Tagged “pip”
CVEs tagged pip, newest first.
5542 CVEsRSS
CVE-2026-25516Medium· 6.1NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content
CVE-2026-25198Medium· 4.7web2py has an Open Redirect Vulnerability
web2py has an Open Redirect Vulnerability
CVE-2026-1707High· 7.4pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability
MAL-2026-738Critical⚠ ExploitedMalicious code in tablescene (PyPI)
Malicious code in tablescene (PyPI)
MAL-2026-732Critical⚠ ExploitedMalicious code in gridifys (PyPI)
Malicious code in gridifys (PyPI)
CVE-2026-25632Critical· 10.0PoCEPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)
MAL-2026-700Critical⚠ ExploitedMalicious code in tabulapys (PyPI)
Malicious code in tabulapys (PyPI)
MAL-2026-698Critical⚠ ExploitedMalicious code in tableshow (PyPI)
Malicious code in tableshow (PyPI)
MAL-2026-686Critical⚠ ExploitedMalicious code in tableapys (PyPI)
Malicious code in tableapys (PyPI)
CVE-2025-64712Critical· 9.8Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write
CVE-2026-1285LowDjango has Inefficient Algorithmic Complexity
Django has Inefficient Algorithmic Complexity
CVE-2025-14550LowDjango has Inefficient Algorithmic Complexity
Django has Inefficient Algorithmic Complexity
CVE-2025-13473LowDjango has Observable Timing Discrepancy
Django has Observable Timing Discrepancy
CVE-2025-70560High· 8.4Boltz contains an insecure deserialization vulnerability in its molecule loading functionality
Boltz contains an insecure deserialization vulnerability in its molecule loading functionality
CVE-2026-25517MediumWagtail has improper permission handling on admin preview endpoints
Wagtail has improper permission handling on admin preview endpoints
CVE-2026-1312Medium· 5.4PoC⚖ disputedAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, w…
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, w…
CVE-2026-1287Medium· 5.4⚖ disputedAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansio…
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansio…
CVE-2026-1207Medium· 5.4PoC⚖ disputedAn issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupport…
An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupport…
MAL-2026-650Critical⚠ ExploitedMalicious code in tableapy (PyPI)
Malicious code in tableapy (PyPI)
CVE-2025-70960Medium· 5.4A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web …
A stored cross-site scripting (XSS) vulnerability in the Forums module of Tendenci CMS v15.3.7 allows attackers to execute arbitrary web scripts or HTML via injecting a crafted payload.
CVE-2026-25481CriticalLangroid has WAF Bypass Leading to RCE in TableChatAgent
Langroid has WAF Bypass Leading to RCE in TableChatAgent
CVE-2026-1777High· 7.2SageMaker Python SDK has Exposed HMAC
SageMaker Python SDK has Exposed HMAC
CVE-2026-0599High· 7.5Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption
Hugging Face Text Generation Inference vulnerable to Uncontrolled Resource Consumption
CVE-2026-1117High· 8.2Lollms has an Improper Access Control vulnerability
Lollms has an Improper Access Control vulnerability
CVE-2025-69207Medium· 5.4Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning
Khoj has an IDOR in Notion OAuth Flow that Enables Index Poisoning
CVE-2026-1703Lowpip Path Traversal vulnerability
pip Path Traversal vulnerability
CVE-2026-1778Medium· 5.9SageMaker Python SDK has Insecure TLS Configuration
SageMaker Python SDK has Insecure TLS Configuration
CVE-2025-10279High· 7.0mlflow Creates of Temporary File in Directory with Insecure Permissions
mlflow Creates of Temporary File in Directory with Insecure Permissions
CVE-2025-6208Medium· 5.3llama-index-core vulnerable to Uncontrolled Resource Consumption
llama-index-core vulnerable to Uncontrolled Resource Consumption
CVE-2026-22778Critical· 9.8PoCvLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). From 0.8.3 to before 0.14.1, when an invalid image is sent to vLLM's multimodal endpoint, PIL throws an error. vLLM returns this error to the client, leaking a hea…