Tagged “pip”
CVEs tagged pip, newest first.
5542 CVEsRSS
CVE-2025-64104High· 7.3LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite)
LangGraph SQLite Checkpoint is an implementation of LangGraph CheckpointSaver that uses SQLite DB (both sync and async, via aiosqlite). Prior to 2.0.11, LangGraph's SQLite store implementation contains SQL injection vulnerabilities using…
CVE-2025-11200High· 8.10dayMLflow Weak Password Requirements Authentication Bypass Vulnerability
MLflow Weak Password Requirements Authentication Bypass Vulnerability
CVE-2025-11201High· 8.10dayPoCMLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
CVE-2025-54384Medium· 6.3CKAN vulnerable to stored XSS in resource description
CKAN vulnerable to stored XSS in resource description
CVE-2025-64100Medium· 6.1CKAN vulnerable to fixed session IDs
CKAN vulnerable to fixed session IDs
MAL-2025-191876NoneMalicious code in speedd-testing-bot (PyPI)
Malicious code in speedd-testing-bot (PyPI)
CVE-2025-62801High· 7.8FastMCP is the standard framework for building MCP applications
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0, a command-injection vulnerability lets any attacker who can influence the server_name field of an MCP execute arbitrary OS commands on Windows hos…
CVE-2025-62800Medium· 6.1FastMCP is the standard framework for building MCP applications
FastMCP is the standard framework for building MCP applications. Versions prior to 2.13.0 have a reflected cross-site scripting vulnerability in the OAuth client callback page (oauth_callback.py) where unescaped user-controlled values ar…
CVE-2025-62727High· 7.5PoCStarlette is a lightweight ASGI framework/toolkit
Starlette is a lightweight ASGI framework/toolkit. Starting in version 0.39.0 and prior to version 0.49.1 , an unauthenticated attacker can send a crafted HTTP Range header that triggers quadratic-time processing in Starlette's FileRespo…
CVE-2025-61385Highpg8000 SQL injection vulnerability via a specially crafted Python list input
pg8000 SQL injection vulnerability via a specially crafted Python list input
CVE-2025-8709High· 7.3langchain: SQL Injection in langchain-ai/langchain (CVE-2025-8709)
A SQL injection vulnerability exists in LangGraph’s SQLite store implementation due to improper string concatenation when building filter conditions in the _get_filter_condition() function. The JSON key portion of the json_extract() path i…
CVE-2025-62707High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to an infinite loop. This requires parsing the content stream of a page which has an inl…
CVE-2025-62611Highaiomysql is a library for accessing a MySQL database from the asyncio
aiomysql is a library for accessing a MySQL database from the asyncio. Prior to version 0.3.0, the client-side settings are not checked before sending local files to MySQL server, which allows obtaining arbitrary files from the client us…
CVE-2025-62708High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to version 6.1.3, an attacker who uses this vulnerability can craft a PDF which leads to large memory usage. This requires parsing the content stream of a page using the LZWD…
CVE-2025-11844Medium· 5.4PoCHugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py
Hugging Face Smolagents version 1.20.0 contains an XPath injection vulnerability in the search_item_ctrl_f function located in src/smolagents/vision_web_browser.py. The function constructs an XPath query by directly concatenating user-su…
CVE-2025-62607Medium· 5.3Nautobot Single Source of Truth (SSoT) is an app for Nautobot
Nautobot Single Source of Truth (SSoT) is an app for Nautobot. Prior to version 3.10.0, an unauthenticated attacker could access this page to view the Service Now public instance name e.g. companyname.service-now.com. This is considered …
CVE-2025-49655Critical· 9.8Keras framework vulnerable to deserialization of untrusted data
Keras framework vulnerable to deserialization of untrusted data
CVE-2025-62379Low· 3.1reflex-dev/reflex has an Open Redirect vulnerability
reflex-dev/reflex has an Open Redirect vulnerability
CVE-2025-62172HighHome Assistant is open source home automation software that puts local control and privacy first
Home Assistant is open source home automation software that puts local control and privacy first. In versions 2025.1.0 through 2025.10.1, the energy dashboard is vulnerable to stored cross-site scripting. An authenticated user can inject…
CVE-2025-7707High· 7.8The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments
The llama_index library version 0.12.33 sets the NLTK data directory to a subdirectory of the codebase by default, which is world-writable in multi-user environments. This configuration allows local users to overwrite, delete, or corrupt…
CVE-2025-61911Mediumpython-ldap has sanitization bypass in ldap.filter.escape_filter_chars
python-ldap has sanitization bypass in ldap.filter.escape_filter_chars
CVE-2025-61920High· 7.5Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
Authlib is vulnerable to Denial of Service via Oversized JOSE Segments
CVE-2025-61912Mediumpython-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
CVE-2025-62706Medium· 6.5Authlib : JWE zip=DEF decompression bomb enables DoS
Authlib : JWE zip=DEF decompression bomb enables DoS
CVE-2025-10284Critical· 9.6BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
BBOT's unarchive module could be abused by supplying malicious archives files and when extracted can then perform an arbitrary file write, resulting in remote code execution.
CVE-2025-10283Critical· 9.6BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
BBOT's gitdumper module could be abused to execute commands through a malicious git repository.
CVE-2025-61783MediumPython Social Auth is a social authentication/registration mechanism
Python Social Auth is a social authentication/registration mechanism. In versions prior to 5.6.0, upon authentication, the user could be associated by e-mail even if the `associate_by_email` pipeline was not included. This could lead to …
CVE-2025-10282Medium· 4.7BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
BBOT's gitlab module could be abused to disclose a GitLab API key to an attacker controlled server with a malicious formatted git URL.
CVE-2025-61773High· 8.1pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters
CVE-2025-10281Medium· 4.7BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.
BBOT's git_clone module could be abused to disclose a GitHub API key to an attacker controlled server with a malicious formatted git URL.