The mcp-memory-service contains a critical authentication bypass vulnerability in its /api/documents/* endpoints. These endpoints do not enforce any authentication, allowing unauthenticated attackers to read, write, and delete memory data. This is inconsistent with the /api/memories endpoints, which correctly enforce authentication. The flaw allows unauthorized remote attackers to manipulate sensitive memory content without credentials, impacting confidentiality, integrity, and availability.
The starlette-healthcheck package on PyPI versions 1.2.0, 1.3.0, and 1.3.1 contains malicious code that covertly collects environment variable names, the machine hostname, and the public IP address, then sends this telemetry to an author-controlled Azure Container Apps endpoint. This behavior is undocumented and unrelated to the package's advertised functionality as an ASGI healthcheck and request-logging utility. The package includes a hardcoded API key and an undocumented override for the logging endpoint, increasing the risk of incidental adoption due to its plausible utility name and generic author metadata.
The twrap-tool PyPI package version 1.0.0 contains malicious code that fetches and executes arbitrary Python code from a remote repository without verification. The package masquerades as a text-wrapping utility but actually runs attacker-controlled code with the privileges of the caller. This behavior allows remote code execution and potential data exfiltration. The malicious payload is fetched from a mutable tag reference, enabling the attacker to change the executed code at any time after the package is installed. No official patch or fix is currently documented.
Gradio before 6.16.0 contain a path traversal vulnerability in the FileExplorer component's preprocess() method that allows unauthenticated attackers to escape the configured root directory by supplying path segments containing directory traversal sequences or absolute paths. Attackers can provide crafted path segments that cause os.path.join to discard the root_dir prefix entirely, resulting in arbitrary file read or exposure of sensitive files outside the intended directory.
Keras versions before 3.12.2 and between 3.12.3 and before 3.14.1 contain a vulnerability that allows an attacker to craft malicious model files with Virtual Datasets referencing external files. Loading such models can cause unintended reading of external files, potentially disclosing sensitive information. This issue is due to incomplete validation of the dataset's virtual property. The vulnerability is fixed in versions 3.12.2 and 3.14.1.
DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.
The django-bkvision package version 1.2.0 on PyPI contains malicious code that executes during installation. This code collects host metadata such as hostname, username, current working directory, Python version, platform, process ID, and timestamp, then sends this information to an external webhook. Additionally, it performs an HTTP GET request to an internal IP address and forwards the response status and partial content to the same external webhook, effectively enabling server-side request forgery (SSRF) detection. The malicious behavior occurs unconditionally during installation, despite claims that it is gated by environment variables. This package is a dependency confusion attack targeting environments that resolve django-bkvision==1.2.0 from public PyPI instead of the intended internal package.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (8c77584b4e40db9023ca0b8a90fa1bd611c859ed486f99ca3a7c9a83dbfa9877)
This package presents itself as a redistribution of NVIDIA/skillspector (pyproject Homepage points to github.com/NVIDIA/skillspector and the source carries NVIDIA copyright headers) but ships an added telemetry.py module whose own header notes it is not part of the upstream project. telemetry.py hardcodes DEFAULT_TELEMETRY_ENDPOINT = "https://livekit-agents.xyz/skillspector-telemetry" and is enabled by default (SKILLSPECTOR_TELEMETRY defaults to '1'). On every `skillspector` CLI invocation, an @app.callback() hook POSTs a payload containing the installer's hostname (platform.node), username (getpass.getuser), current working directory (os.getcwd), a persistent install_id UUID, OS, arch, Python version, and timestamp to that endpoint. The behavior directly contradicts the README's 'Usage telemetry' section, which states that nothing is sent unless an operator explicitly sets SKILLSPECTOR_TELEMETRY_URL and that usernames, hostnames, and environment values are never sent. The destination domain is unrelated to the declared publisher (NVIDIA). Hostname + username + cwd shipped by default to a non-publisher domain whose documentation explicitly disclaims this collection is covert exfiltration of installer identity, not consensual telemetry.
## Source: kam193 (3c5f440b1893b0d6aad59302e3cef3c14e1ae5b51b83144474e8126b3d2f9075)
This package is a modified, unofficial version of the Nvidia project (https://github.com/NVIDIA/skillspector). The modification is disguised as telemetry. The project's README describes the telemetry as opt-in, anonymous usage reporting of selected data added by the redistributor. In fact the "telemetry" uses a default domain suggesting (impersonating) it belongs to Nvidia's LiveKit project and exfiltrates full command arguments on every CLI invocation.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-skillspector
Reasons (based on the campaign):
- The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
- exfiltration-generic
- dependency-confusion
- clones-real-package
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (9b4c3b37df5e3d08d7bc6ad736e0231ed0dc655640ffdf0dc403f4029ace2787)
Package name explicitly declares its purpose as harvesting Telegram Desktop session data (tdata directory). The tdata folder contains live authenticated Telegram session keys; collecting and exfiltrating it enables full account takeover of the installer's Telegram account by whoever receives the data. Automated tracing of the package contents engaged but its output was withheld by the provider's malware-content safety filter — a signal consistent with the file contents reading as operational session-stealer code. Combined with the self-declared purpose in the package name, the package fits the messaging-session-theft fingerprint (active-attack) rather than any legitimate library shape.
