Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
CVE-2026-33533HighGlances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
Glances Vulnerable to Cross-Origin System Information Disclosure via XML-RPC Server CORS Wildcard
CVE-2026-0560High· 7.5PoCA Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/exp…
A Server-Side Request Forgery (SSRF) vulnerability exists in parisneo/lollms versions prior to 2.2.0, specifically in the `/api/files/export-content` endpoint. The `_download_image_to_temp()` function in `backend/routers/files.py` fails …
CVE-2026-0558Critical· 9.8PoCA vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through t…
A vulnerability in parisneo/lollms, up to and including version 2.2.0, allows unauthenticated users to upload and process files through the `/api/files/extract-text` endpoint. This endpoint does not enforce authentication, unlike other f…
CVE-2026-29071Low· 3.1Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
Open WebUI's Insecure Direct Object Reference (IDOR) allows access to other users' memories
CVE-2026-28786Medium· 4.3Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
Open WebUI vulnerable to Path Traversal in `POST /api/v1/audio/transcriptions`
CVE-2026-33980High· 8.3PoCAzure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
Azure Data Explorer MCP Server: KQL Injection in multiple tools allows MCP client to execute arbitrary Kusto queries
CVE-2026-33044LowHome Assistant has stored XSS in Map-card through malicious device name
Home Assistant has stored XSS in Map-card through malicious device name
CVE-2026-28788High· 7.1Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
Open WebUI's process_files_batch() endpoint missing ownership check, allows unauthorized file overwrite
CVE-2025-15381High· 7.1In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators
In the latest version of mlflow/mlflow, when the `basic-auth` app is enabled, tracing and assessment endpoints are not protected by permission validators. This allows any authenticated user, including those with `NO_PERMISSIONS` on the e…
CVE-2026-34172HighGiskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
Giskard Agents have Server-side template injection via ChatWorkflow.chat() using non-sandboxed Jinja2 Environment
CVE-2026-33936Medium· 5.3PoCpython-ecdsa: Denial of Service via improper DER length validation in crafted private keys
python-ecdsa: Denial of Service via improper DER length validation in crafted private keys
CVE-2026-34046High· 8.8Langflow is a tool for building and deploying AI-powered agents and workflows
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.5.1, the `_read_flow` helper in `src/backend/base/langflow/api/v1/flows.py` branched on the `AUTO_LOGIN` setting to decide whether to filte…
CVE-2026-33981HighChangedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
Changedetection.io Discloses Environment Variables via jq env Builtin in Include Filters
CVE-2026-4963Medium· 6.3Hugging Face Smolagents has an Injection issue
Hugging Face Smolagents has an Injection issue
CVE-2026-29070Medium· 5.4Open WebUI has unauthorized deletion of knowledge files
Open WebUI has unauthorized deletion of knowledge files
CVE-2026-33045LowHome Assistant has stored XSS in history-graphs
Home Assistant has stored XSS in history-graphs
CVE-2026-27893High· 8.8vLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.18.0, two model implementation files hardcode `trust_remote_code=True` when loading sub-components, bypassing the…
GHSA-wcjx-v2wj-xg87High· 7.5C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)
C2C CI utils is vulnerable to DoS via pyasn dependency (CVE-2026-30922)
CVE-2026-33699Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF in non-strict mode (CVE-2026-33699)
A flaw was found in pypdf. An attacker can craft a malicious PDF file that, when processed by pypdf in non-strict mode, triggers an infinite loop. This vulnerability can lead to a Denial of Service (DoS) by consuming excessive system resou…
CVE-2026-27602High· 7.2Modoboa has OS Command Injection
Modoboa has OS Command Injection
CVE-2025-70887HighSignify allows a remote attacker to escalate privileges via the signed_data.py and the context.py components
Signify allows a remote attacker to escalate privileges via the signed_data.py and the context.py components
CVE-2026-25645Medium· 4.7PoCrequests: Requests: Security bypass due to predictable temporary file creation (CVE-2026-25645)
A flaw was found in the `requests` HTTP library, specifically in the `requests.utils.extract_zipped_paths()` function, which is used to load Certificate Authority (CA) bundles. A local attacker can exploit this vulnerability by pre-creatin…
CVE-2026-33682Medium· 4.7Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)
Unauthenticated SSRF Vulnerability in Streamlit on Windows (NTLM Credential Exposure)
MAL-2026-2144Critical⚠ ExploitedMalicious code in litellm (PyPI)
Malicious code in litellm (PyPI)
CVE-2026-24159High· 7.8NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution
NVIDIA NeMo Framework contains a vulnerability leading to Remote Code Execution
CVE-2026-24157High· 7.8NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading
NVIDIA NeMo Framework contains an RCE vulnerability in checkpoint loading
CVE-2026-33545Medium· 5.3MobSF has SQL Injection in its SQLite Database Viewer Utils
MobSF has SQL Injection in its SQLite Database Viewer Utils
CVE-2026-33046HighIndico discloses local files resulting in Remote Code Execution through LaTeX injection
Indico discloses local files resulting in Remote Code Execution through LaTeX injection
CVE-2026-26209Medium· 5.5⚖ disputedcbor2: cbor2: Denial of Service due to uncontrolled recursion via crafted CBOR payloads (CVE-2026-26209)
A flaw was found in cbor2, a library for encoding and decoding Concise Binary Object Representation (CBOR) data. A remote attacker can exploit this vulnerability by sending a specially crafted CBOR payload containing deeply nested structur…
CVE-2026-4539Low· 3.3Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching
Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching