Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
CVE-2025-69229Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, handling of chunked messages can result in excessive blocking CPU usage when receiving a large number of chunks. If an applicat…
CVE-2025-69230Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. In versions 3.13.2 and below, reading multiple invalid cookies can lead to a logging storm. If the cookies attribute is accessed in an application, then an a…
CVE-2026-21851Medium· 5.3MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download
MONAI has Path Traversal (Zip Slip) in NGC Private Bundle Download
CVE-2026-21883MediumBokeh server applications have Incomplete Origin Validation in WebSockets
Bokeh server applications have Incomplete Origin Validation in WebSockets
CVE-2025-69228High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a request to be crafted in such a way that an AIOHTTP server's memory fills up uncontrollably during processing. If an applic…
MAL-2026-42NoneMalicious code in pyrogrom (PyPI)
Malicious code in pyrogrom (PyPI)
CVE-2026-21439Lowbadkeys vulnerable to ASCII control character injection on console via malformed input
badkeys vulnerable to ASCII control character injection on console via malformed input
CVE-2025-69224Medium· 6.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below of the Python HTTP parser may allow a request smuggling attack with the presence of non-ASCII characters. If a pure Python version …
CVE-2025-69226Medium· 5.3AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below enable an attacker to ascertain the existence of absolute path components through the path normalization logic for static files mea…
CVE-2025-69223High· 7.5AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that …
CVE-2026-21445HighPoCLangflow Missing Authentication on Critical API Endpoints
Langflow Missing Authentication on Critical API Endpoints
CVE-2025-68131MediumCBORDecoder reuse can leak shareable values across decode calls
CBORDecoder reuse can leak shareable values across decode calls
MAL-2025-193011NoneMalicious code in requeses (PyPI)
Malicious code in requeses (PyPI)
MAL-2025-193010NoneMalicious code in pyrogrqm (PyPI)
Malicious code in pyrogrqm (PyPI)
MAL-2025-193008NoneMalicious code in telegreph (PyPI)
Malicious code in telegreph (PyPI)
MAL-2025-193007NoneMalicious code in aiogrem (PyPI)
Malicious code in aiogrem (PyPI)
MAL-2025-192991NoneMalicious code in pyrogrem (PyPI)
Malicious code in pyrogrem (PyPI)
CVE-2025-34469High· 7.5PoCCowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl
Cowrie versions prior to 2.9.0 contain a server-side request forgery (SSRF) vulnerability in the emulated shell implementation of wget and curl. In the default emulated shell configuration, these command emulations perform real outbound …
MAL-2025-192943NoneMalicious code in telegrem (PyPI)
Malicious code in telegrem (PyPI)
MAL-2025-192942NoneMalicious code in telebot-bot (PyPI)
Malicious code in telebot-bot (PyPI)
CVE-2025-67729High· 8.8LMDeploy is a toolkit for compressing, deploying, and serving LLMs
LMDeploy is a toolkit for compressing, deploying, and serving LLMs. Prior to version 0.11.1, an insecure deserialization vulnerability exists in lmdeploy where torch.load() is called without the weights_only=True parameter when loading m…
CVE-2025-68664Critical· 9.3PoCLangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
LangChain serialization injection vulnerability enables secret extraction in dumps/loads APIs
CVE-2025-65713MediumHome Assistant Core before is vulnerable to Directory Traversal
Home Assistant Core before is vulnerable to Directory Traversal
CVE-2025-67743Medium· 6.3Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
Local Deep Research is Vulnerable to Server-Side Request Forgery (SSRF) in Download Service
CVE-2025-68480Medium· 5.3Marshmallow has DoS in Schema.load(many)
Marshmallow has DoS in Schema.load(many)
CVE-2025-14881LowMultiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
Multiple API endpoints allowed access to sensitive files from other users by knowing the UUID of the file that were not intended to be accessible by UUID only.
CVE-2025-14882Lowpretix has Broken Access Control Allowing Cross-User File Access via UUID
pretix has Broken Access Control Allowing Cross-User File Access via UUID
CVE-2025-14546Medium· 6.3Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback
Versions of the package fastapi-sso before 0.19.0 are vulnerable to Cross-site Request Forgery (CSRF) due to the improper validation of the OAuth state parameter during the authentication callback. While the get_login_url method allows f…
CVE-2025-68481Medium· 5.9FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project
FastAPI Users allows users to quickly add a registration and authentication system to their FastAPI project. Prior to version 15.0.2, the OAuth login state tokens are completely stateless and carry no per-request entropy or any data that…
CVE-2025-68477High· 7.7Langflow is a tool for building and deploying AI-powered agents and workflows
Langflow is a tool for building and deploying AI-powered agents and workflows. Prior to version 1.7.0, Langflow provides an API Request component that can issue arbitrary HTTP requests within a flow. This component takes a user-supplied …