## Source: kam193 (6aa5184e991d29d6a751e13971ce2ce6a1cec834f675a1c3dd5eb0fc2ec75762)
Package exfiltrates data from the Telegram application to a remote location, effectively collecting Telegram sessions.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-telegramlite
Reasons (based on the campaign):
- target:telegram
- files-exfiltration
The fsociety-tools package on PyPI (versions 1.0.0, 1.0.1, and 1.0.2) contains malicious code that acts as a dropper for a Windows executable infostealer named NBSteal. Upon import, the package decodes and decrypts an embedded executable, writes it to the temporary directory, and silently executes it without user awareness. The malware targets data exfiltration from browsers, Telegram, Discord, Roblox, and other platforms, stealing credentials and sensitive information. The package disguises this behavior behind a fake security tool facade and obfuscates the payload to evade detection.
The discord-token-generator package on PyPI versions 1.0.0 through 1.0.3 contains malicious code that executes a hidden Windows binary upon import. This binary, obfuscated and launched without a visible console, acts as an infostealer named "NBSteal" targeting credentials and data from browsers, Telegram, Discord, Roblox, and other platforms. The package impersonates Discord to lure users into installing it. This behavior confirms the package's malicious intent and risk to users who install it.
Lemur manages TLS certificate creation. Prior to 1.9.2, PUT /api/1/roles/ in lemur/roles/views.py:298 authorized updates with RoleMemberPermission(role_id), which allowed either an administrator or any existing member of the target role. The handler passed data["users"] and data["name"] to service.update, allowing a non-admin member to add or remove other users and rename the role. This enabled lateral privilege grants within roles that control certificate and authority access and could deny access by removing legitimate members. The DELETE handler already required admin_permission, confirming that the weaker PUT authorization was inconsistent. The fix applies the same administrator-only requirement to the PUT handler. This issue is fixed in version 1.9.2.
Lemur manages TLS certificate creation. Prior to 1.9.2, lemur.users.service.update assigned a replacement password directly to users.password, while lemur/users/models.py registered User.hash_password only for the before_insert event. Because no before_update listener ran, administrator-initiated password changes through PUT /api/1/users/ were committed as plaintext. The affected user could no longer authenticate normally because bcrypt verification received an unhashed value. A database, backup, replica, query-log, or administrative read compromise exposed immediately usable credentials without offline cracking. The fix registers hashing for before_update and avoids rehashing values that already have a bcrypt prefix. This issue is fixed in version 1.9.2.
Lemur manages TLS certificate creation. Prior to 1.9.2, the JWT verifier in lemur/auth/service.py:130-137 used fetch_token_header to read header_data["alg"] from an unverified token and passed that attacker-controlled value to decode_with_multiple_secrets. PyJWT 2.x rejects alg=none with the configured key, so the flaw is a defense-in-depth gap rather than a direct authentication bypass in the shipped configuration. The unpinned algorithm can become exploitable after an asymmetric-signing migration through algorithm confusion, and it weakens algorithm-based anomaly detection because the token chooses the recorded value. A separate disclosure of LEMUR_TOKEN_SECRET would also permit forged HS256 tokens, although that disclosure is an independent prerequisite. The fix introduces the server-controlled LEMUR_TOKEN_ALGORITHMS allowlist and defaults it to HS256. This issue is fixed in version 1.9.2.
Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url without an effective server-side destination restriction and trigger AcmeHandler.setup_acme_client to make backend requests. An attacker could target cloud instance metadata or internal services from Lemur network context, potentially obtaining credentials available to the host. The advisory also identifies creator-equality authorization behavior that could preserve access to certificate key material after ownership or role changes, with insufficient export_private_key audit context to distinguish that access path. Together, the acme_url server-side request forgery and authorization weakness could expose cloud credentials and long-lived PKI private-key access. The fix adds ACME_DIRECTORY_HOST_ALLOWLIST validation and enriches key-export audit events with creator and current-owner context. This issue is fixed in version 1.9.2.
Dosage versions prior to 3.3 contain a stored cross-site scripting (XSS) vulnerability in their HTML and RSS output handlers. User-controlled content such as comic text and page URLs are written directly into generated HTML and RSS files without proper HTML escaping. This allows attacker-controlled JavaScript to execute in the browser when a user opens these files. The vulnerability stems from the lack of sanitization or escaping of untrusted input before writing to output files.
CVE-2026-48813 is a vulnerability in flawfinder prior to version 2.0.20 that allows output manipulation via untrusted filenames and source text. It enables Terminal/ANSI Escape Sequence Injection, which can spoof terminal output to hide or alter scan results, and CSV/XML injection that can corrupt structured reports such as SonarQube outputs. This affects users who scan repositories with malicious filenames or code context. The issue is fully patched in flawfinder 2.0.20.
A denial of service vulnerability exists in python-socketio versions prior to 5.16.2 where the server accumulates binary EVENT and ACK messages in memory while waiting for their attachments. An attacker can exploit this by sending a binary message and withholding one or more attachments, causing memory to be consumed indefinitely. This issue is addressed in version 5.16.2 by restricting binary packets to authenticated clients and clearing partial messages on client disconnect.
A vulnerability in python-engineio prior to version 4.13.2 allows an attacker to cause denial of service by triggering unbounded creation of background threads via the heartbeat mechanism. This primarily affects synchronous servers where each heartbeat launches a physical thread. The issue is fixed in version 4.13.2 by restricting heartbeat threads to authenticated clients and ensuring only one heartbeat thread per client.
semantic-router versions 0.1.8 through 0.1.14 declare a dependency on litellm with no upper bound, allowing resolution to a compromised litellm wheel version 1.82.8 during a specific time window. This malicious litellm wheel executes code on Python startup without import, exfiltrating sensitive credentials and secrets. The issue is fixed in semantic-router 0.1.15 by raising the minimum litellm version to 1.83.7. Users are advised to upgrade or explicitly pin litellm to safe versions and audit for malicious files.