Tagged “pip”

CVEs tagged pip, newest first.

5542 CVEsRSS

CVE-2026-4539Low· 3.3

7mo ago

Pygments has Regular Expression Denial of Service (ReDoS) due to Inefficient Regex for GUID Matching

▾ Sunlitpygments · pygmentsEPSS 0.16%via OSV

CVE-2026-4506Medium· 6.3

7mo ago

MindSQL is vulnerable to Code Injection through its ask_db function

▾ Sunlitmindsql · mindsqlEPSS 0.24%via OSV

CVE-2026-32711High· 7.8

7mo ago

pydicom has a path traversal in FileSet/DICOMDIR ReferencedFileID allows file access outside the File-set root

▾ Twilightpydicom · pydicomEPSS 0.30%via OSV

CVE-2026-33123Medium· 4.3

7mo ago

pypdf: pypdf: Denial of Service due to excessive resource consumption from crafted PDF (CVE-2026-33123)

A flaw was found in pypdf, a pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive resource consumption, causing long runtimes and high memory usage. This can result in a Denial of Ser…

▾ SunlitRed Hat · OpenShift LightspeedEPSS 0.36%via CSAF

CVE-2026-33154High· 7.5PoC

7mo ago

dynaconf: jinja2: Dynaconf: Arbitrary code execution via Server-Side Template Injection (CVE-2026-33154)

A flaw was found in dynaconf, a Python configuration management tool. This Server-Side Template Injection (SSTI) vulnerability occurs due to unsafe template evaluation in the @Jinja resolver when the jinja2 package is installed. A remote a…

▾ MidnightRed Hat · Red Hat Ansible Automation Platform 2EPSS 0.55%via CSAF

CVE-2026-33230Medium· 6.1

7mo ago

nltk: NLTK: Script execution via reflected cross-site scripting in WordNet Browser (CVE-2026-33230)

A flaw was found in NLTK (Natural Language Toolkit), a suite of open source Python modules for Natural Language Processing. The `nltk.app.wordnet_app` component contains a reflected cross-site scripting (XSS) vulnerability. A remote attack…

▾ SunlitRed Hat · Red Hat Ansible Automation Platform 2EPSS 0.34%via CSAF

CVE-2026-32889Medium· 6.5

7mo ago

tinytag: tinytag: Denial of Service via malicious MP3 file parsing (CVE-2026-32889)

A flaw was found in tinytag, a Python library for reading audio file metadata. An attacker who can supply specially crafted MP3 files for parsing can trigger a non-terminating loop within the library. This can cause the parsing operation t…

▾ SunlitRed Hat · OpenShift LightspeedEPSS 0.43%via CSAF

CVE-2026-33236High· 8.1

7mo ago

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing. In versions 3.9.3 and prior, the NLTK downloader does not validate the…

▾ Twilightnltk · nltkEPSS 0.61%via NVD

CVE-2026-33231High· 7.5PoC

7mo ago

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing

▾ Midnightnltk · nltkEPSS 1.3%via NVD

CVE-2026-33509High· 7.5

7mo ago

pyLoad SETTINGS Permission Users Can Achieve Remote Code Execution via Unrestricted Reconnect Script Configuration

▾ Twilightpyload-ng · pyload-ngEPSS 0.55%via OSV

CVE-2026-33332Medium· 5.3

7mo ago

NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

▾ Sunlitnicegui · niceguiEPSS 0.62%via OSV

CVE-2025-15031High· 8.1

7mo ago

Arbitrary file write via tar traversal in mlflow

▾ Twilightmlflow · mlflowEPSS 0.85%via OSV

CVE-2026-27953High· 7.1

7mo ago

ormar Pydantic Validation Bypass via __pk_only and excluded__ Kwargs Injection in Model Constructor

ormar Pydantic Validation Bypass via __pk_only__ and __excluded__ Kwargs Injection in Model Constructor

▾ Twilightormar · ormarEPSS 1.2%via OSV

CVE-2026-3029Medium

7mo ago

PyMuPDF has a path traversal in _main_.py

▾ Sunlitpymupdf · pymupdfEPSS 0.38%via OSV

CVE-2026-33310High· 8.8PoC

7mo ago

Intake has a Command Injection via shell() Expansion in Parameter Defaults

▾ Midnightintake · intakeEPSS 0.44%via OSV

CVE-2026-8630Medium

7mo ago

JustHTML Affected by Mutation XSS via Literal Text Serialization in Raw Text Elements (style/script)

▾ Sunlitjusthtml · justhtmlEPSS 0.26%via OSV

CVE-2026-32874High· 7.5

7mo ago

UltraJSON has a Memory Leak parsing large integers allows DoS

▾ Twilightujson · ujsonEPSS 0.51%via OSV

CVE-2026-33125High· 7.1

7mo ago

Frigte has broken access control viewer user can delete admin and other users account

▾ Twilightfrigate · frigateEPSS 0.25%via OSV

CVE-2026-33139High

7mo ago

PySpector has a Plugin Sandbox Bypass leads to Arbitrary Code Execution

▾ Twilightpyspector · pyspectorEPSS 0.18%via OSV

CVE-2026-30922High· 7.5PoC

7mo ago

pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x3…

▾ MidnightRed Hat · Red Hat Enterprise Linux AppStream (v. 10)EPSS 0.83%via CSAF

CVE-2026-32875High· 7.5

7mo ago

UltraJSON has an integer overflow handling large indent leads to buffer overflow or infinite loop

▾ Twilightujson · ujsonEPSS 0.49%via OSV

CVE-2026-33155High

7mo ago

DeepDiff has Memory Exhaustion DoS through SAFE_TO_IMPORT

▾ Twilightdeepdiff · deepdiffEPSS 0.47%via OSV

CVE-2026-33140Medium

7mo ago

Stored XSS in PySpector HTML Report Generation leads to Javascript Code Execution

▾ Sunlitpyspector · pyspectorEPSS 0.23%via OSV

CVE-2026-27459Critical· 9.8⚖ disputed

7mo ago

pyOpenSSL is a Python wrapper around the OpenSSL library

pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL wou…

▾ Midnightpyopenssl · pyopensslEPSS 0.75%via NVD

CVE-2026-4269High· 7.5

7mo ago