Tagged “pip”
CVEs tagged pip, newest first.
5512 CVEsRSS
MAL-2026-18104Critical⚠ ExploitedMalicious code in semvver (PyPI)
Malicious code in semvver (PyPI)
MAL-2026-18103Critical⚠ ExploitedMalicious code in semverr (PyPI)
Malicious code in semverr (PyPI)
MAL-2026-18102Critical⚠ ExploitedMalicious code in semveer (PyPI)
Malicious code in semveer (PyPI)
MAL-2026-18101Critical⚠ ExploitedMalicious code in semmver (PyPI)
Malicious code in semmver (PyPI)
MAL-2026-18098Critical⚠ ExploitedMalicious code in security-research-startup-snapshot-810764b303 (PyPI)
Malicious code in security-research-startup-snapshot-810764b303 (PyPI)
MAL-2026-18097Critical⚠ ExploitedMalicious code in research-probe-6150c1c915 (PyPI)
Malicious code in research-probe-6150c1c915 (PyPI)
MAL-2026-18096Critical⚠ ExploitedMalicious code in workalender (PyPI)
Malicious code in workalender (PyPI)
MAL-2026-18095Critical⚠ ExploitedMalicious code in resion (PyPI)
Malicious code in resion (PyPI)
MAL-2026-18094Critical⚠ ExploitedMalicious code in pafex (PyPI)
Malicious code in pafex (PyPI)
MAL-2026-18093Critical⚠ ExploitedMalicious code in workcalender (PyPI)
Malicious code in workcalender (PyPI)
MAL-2026-18092Critical⚠ ExploitedMalicious code in test-workalendar-internal (PyPI)
Malicious code in test-workalendar-internal (PyPI)
CVE-2026-113731Low· 3.3PoCdjust: Arbitrary absolute-path file read in the find_handlers_for_template MCP tool
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. From 0.9.0 until 1.0.10, 1.1.7, 1.2.4, and 1.3.0rc8, the find_handlers_for_template MCP tool in python/djust/mcp/server.py acc…
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
GHSA-6q48-6c7w-9gw2Criticalcertifi bundles emSign root CAs with compromised intermediate CA keys
certifi bundles emSign root CAs with compromised intermediate CA keys
CVE-2026-112895High· 7.5Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
CVE-2026-112897High· 7.5PoCPillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
CVE-2026-112896High· 7.1PoCPillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
CVE-2026-112400High· 7.5PoCPillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
CVE-2026-112403Critical· 9.8PoCPillow: Heap buffer overflow in ImagingJpegDecode
Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112397High· 7.5PoCPillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
CVE-2026-111065Medium· 6.9AIOHTTP: Connector pool exhaustion via Max-Age overflow
AIOHTTP: Connector pool exhaustion via Max-Age overflow
CVE-2026-111748Medium· 6.3AIOHTTP: Absolute-form request targets can spoof Request.scheme
AIOHTTP: Absolute-form request targets can spoof Request.scheme
MAL-2026-18045Critical⚠ ExploitedMalicious code in asurion (PyPI)
Malicious code in asurion (PyPI)
MAL-2026-17943Critical⚠ ExploitedMalicious code in vinted-mocked-apis (PyPI)
Malicious code in vinted-mocked-apis (PyPI)
CVE-2026-112893High· 8.2PoCPillow: Invalid free in FreeType glyph rendering when a stroker is active
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale …
CVE-2026-112898Medium· 6.9PoCPillow: Image.quantize() with empty palette leaks uninitialized stack memory
Pillow is a Python imaging library. From 9.1.0 until 13.0.0, Pillow can disclose uninitialized stack memory when Image.quantize() uses an empty palette. ImagingPaletteCacheUpdate() leaves a local cache array uninitialized when the palett…
CVE-2026-112395Medium· 6.5PoCPillow tiled-TIFF decoder reads past tile buffer in copy4 (Unpack.c:1290)
Pillow is a Python imaging library. From 8.2.0 until 13.0.0, Pillow's tiled-TIFF decoder can read past the tile buffer while copying four-byte pixels. In _decodeTile, libtiff can return a tile allocation smaller than the required row str…
CVE-2026-112399High· 8.7PoCPillow: APNG background disposal allocates full canvas before decompression bomb check
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large decl…
CVE-2026-112404High· 8.8PoCPillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated P…
CVE-2026-112892High· 7.5pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder (CVE-2026-112892)
A flaw was found in Pillow. A remote attacker can cause a Denial of Service (DoS) by supplying a specially crafted Microsoft Paint (MSP) image file to an application that processes image pixels. Due to missing expansion limits during decom…