GCVE-110-OSM-2026-2510

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published April 16, 2026

Suspicious package detected. IOCs: - urls: https://mencius.uio.no/JASPAR/JASPAR_metadata/2026/JASPAR2026.sqlite3, https://jaspar.elixir.no/download/data/2026/CORE/JASPAR2026_CORE_vertebrates_non-redundant_pfms_jaspar.txt, https://ftp.ebi.ac.uk/pub/databases/gencode/Gencode_human/release_39/gencode.v39.primary_assembly.annotation.gtf.gz, https://ftp.ebi.ac.uk/pub/databases/gencode/Gencode_human/release_39/GRCh38.primary_assembly.genome.fa.gz, http://www.ensembl.org/biomart/martservice?query= (+7 more) - domains: tool.poetry.group.dev, mencius.uio.no, jaspar.elixir.no, ftp.ebi.ac.uk, www.ensembl.org (+9 more)

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

5.4/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
unknown	tfitpy	* (affected)	—

References

Malicious pypi package: tfitpy

advisory

vendor

Browse GCVE Records

73,040 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON