core issue is in DNSConstraint::matches, where a wildcard pattern was treated as matching a more-specific permitted constraint even though *.example.com can expand to sibling names such as bar.example.com outside foo.example.com. This allows acceptance of an invalid certificate chain. This issue is fixed in 49.0.0.
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the HTTP parsers were vulnerable to a request smuggling attack relating to WebSocket upgrades. If using the server-side component, an attacker may be able to execute a request smuggling vulnerability using an edge case in the WebSocket upgrade procedure. A WebSocket upgrade request with a body could cause the parser to switch protocols before the complete request body was received, leaving trailing bytes to be handled as upgraded-protocol or pipelined data rather than normal HTTP body data. This issue is fixed in version 3.14.2.
CVE-2026-69244 is a high severity vulnerability in aiohttp, an asynchronous HTTP client/server framework for Python. Versions prior to 3.14.3 contain an out-of-bounds heap read in the C response parser during error message construction for malformed HTTP responses. This flaw can be triggered by a malicious or accidental server response, potentially causing a denial of service (DoS) in the client. The issue is fixed in version 3.14.3.
GitPython versions up to 3.1.53 contain a vulnerability in the Commit.count() method where unguarded forwarding of options to git rev-list allows an attacker to specify an --output argument. This causes git rev-list to truncate an arbitrary file to zero bytes, resulting in file destruction. The vulnerability has medium severity with a CVSS score of 5.4. A patch is available that adds proper unsafe option checks to Commit.count().
GitPython's Repo.archive() method uses a denylist to block unsafe git archive options, but this denylist is incomplete. Specifically, the options --add-file and --add-virtual-file, which allow reading arbitrary files from the filesystem and injecting arbitrary content into archives, are not blocked. This enables an attacker who can control the options passed to Repo.archive() to read arbitrary files with the privileges of the running process. The vulnerability does not allow code execution but can lead to sensitive file disclosure. A patch is available that extends the denylist to cover these options or implements a safer allowlist approach.
GitPython versions prior to 3.1.57 contain unguarded forwarding of git command options in the methods IndexFile.checkout() and TagReference.create(). This allows an attacker with limited privileges to cause arbitrary file overwrite on the filesystem via the --prefix option in git checkout-index, and arbitrary file read via the -F/--file option in git tag. Both vulnerabilities arise because these methods forward **kwargs directly to git commands without validating or restricting unsafe options. The arbitrary file overwrite can lead to code execution if attacker-controlled repository content is written to sensitive locations. The arbitrary file read exposes file contents to the attacker at the process privilege level. A patch is available to address these issues.
Bulletin ID: 2026-071-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 08/03/2026 12:30 PM PDT Description: AWS Command Line Interface (AWS CLI) is a unified tool to manage AWS services from the command line. We identified CVE-2026-18654, an issue where the EMR SSH helper commands (aws emr ssh, aws emr socks, aws emr put, aws emr get) disabled SSH host key verification, which might allow man-in-the-middle actors to intercept SSH sessions and file transfers via network positioning between the client and the EMR cluster endpoint. Impacted versions: - AWS CLI v1 <= 1.45.27 - AWS CLI v2 <= 2.35.2 Please refer to the article below for the most up-to-date and complete information related to this AWS Security Bulletin.
The PyPI package 'trongriden' version 0.0.1 is identified as malicious software designed for private key exfiltration. It appears related to the cryptocurrency Tron (TRX) and is part of a campaign involving repeated uploads of similar malicious packages that mimic legitimate library readmes. There are no known exploitations in the wild at this time.
The wacve-utils package version 1.0.7 on PyPI contains malicious encrypted code functioning as an infostealer targeting Linux and Android (via Termux). It collects files, browser data, and text messages, then exfiltrates this information to a Telegram channel. The package also downloads and executes remote malicious scripts and uses obfuscation techniques to evade detection.
A vulnerability in keras-team/keras versions <= 3.14.0 allows arbitrary local HDF5 file content disclosure due to improper handling of HDF5 ExternalLinks. The `KerasFileEditor` and `keras.saving.load_weights` functions bypass the `safe_get_h5_group` and `safe_get_h5_dataset` helpers, which are designed to reject ExternalLinks and SoftLinks. This results in automatic dereferencing of links to external HDF5 files, enabling attackers to disclose sensitive data from the victim's local filesystem. Specifically, `KerasFileEditor` extracts attributes and datasets from linked files into its internal structures, while `keras.saving.load_weights` loads weights from linked files into the user's model. This issue can be exploited by providing a malicious `.h5`, `.weights.h5`, or `.keras` file containing ExternalLinks.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (0f81b904b849df393cbe5c34f952af65d8b28e0797e33d62cf964df77d4929c7)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (e8cdbb30c1c2ddf88a76d18b935d4accf68155f936b5df59a8864fafd7f4e06f)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.
---
Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.
Campaign: GENERIC-standard-pypi-install-pentest
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- The package overrides the install command in setup.py to execute malicious code during installation.