Tagged “pip”
CVEs tagged pip, newest first.
5542 CVEsRSS
MAL-2026-623NoneMalicious code in marshl (PyPI)
Malicious code in marshl (PyPI)
CVE-2026-25130Critical· 9.6PoCCAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection
CAI find_file Agent Tool has Command Injection Vulnerability Through Argument Injection
CVE-2026-25211Low· 3.2PoCLlama Stack exposes secret in initialization log
Llama Stack exposes secret in initialization log
CVE-2025-62349Medium· 6.2Salt Authentication Protocol Version Downgrade Allows Minion Impersonation
Salt Authentication Protocol Version Downgrade Allows Minion Impersonation
CVE-2025-62348High· 7.8Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload
Salt junos Module Vulnerable to Code Injection via Specially Crafted YAML Payload
MAL-2026-602Critical⚠ ExploitedMalicious code in tableasets (PyPI)
Malicious code in tableasets (PyPI)
MAL-2026-601Critical⚠ ExploitedMalicious code in tableautes (PyPI)
Malicious code in tableautes (PyPI)
CVE-2026-24780HighAutoGPT is Vulnerable to RCE via Disabled Block Execution
AutoGPT is Vulnerable to RCE via Disabled Block Execution
MAL-2026-562Critical⚠ ExploitedMalicious code in tabullates (PyPI)
Malicious code in tabullates (PyPI)
MAL-2026-548Critical⚠ ExploitedMalicious code in tabletas (PyPI)
Malicious code in tabletas (PyPI)
CVE-2026-23892Medium· 5.9OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
CVE-2026-1213Mediumaskbot inexhaustive permissions check allows any user to modify a different user's profile picture
askbot inexhaustive permissions check allows any user to modify a different user's profile picture
CVE-2026-24688Medium· 5.3PoCpypdf: pypdf Infinite Loop when processing outlines/bookmarks (CVE-2026-24688)
A reachable infinite loop has been discovered in pypdf. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bo…
CVE-2026-24779High· 7.1vLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in the `MediaConnector` class within the vLLM project's multimodal feature set. …
CVE-2026-24747High· 8.8PyTorch is a Python package that provides tensor computation
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.l…
CVE-2026-24486High· 8.6PoCPython-Multipart is a streaming multipart parser for Python
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write …
CVE-2026-24408None· 0.0sigstore CSRF possibility in OIDC authentication during signing
sigstore CSRF possibility in OIDC authentication during signing
CVE-2026-24489Medium· 5.3Gakido vulnerable to HTTP Header Injection (CRLF Injection)
Gakido vulnerable to HTTP Header Injection (CRLF Injection)
CVE-2026-24490High· 8.1MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
CVE-2026-24123High· 7.4BentoML has a Path Traversal via Bentofile Configuration
BentoML has a Path Traversal via Bentofile Configuration
CVE-2025-11687Medium· 6.1GI-DocGen vulnerable to Reflected XSS via unescaped query strings
GI-DocGen vulnerable to Reflected XSS via unescaped query strings
MAL-2026-492Critical⚠ ExploitedMalicious code in tableates (PyPI)
Malicious code in tableates (PyPI)
MAL-2026-490Critical⚠ ExploitedMalicious code in tabletes (PyPI)
Malicious code in tabletes (PyPI)
CVE-2026-0770HighCISA KEV0dayPoCLangflow affected by Remote Code Execution via validate_code() exec()
Langflow affected by Remote Code Execution via validate_code() exec()
CVE-2026-0994High· 7.5PoCA denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth ac…
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth ac…
CVE-2025-67221HighPoCorjson does not limit recursion for deeply nested JSON documents
orjson does not limit recursion for deeply nested JSON documents
MAL-2026-470NoneMalicious code in urlsssser (PyPI)
Malicious code in urlsssser (PyPI)
MAL-2026-468NoneMalicious code in urlsser (PyPI)
Malicious code in urlsser (PyPI)
CVE-2026-24009High· 8.1PoCdocling-core vulnerable to Remote Code Execution via unsafe PyYAML usage
docling-core vulnerable to Remote Code Execution via unsafe PyYAML usage
CVE-2025-71176Medium· 6.8pytest has vulnerable tmpdir handling
pytest has vulnerable tmpdir handling