Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
CVE-2024-52294Medium· 4.3khoj has an IDOR in subscription management allows unauthorized subscription modifications
khoj has an IDOR in subscription management allows unauthorized subscription modifications
CVE-2024-9774Medium· 6.5python-sql SQL injection vulnerability
python-sql SQL injection vulnerability
CVE-2024-56509High· 8.6changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal
changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal
CVE-2024-39025High· 7.5Letta (previously MemGPT) incorrect access control vulnerability
Letta (previously MemGPT) incorrect access control vulnerability
CVE-2024-12745High· 8.0Amazon Redshift Python Connector vulnerable to SQL Injection
Amazon Redshift Python Connector vulnerable to SQL Injection
MAL-2025-923NoneMalicious code in fflask (PyPI)
Malicious code in fflask (PyPI)
CVE-2024-9427Medium· 5.4Koji Cross-site Scripting
Koji Cross-site Scripting
CVE-2024-56326Medium· 6.3jinja2: Jinja has a sandbox breakout through indirect reference to format method (CVE-2024-56326)
A flaw was found in the Jinja package. In affected versions of Jinja, an oversight in how the Jinja sandboxed environment detects calls to str.format allows an attacker that controls the content of a template to execute arbitrary Python co…
CVE-2024-56201High· 7.3jinja2: Jinja has a sandbox breakout through malicious filenames (CVE-2024-56201)
A flaw was found in the Jinja2 package. A bug in the Jinja compiler allows an attacker that controls both the content and filename of a template to execute arbitrary Python code, regardless of Jinja's sandbox being used. An attacker needs …
CVE-2024-56327Critical· 9.8pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
pyrage vulnerable to malicious plugin names, recipients, or identities causing arbitrary binary execution
CVE-2024-56142Medium· 6.5PGHoard Path Traversal vulnerability
PGHoard Path Traversal vulnerability
CVE-2024-55890MediumPoCD-Tale allows Remote Code Execution through the Custom Filter Input
D-Tale allows Remote Code Execution through the Custom Filter Input
CVE-2024-55633Medium· 6.5Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
CVE-2024-55587High· 8.8PoCpython-libarchive directory traversal
python-libarchive directory traversal
CVE-2024-55655Lowsigstore has insufficient validation of integration timestamp during verification
sigstore has insufficient validation of integration timestamp during verification
CVE-2024-53947Critical· 9.8Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
CVE-2024-53949Medium· 6.5Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
CVE-2024-46455Mediumunstructured XML External Entity (XXE)
unstructured XML External Entity (XXE)
CVE-2024-53948Medium· 5.3Apache Superset: Error verbosity exposes metadata in analytics databases
Apache Superset: Error verbosity exposes metadata in analytics databases
CVE-2024-53908Critical· 9.8Django SQL injection in HasKey(lhs, rhs) on Oracle
Django SQL injection in HasKey(lhs, rhs) on Oracle
CVE-2024-53907High· 7.5Django denial-of-service in django.utils.html.strip_tags()
Django denial-of-service in django.utils.html.strip_tags()
CVE-2024-39163High· 8.8pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints
pyspider Cross-Site Request Forgery (CSRF) via the Flask endpoints
CVE-2024-53863HighSynapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decoders
CVE-2024-52805HighSynapse allows unsupported content types to lead to memory exhaustion
Synapse allows unsupported content types to lead to memory exhaustion
CVE-2024-52815HighSynapse allows a a malformed invite to break the invitee's `/sync`
Synapse allows a a malformed invite to break the invitee's `/sync`
CVE-2024-53999Medium· 6.1Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
CVE-2024-53867Medium· 4.3Synapse Matrix has a partial room state leak via Sliding Sync
Synapse Matrix has a partial room state leak via Sliding Sync
CVE-2024-53848High· 7.1check-jsonschema default caching for remote schemas allows for cache confusion
check-jsonschema default caching for remote schemas allows for cache confusion
CVE-2024-53865High· 8.2Python package "zhmcclient" stores passwords in clear text in its HMC and API logs
Python package "zhmcclient" stores passwords in clear text in its HMC and API logs
CVE-2024-53981High· 7.5Denial of service (DoS) via deformation `multipart/form-data` boundary
Denial of service (DoS) via deformation `multipart/form-data` boundary