Tagged “pip”
CVEs tagged pip, newest first.
5542 CVEsRSS
MAL-2026-237NoneMalicious code in formater (PyPI)
Malicious code in formater (PyPI)
MAL-2026-236NoneMalicious code in graponater (PyPI)
Malicious code in graponater (PyPI)
CVE-2025-14279High· 8.1MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation
CVE-2026-22251Medium· 5.3Weblate wlc has insecure API key configuration
Weblate wlc has insecure API key configuration
CVE-2026-22033HighLabel Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field
CVE-2026-22250Low· 2.5Weblate command-line client susceptible to SSL verification skip
Weblate command-line client susceptible to SSL verification skip
CVE-2025-15506Low· 3.3AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability
AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability
CVE-2026-22701Medium· 5.3filelock: filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock (CVE-2026-22701)
A Time-of-Check-Time-of-Use (TOCTOU) flaw has been discovered in the pypi filelock package. The TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access…
CVE-2025-15504Low· 3.3LIEF is vulnerable to segmentation fault
LIEF is vulnerable to segmentation fault
CVE-2026-22702Medium· 4.5virtualenv: virtualenv: Local attacker can redirect file operations via TOCTOU race condition (CVE-2026-22702)
A flaw was found in virtualenv, a tool for creating isolated virtual Python environments. A local attacker can exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition during directory creation operations. By performing symlink-based at…
CVE-2026-22690Medium· 6.5pypdf: pypdf: Denial of Service via crafted PDF with missing /Root object (CVE-2026-22690)
A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF file that omits the /Root entry in the trailer and uses a large /Size value. This can lead to excessively long processing times when th…
CVE-2026-22691Medium· 6.5pypdf: pypdf: Denial of Service via malformed PDF startxref entries (CVE-2026-22691)
A flaw was found in pypdf. A remote attacker can exploit this vulnerability by crafting a malicious PDF file with malformed startxref entries and excessive whitespace characters. This can cause excessively long processing times when rebuil…
CVE-2026-22606HighFickling has a bypass via runpy.run_path() and runpy.run_module()
Fickling has a bypass via runpy.run_path() and runpy.run_module()
CVE-2026-22609HighFickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist
CVE-2026-22607HighFickling Blocklist Bypass: cProfile.run()
Fickling Blocklist Bypass: cProfile.run()
CVE-2026-22612HighFickling vulnerable to detection bypass due to "builtins" blindness
Fickling vulnerable to detection bypass due to "builtins" blindness
CVE-2026-22608HighFickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection
CVE-2023-7333Medium· 5.3records-mover Injection vulnerability
records-mover Injection vulnerability
CVE-2026-21874Medium· 5.3NiceGUI has Redis connection leak via tab storage causes service degradation
NiceGUI has Redis connection leak via tab storage causes service degradation
CVE-2026-21873High· 7.2NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS
CVE-2026-21872Medium· 6.1NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links
CVE-2025-68158Medium· 5.7Authlib is a Python library which builds OAuth and OpenID Connect servers
Authlib is a Python library which builds OAuth and OpenID Connect servers. In versions 1.0.0 through 1.6.5, cache-backed state/request-token storage is not tied to the initiating user session, so CSRF is possible for any attacker that ha…
CVE-2026-21892Medium· 5.3Parsl is a Python parallel scripting library
Parsl is a Python parallel scripting library. A SQL Injection vulnerability exists in the parsl-visualize component of versions prior to 2026.01.05. The application constructs SQL queries using unsafe string formatting (Python % operator…
CVE-2026-21860Medium· 5.3Werkzeug safe_join() allows Windows special device names with compound extensions
Werkzeug safe_join() allows Windows special device names with compound extensions
CVE-2026-21871Medium· 6.1NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()
CVE-2025-61782Medium· 5.4OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authentication endpoint (/auth/saml/callbac…
CVE-2026-22041Lowloggingredactor converts non-string types to string types in logs
loggingredactor converts non-string types to string types in logs
CVE-2026-21441High· 7.5urllib3 is an HTTP client library for Python
urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urll…
MAL-2026-96NoneMalicious code in pycolorom (PyPI)
Malicious code in pycolorom (PyPI)
CVE-2025-69225Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below contain parser logic which allows non-ASCII decimals to be present in the Range header. There is no known impact, but there is the …