Tagged “pip”
CVEs tagged pip, newest first.
5542 CVEsRSS
CVE-2026-27448LowpyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
pyOpenSSL allows TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
CVE-2026-32608High· 7.0Glances has a Command Injection via Process Names in Action Command Templates
Glances has a Command Injection via Process Names in Action Command Templates
CVE-2026-32722Low· 3.6PoCStored XSS in Memray-generated HTML reports via unescaped command-line metadata
Stored XSS in Memray-generated HTML reports via unescaped command-line metadata
CVE-2026-32632Medium· 5.9Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
Glances's REST/WebUI Lacks Host Validation and Remains Exposed to DNS Rebinding
CVE-2026-32609High· 7.5Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
CVE-2026-32610High· 8.1Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
Glances's Default CORS Configuration Allows Cross-Origin Credential Theft
CVE-2026-28490HighAuthlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
Authlib Vulnerable to JWE RSA1_5 Bleichenbacher Padding Oracle
CVE-2026-4229High· 7.3Vanna has a SQL injection in the remove_training_data function
Vanna has a SQL injection in the remove_training_data function
CVE-2026-32611High· 7.0Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
Glances has a SQL Injection in DuckDB Export via Unparameterized DDL Statements
CVE-2026-27962Critical· 9.1PoCAuthlib is a Python library which builds OAuth and OpenID Connect servers
Authlib is a Python library which builds OAuth and OpenID Connect servers. Prior to version 1.6.9, a JWK Header Injection vulnerability in authlib's JWS implementation allows an unauthenticated attacker to forge arbitrary JWT tokens that…
CVE-2026-31899High· 7.5PoCCairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
CairoSVG vulnerable to Exponential DoS via recursive <use> element amplification
CVE-2026-32116HighMagic Wormhole: "wormhole receive" allows arbitrary local file overwrite
Magic Wormhole: "wormhole receive" allows arbitrary local file overwrite
CVE-2026-32597High· 7.5PoCPyJWT is a JSON Web Token implementation in Python
PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not …
MAL-2026-1371Critical⚠ ExploitedMalicious code in collecters (PyPI)
Malicious code in collecters (PyPI)
CVE-2026-32112Medium· 6.8ha-mcp has XSS via Unescaped HTML in OAuth Consent Form
ha-mcp has XSS via Unescaped HTML in OAuth Consent Form
CVE-2026-3989High· 7.8SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization
SGLangs `replay_request_dump.py` contains an insecure pickle.load() without validation and proper deserialization
CVE-2026-32247High· 8.1PoCGraphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
CVE-2026-32111Medium· 5.3ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
CVE-2026-32274High· 7.5black: Black: Arbitrary file writes from unsanitized user input in cache file name (CVE-2026-32274)
A user input sanitization flaw has been discovered in the Black python code formatter. Black writes a cache file, the name of which is computed from various formatting options. The value of the --python-cell-magics option was placed in the…
CVE-2026-28356High· 7.5multipart is a fast multipart/form-data parser for python
multipart is a fast multipart/form-data parser for python. Prior to 1.2.2, 1.3.1 and 1.4.0-dev, the parse_options_header() function in multipart.py uses a regular expression with an ambiguous alternation, which can cause exponential back…
MAL-2026-1342Critical⚠ ExploitedMalicious code in collectables (PyPI)
Malicious code in collectables (PyPI)
MAL-2026-1341Critical⚠ ExploitedMalicious code in collects (PyPI)
Malicious code in collects (PyPI)
CVE-2026-31900Critical· 9.8PoCBlack is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, us…
Black is the uncompromising Python code formatter. Black provides a GitHub action for formatting code. This action supports an option, use_pyproject: true, for reading the version of Black to use from the repository pyproject.toml. A mal…
CVE-2026-31815Medium· 5.3django-unicorn affected by component state manipulation via unvalidated attribute access
django-unicorn affected by component state manipulation via unvalidated attribute access
CVE-2026-30974Medium· 4.6copyparty: volflag `nohtml` did not block javascript in svg files
copyparty: volflag `nohtml` did not block javascript in svg files
CVE-2026-31826Medium· 6.5pypdf: pypdf: Denial of Service due to excessive memory consumption via crafted PDF (CVE-2026-31826)
A flaw was found in pypdf, a pure-Python PDF library. An attacker can craft a malicious PDF file containing a content stream with an intentionally large /Length value. When this PDF is parsed, it can lead to excessive memory consumption, r…
CVE-2026-27826High· 8.2PoCMCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
MCP Atlassian has SSRF via unvalidated X-Atlassian-Jira-Url / X-Atlassian-Confluence-Url headers
CVE-2026-30930HighGlances has SQL Injection via Process Names in TimescaleDB Export
Glances has SQL Injection via Process Names in TimescaleDB Export
CVE-2026-25960Medium· 5.4vLLM has SSRF Protection Bypass
vLLM has SSRF Protection Bypass
CVE-2026-30928HighPoCGlances Exposes Unauthenticated Configuration Secrets
Glances Exposes Unauthenticated Configuration Secrets