Tagged “pip”
CVEs tagged pip, newest first.
5516 CVEsRSS
MAL-2026-17422Critical⚠ ExploitedMalicious code in shortneer (PyPI)
Malicious code in shortneer (PyPI)
MAL-2026-17421Critical⚠ ExploitedMalicious code in spo365-graph (PyPI)
Malicious code in spo365-graph (PyPI)
MAL-2026-17419Critical⚠ ExploitedMalicious code in friendly-tools (PyPI)
Malicious code in friendly-tools (PyPI)
CVE-2026-51886Critical· 9.8PoClangflow-ai langflow v1.9.3 is affected by: Code Injection
langflow-ai langflow v1.9.3 is affected by: Code Injection. The impact is: execute arbitrary code (remote). The component is: src/backend/base/langflow/api/v1/validate.py:validate-post_validate_code-a-real-authenticated-http-post-to-api-…
CVE-2026-77387Medium· 4.0PoCgeopy is a geocoding library for Python
geopy is a geocoding library for Python. Prior to 2.5.0, geopy.Point and Point.from_string() can spend excessive CPU time due to inefficient regular-expression behavior when an application passes a long malformed coordinate string withou…
CVE-2026-103263Medium· 5.9PoCTornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it
Tornado before 6.5.9 contains a path traversal vulnerability in StaticFileHandler that follows symbolic links inside the static root without confirming the resolved target stays within it. When a symlink pointing outside the static direc…
CVE-2026-103262High· 7.5PoCTornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response
Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response. Attackers can send a gzip-encoded decom…
CVE-2026-103261Medium· 5.3Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters
Tornado before 6.5.9 fails to limit the number of query string fields in HTTPServerRequest.__init__, allowing remote attackers to cause event-loop stalling by sending requests with thousands of query parameters. Attackers can send unauth…
CVE-2026-50221Medium· 5.4OpenStack Swift vulnerable to authenticated server-side request forgery
OpenStack Swift vulnerable to authenticated server-side request forgery
CVE-2026-53964High· 7.2Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data
Document Merge Service is a document template merge service providing an API to manage templates and merge them with given data. Prior to version 9.1.0, a remote code execution (RCE) via server-side template injection (SSTI) allows for u…
MAL-2026-17417Critical⚠ ExploitedMalicious code in beautifytext (PyPI)
Malicious code in beautifytext (PyPI)
MAL-2026-17416Critical⚠ ExploitedMalicious code in friendly-greeting-tools (PyPI)
Malicious code in friendly-greeting-tools (PyPI)
GHSA-59cr-6r3x-644wMediumGitPython submodule update path traversal can write outside the repository
GitPython submodule update path traversal can write outside the repository
GHSA-c2m8-h5v5-343rHighTornado: StaticFileHandler follows symlinks outside static root (path traversal)
Tornado: StaticFileHandler follows symlinks outside static root (path traversal)
GHSA-chx6-46f5-w4vpHigh· 7.5tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOM
GHSA-3hv7-mjh2-fv65Medium· 5.3Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
Tornado: Unbounded query-string argument count allows event-loop-stalling DoS
GHSA-whh4-5q6c-9v3xMedium· 6.5GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracle
CVE-2026-103001Medium· 6.5PoCPyJWT is a Python implementation of JSON Web Token standards
PyJWT is a Python implementation of JSON Web Token standards. From 2.11.0 through 2.13.0, PyJWT's PyJWT._merge_options() method can modify a caller-supplied mutable options mapping when verify_signature is false. If an application reuses…
CVE-2026-103000High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF can provide unusually large alphabetical page-label values that cause pypdf/_page_labels.py to generate strings beyond a reasonable page-label length…
CVE-2026-102999High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF containing many embedded files can cause the dictionary-based attachments API in pypdf/_doc_common.py to reparse the full attachment list for each co…
CVE-2026-102998High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.19.0, a crafted PDF with form field values can cause pypdf/generic/_appearance_stream.py appearance-stream generation to repeat invariant selection-data work inside a lo…
CVE-2026-102997High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF containing a partially malformed /FlateDecode stream with padded data can force pypdf/filters.py to use inefficient byte-by-byte decompression while …
CVE-2026-102996High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can provide a TrueType or Type1 simple font with an unusually large /Widths array, causing pypdf/_font.py Font._collect_tt_t1_character_widths to pro…
CVE-2026-102995High· 7.5⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.1, a crafted PDF can place unusually large source-code or destination-string tokens in a font /ToUnicode mapping, causing pypdf/_cmap.py parse_bfchar to decode and re…
CVE-2026-102994High· 7.5pypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.18.0, a crafted PDF containing indirect-object identifiers or generation-number tokens that continue for a long time without whitespace can cause pypdf/_reader.py and py…
CVE-2026-102993High· 7.5⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.17.0, a crafted PDF can provide unusually large Roman page-label values that cause pypdf/_page_labels.py to generate excessively large numeral strings when an applicatio…
CVE-2026-102991Medium· 6.5PoCMako is a template library written in Python
Mako is a template library written in Python. Prior to 1.4.2, on Windows, TemplateLookup.get_template() in mako/lookup.py resolves template URIs with posixpath, while Template.__init__() in mako/template.py validates them with os.path, w…
CVE-2026-103241Medium· 5.3PoC⚖ disputedA flaw has been found in vllm-project vLLM up to 0.26.0
A flaw has been found in vllm-project vLLM up to 0.26.0. This vulnerability affects unknown code of the file rust/src/parser/src/unified/gemma4.rs of the component Gemma4UnifiedParser. Executing a manipulation can lead to denial of servi…
MAL-2026-17325Critical⚠ ExploitedMalicious code in cleanup-string (PyPI)
Malicious code in cleanup-string (PyPI)
MAL-2026-17319Critical⚠ ExploitedMalicious code in bfox-build-utils (PyPI)
Malicious code in bfox-build-utils (PyPI)