Tagged “pip”
CVEs tagged pip, newest first.
5542 CVEsRSS
CVE-2026-24130LowMoonraker affected by LDAP search filter injection
Moonraker affected by LDAP search filter injection
CVE-2026-1260High· 7.8Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.
Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.
CVE-2026-24049High· 7.1PoCwheel is a command line tool for manipulating Python wheel files, as defined in PEP 427
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after e…
MAL-2026-441Critical⚠ ExploitedMalicious code in spellcheckpy (PyPI)
Malicious code in spellcheckpy (PyPI)
CVE-2026-23968Medium· 5.5Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
CVE-2026-23877MediumSwing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user
Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user
CVE-2026-23996Low· 3.7FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection
FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection
CVE-2026-23833MediumESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
CVE-2026-23986High· 7.1Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
CVE-2026-23946Medium· 6.8Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
Tendenci Affected by Authenticated Remote Code Execution via Pickle Deserialization
CVE-2026-22807High· 8.8PoCvLLM is an inference and serving engine for large language models (LLMs)
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_…
MAL-2026-375Critical⚠ ExploitedMalicious code in spellcheckerpy (PyPI)
Malicious code in spellcheckerpy (PyPI)
CVE-2026-23842High· 7.5PoCChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion
ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion
CVE-2026-22219High· 7.7Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled…
MAL-2026-326NoneMalicious code in urlssser (PyPI)
Malicious code in urlssser (PyPI)
MAL-2026-325NoneMalicious code in marshel (PyPI)
Malicious code in marshel (PyPI)
CVE-2025-68675High· 7.5In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information
In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefo…
CVE-2025-68438High· 7.5In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI
In Apache Airflow versions before 3.1.6, when rendered template fields in a Dag exceed [core] max_templated_field_length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This occurred because serialization of…
CVE-2026-23528MediumDask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard
Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard
CVE-2026-23535High· 8.0Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command
Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command
CVE-2026-23490High· 7.5PoCpyasn1 is a generic ASN.1 library for Python
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.
CVE-2025-68492Medium· 4.2Chainlit contains an authorization bypass vulnerability
Chainlit contains an authorization bypass vulnerability
CVE-2026-22779MediumBlackSheep's ClientSession is vulnerable to CRLF injection
BlackSheep's ClientSession is vulnerable to CRLF injection
CVE-2026-21889LowWeblate leaks information via screenshots
Weblate leaks information via screenshots
CVE-2026-22871HighGuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE
CVE-2026-21226High· 7.5Azure Core is vulnerable to deserialization of untrusted data
Azure Core is vulnerable to deserialization of untrusted data
CVE-2026-22798Medium· 5.9hermes's raw options logging may disclose secrets passed in via subcommand options argument
hermes's raw options logging may disclose secrets passed in via subcommand options argument
CVE-2026-22870HighGuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS
CVE-2026-23949High· 8.6jaraco.context Has a Path Traversal Vulnerability
jaraco.context Has a Path Traversal Vulnerability
CVE-2026-22777High· 7.5PoCComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler
ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler