Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
CVE-2025-6051Medium· 5.3A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class
A Regular Expression Denial of Service (ReDoS) vulnerability was discovered in the Hugging Face Transformers library, specifically within the `normalize_numbers()` method of the `EnglishNormalizer` class. This vulnerability affects versi…
CVE-2025-6638Medium· 5.3Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer
CVE-2025-10193HighNeo4j Cypher MCP server is vulnerable to DNS rebinding
Neo4j Cypher MCP server is vulnerable to DNS rebinding
CVE-2025-58065Medium· 6.5Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods
CVE-2025-59036Medium· 5.5Infrahub: Deleted and expired API tokens can still authenticate
Infrahub: Deleted and expired API tokens can still authenticate
CVE-2025-59042HighPyInstaller has local privilege escalation vulnerability
PyInstaller has local privilege escalation vulnerability
CVE-2025-11059Highxml2rfc is vulnerable to arbitrary file reads through prepped files
xml2rfc is vulnerable to arbitrary file reads through prepped files
CVE-2025-59035Medium· 4.6Indico vulnerable to Cross-Site Scripting via LaTeX math code
Indico vulnerable to Cross-Site Scripting via LaTeX math code
CVE-2025-59034Medium· 4.3Indico may disclose unauthorized user details access via legacy API
Indico may disclose unauthorized user details access via legacy API
CVE-2025-58753Mediumcopyparty: Sharing a single file does not fully restrict access to other files in source folder
copyparty: Sharing a single file does not fully restrict access to other files in source folder
CVE-2025-10164High· 7.3SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor
SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor
CVE-2025-58180High· 8.8PoCOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload
CVE-2025-57833High· 7.1PoCDjango is subject to SQL injection through its column aliases
Django is subject to SQL injection through its column aliases
CVE-2025-57766Medium· 4.8Fides' Admin UI User Password Change Does Not Invalidate Current Session
Fides' Admin UI User Password Change Does Not Invalidate Current Session
CVE-2025-57817High· 7.2Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
CVE-2025-57816High· 7.5Fides Webserver API Rate Limiting Vulnerability in Proxied Environments
Fides Webserver API Rate Limiting Vulnerability in Proxied Environments
CVE-2025-57815Medium· 6.5Fides has a Lack of Brute-Force Protections on Authentication Endpoints
Fides has a Lack of Brute-Force Protections on Authentication Endpoints
CVE-2025-58438Criticalinternetarchive Vulnerable to Directory Traversal in File.download()
internetarchive Vulnerable to Directory Traversal in File.download()
CVE-2025-55671High· 7.8TkEasyGUI Affected by Uncontrolled Search Path Element Issue
TkEasyGUI Affected by Uncontrolled Search Path Element Issue
CVE-2025-58446Mediumxgrammar vulnerable to denial of service by huge enum grammar
xgrammar vulnerable to denial of service by huge enum grammar
CVE-2025-9636High· 7.9pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability
CVE-2025-58352Medium· 6.5Weblate is a web based localization tool
Weblate is a web based localization tool. Versions lower than 5.13.1 contain a vulnerability that causes long session expiry during the second factor verification. The long session expiry could be used to circumvent rate limiting of the…
CVE-2025-6984High· 7.5langchain-community: Langchain-community insecure XML parsing (CVE-2025-6984)
An XML External Entity flaw has been discovered in the langchain-community python package. The EverNoteLoader component has an insecure use of the `etree.iterparse()` function which does not disable external entity references. This can lea…
CVE-2025-58367CriticalDeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more
CVE-2025-57808High· 8.1PoCESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header
CVE-2025-58161LowMobSF Path Traversal in GET /download/<filename> using absolute filenames
MobSF Path Traversal in GET /download/<filename> using absolute filenames
CVE-2025-58162Medium· 6.5MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction
MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction
CVE-2023-41471High· 7.8Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to t…
Cross Site Scripting vulnerability in copyparty before 1.9.2 allows a local attacker to execute arbitrary code via a crafted payload to the WEEKEND-PLANS function. NOTE: this is disputed because WEEKEND-PLANS is accessible only to actors…
CVE-2025-55304LowExiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata
CVE-2025-58068MediumEventlet affected by HTTP request smuggling in unparsed trailers
Eventlet affected by HTTP request smuggling in unparsed trailers