Tagged “pip”
CVEs tagged pip, newest first.
5516 CVEsRSS
CVE-2026-105697Critical· 9.9PoCLangflow is a tool for building and deploying AI-powered agents and workflows
Langflow is a tool for building and deploying AI-powered agents and workflows. Before Langflow 1.10.3, the MCP stdio transport launched whatever command / args a user put in an MCP server configuration, with no allowlist and (before 1.10…
CVE-2026-105315Medium· 4.7PoC⚖ disputedA vulnerability has been found in django-haystack up to 3.3.0
A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsearch_backend.py of the component more_like_this Template Tag Handler. Such manipulation of the argu…
MAL-2026-17472Critical⚠ ExploitedMalicious code in anthropic-sdk (PyPI)
Malicious code in anthropic-sdk (PyPI)
MAL-2026-17629Critical⚠ ExploitedMalicious code in zencleaner (PyPI)
Malicious code in zencleaner (PyPI)
MAL-2026-17471Critical⚠ ExploitedMalicious code in caoxiltts (PyPI)
Malicious code in caoxiltts (PyPI)
MAL-2026-17470Critical⚠ ExploitedMalicious code in voxcpmruntime (PyPI)
Malicious code in voxcpmruntime (PyPI)
MAL-2026-17469Critical⚠ ExploitedMalicious code in infrabench (PyPI)
Malicious code in infrabench (PyPI)
MAL-2026-17468Critical⚠ ExploitedMalicious code in voxcpmintel (PyPI)
Malicious code in voxcpmintel (PyPI)
MAL-2026-17467Critical⚠ ExploitedMalicious code in voxcpmui4 (PyPI)
Malicious code in voxcpmui4 (PyPI)
MAL-2026-17466Critical⚠ ExploitedMalicious code in voxcpmkit (PyPI)
Malicious code in voxcpmkit (PyPI)
MAL-2026-17465Critical⚠ ExploitedMalicious code in voxcpmeval (PyPI)
Malicious code in voxcpmeval (PyPI)
MAL-2026-17464Critical⚠ ExploitedMalicious code in voxcpmui3 (PyPI)
Malicious code in voxcpmui3 (PyPI)
MAL-2026-17463Critical⚠ ExploitedMalicious code in voxcpmtts3 (PyPI)
Malicious code in voxcpmtts3 (PyPI)
MAL-2026-17462Critical⚠ ExploitedMalicious code in echogen (PyPI)
Malicious code in echogen (PyPI)
MAL-2026-17461Critical⚠ ExploitedMalicious code in voxel-tts (PyPI)
Malicious code in voxel-tts (PyPI)
GHSA-qqw9-2vj9-hx7rHighDuplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
Duplicate Advisory: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators Description
MAL-2026-17457Critical⚠ ExploitedMalicious code in voxeval (PyPI)
Malicious code in voxeval (PyPI)
MAL-2026-17455Critical⚠ ExploitedMalicious code in dedh-devops-automation (PyPI)
Malicious code in dedh-devops-automation (PyPI)
GHSA-jqmf-mx4f-hfr6Critical· 10.0Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF
GHSA-5rmq-chc7-m22fHigh· 7.5Vibe-Trading file-read tools expose arbitrary server-readable files
Vibe-Trading file-read tools expose arbitrary server-readable files
GHSA-v2f8-6655-7grjCritical· 10.0Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain
GHSA-cm62-gvxx-vmxxHigh· 8.6Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinks
GHSA-8w8g-wq8h-fq33High· 8.6Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protections
GHSA-5fqc-mrg8-w798High· 8.6Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistence
GHSA-35mr-4567-66vgMedium· 6.5Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object Resolution
GHSA-8mcx-5rqc-vhmfHigh· 8.8Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree Paths
CVE-2026-104874Medium· 5.3PoCMultidict is an implementation of a multidict data structure
Multidict is an implementation of a multidict data structure. From 6.7.0 until 6.9.1, the C extension's items-view reflected union operation, operand | d.items(), in multidict_itemsview_or2_impl and subtraction operation, d.items() - ope…
CVE-2026-104873High· 7.6LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications
LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs from Python applications. From 0.1.45 until 0.4.4, the langgraph-sdk resource-scoped authorization decorators @auth.on.t…
CVE-2026-104851High· 8.8PoCfsspec is a specification and Python implementation framework for filesystem interfaces
fsspec is a specification and Python implementation framework for filesystem interfaces. From 0.9.0 until 2026.6.0, fsspec.implementations.reference.ReferenceFileSystem evaluates fields from Kerchunk reference JSON documents through unre…
CVE-2026-104843Medium· 5.9uv is a Python package and project manager written in Rust
uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a…