Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
CVE-2024-41955Medium· 5.2PoCMobSF vulnerable to Open Redirect in Login Redirect
MobSF vulnerable to Open Redirect in Login Redirect
CVE-2024-41951Medium· 4.4PheonixAppAPI has visible Encoding Maps
PheonixAppAPI has visible Encoding Maps
CVE-2023-33976High· 7.5TensorFlow has segfault in array_ops.upper_bound
TensorFlow has segfault in array_ops.upper_bound
CVE-2024-6578Medium· 6.1Aim Stored Cross-site Scripting Vulnerability
Aim Stored Cross-site Scripting Vulnerability
CVE-2024-41671High· 8.3twisted.web has disordered HTTP pipeline response
twisted.web has disordered HTTP pipeline response
MAL-2024-12279Critical⚠ ExploitedMalicious code in google-cloud-datacatalog-lineage-producer-client (PyPI)
Malicious code in google-cloud-datacatalog-lineage-producer-client (PyPI)
CVE-2024-40767Medium· 6.5OpenStack Nova vulnerable to unauthorized access to potentially sensitive data
OpenStack Nova vulnerable to unauthorized access to potentially sensitive data
CVE-2024-41656High· 7.1Sentry vulnerable to stored Cross-Site Scripting (XSS)
Sentry vulnerable to stored Cross-Site Scripting (XSS)
CVE-2024-29073Medium· 5.3Anki Latex Incomplete Blocklist Vulnerability
Anki Latex Incomplete Blocklist Vulnerability
CVE-2024-32152Low· 3.1Ankitects Anki LaTeX Blocklist Bypass vulnerability
Ankitects Anki LaTeX Blocklist Bypass vulnerability
CVE-2024-41129Medium· 4.4ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
ops leaking secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI command
CVE-2024-26020Critical· 9.6Ankitects Anki arbitrary script execution vulnerability
Ankitects Anki arbitrary script execution vulnerability
CVE-2024-6961Medium· 5.9Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference
Guardrails AI vulnerable to Improper Restriction of XML External Entity Reference
CVE-2024-6281High· 7.3LoLLMS vulnerable to Expected Behavior Violation
LoLLMS vulnerable to Expected Behavior Violation
CVE-2024-41124Low· 3.8[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`
[PUNCIA] [CWE-319] Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`
CVE-2024-39123Medium· 5.4PoCCalibre-Web Cross Site Scripting (XSS)
Calibre-Web Cross Site Scripting (XSS)
CVE-2024-35198Critical· 9.8TorchServe vulnerable to bypass of allowed_urls configuration
TorchServe vulnerable to bypass of allowed_urls configuration
CVE-2024-35199High· 8.2TorchServe gRPC Port Exposure
TorchServe gRPC Port Exposure
CVE-2024-40647Low· 2.5Sentry's Python SDK unintentionally exposes environment variables to subprocesses
Sentry's Python SDK unintentionally exposes environment variables to subprocesses
CVE-2024-40637Medium· 4.2dbt has an implicit override for built-in materializations from installed packages
dbt has an implicit override for built-in materializations from installed packages
CVE-2024-39863Medium· 5.4Apache Airflow Potential Cross-site Scripting Vulnerability
Apache Airflow Potential Cross-site Scripting Vulnerability
CVE-2024-39877High· 8.8PoCApache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden accordi…
Apache Airflow 2.4.0, and versions before 2.9.3, has a vulnerability that allows authenticated DAG authors to craft a doc_md parameter in a way that could execute arbitrary code in the scheduler context, which should be forbidden accordi…
CVE-2024-39700Critical· 9.9PoCJupyterLab extension template is a `copier` template for JupyterLab extensions
JupyterLab extension template is a `copier` template for JupyterLab extensions. Repositories created using this template with `test` option include `update-integration-tests.yml` workflow which has an RCE vulnerability. Extension author…
CVE-2024-39887Medium· 4.3PoCApache Superset vulnerable to improper SQL authorization
Apache Superset vulnerable to improper SQL authorization
CVE-2024-6345High· 8.8pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools (CVE-2024-6345)
A flaw was found in the package_index module of pypa/setuptools. Affected versions of this package allow remote code execution via its download functions. These functions, which are used to download packages from URLs provided by users or …
CVE-2024-40627Medium· 5.8OpaMiddleware does not filter HTTP OPTIONS requests
OpaMiddleware does not filter HTTP OPTIONS requests
CVE-2024-39903High· 8.6PoCLocal File Inclusion in Solara
Local File Inclusion in Solara
CVE-2024-39905Medium· 5.3Red-DiscordBot vulnerable to Incorrect Authorization in commands API
Red-DiscordBot vulnerable to Incorrect Authorization in commands API
CVE-2024-38875High· 7.5Django vulnerable to Denial of Service
Django vulnerable to Denial of Service
CVE-2024-39614High· 7.5PoCDjango vulnerable to Denial of Service
Django vulnerable to Denial of Service