Tagged “pip”

CVEs tagged pip, newest first.

5529 CVEsRSS

MAL-2026-16044Critical⚠ Exploited

2mo ago

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes. Attackers holding the service's public key can forge HS256 tokens that pa…

▾ Midnightmpdavis · python-joseEPSS 0.22%via NVD

MAL-2026-15864Critical⚠ Exploited

2mo ago

Malicious code in asti (PyPI)

▾ Abyssalasti · astivia OSV

CVE-2024-33663Critical· 9.1

2mo ago

python-jose algorithm confusion guard bypassed by DER-encoded public keys

▾ Midnightpython-jose · python-joseEPSS 0.31%via OSV

MAL-2026-15863None

2mo ago

Malicious code in uvhttp-custom (PyPI)

▾ Sunlituvhttp-custom · uvhttp-customvia OSV

MAL-2026-15862None

2mo ago

Malicious code in py-2equests (PyPI)

▾ Sunlitpy-2equests · py-2equestsvia OSV

MAL-2026-15861None

2mo ago

Malicious code in py-1requests (PyPI)

▾ Sunlitpy-1requests · py-1requestsvia OSV

MAL-2026-15860None

2mo ago

Malicious code in py-0requests (PyPI)

▾ Sunlitpy-0requests · py-0requestsvia OSV

MAL-2026-15859None

2mo ago

Malicious code in 0requests (PyPI)

▾ Sunlit0requests · 0requestsvia OSV

MAL-2026-15858None

2mo ago

Malicious code in trongridi (PyPI)

▾ Sunlittrongridi · trongridivia OSV

MAL-2026-15829None

2mo ago

Malicious code in telemetry-helper (PyPI)

▾ Sunlittelemetry-helper · telemetry-helpervia OSV

MAL-2026-15828None

2mo ago

Malicious code in env-validator-tool (PyPI)

▾ Sunlitenv-validator-tool · env-validator-toolvia OSV

MAL-2026-15827None

2mo ago

Malicious code in company-sdk (PyPI)

▾ Sunlitcompany-sdk · company-sdkvia OSV

CVE-2026-53720Medium

2mo ago

pymonocypher uses cython to wrap the Monocypher C library

pymonocypher uses cython to wrap the Monocypher C library. Prior to version 4.0.2.8, the argon2i_32 implementation does not check the nb_blocks size. If the caller does not provide a sufficiently large buffer based on the API contract, t…

▾ Sunlitpymonocypher · pymonocypherEPSS 0.18%via NVD

CVE-2026-84377Medium· 6.5

2mo ago

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format. Prior to versions 1.88.6 and 1.96.2, any authenticated LiteLLM proxy user could redirect an outbound provider call to a destination the user controls a…

▾ SunlitRed Hat · Red Hat OpenShift AI (RHOAI)EPSS 0.54%via NVD

CVE-2026-84452High

2mo ago

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML. Prior to 0.4.0, the src/winml/modelkit/serve/cli_api.py component exposes WinML CLI commands through a localhost HTTP API…

▾ Twilightwinml-cli · winml-cliEPSS 1.6%via NVD

CVE-2026-84382High· 7.5

2mo ago

HTTPX2 is a next generation HTTP client for Python

HTTPX2 is a next generation HTTP client for Python. Prior to 2.12.0, the HTTPX2 content decoders in src/httpx2/httpx2/_decoders.py fully inflate each gzip, deflate, br, or zstd network chunk before iter_bytes() or aiter_bytes() yields bo…

▾ Twilighthttpx2 · httpx2EPSS 0.63%via NVD

CVE-2026-84380Medium· 5.6

2mo ago

HTTPX2 is a next generation HTTP client for Python

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, Request._prepare() in src/httpx2/httpx2/_models.py can add a body-derived Content-Length header to a request that already contains a caller-supplied Transfer-Encoding h…

▾ Sunlithttpx2 · httpx2EPSS 0.22%via NVD

CVE-2026-84379Medium· 5.3

2mo ago

HTTPX2 is a next generation HTTP client for Python

HTTPX2 is a next generation HTTP client for Python. Prior to 2.11.0, FileField.render_headers() in src/httpx2/httpx2/_multipart.py directly interpolates attacker-controlled content_type values and custom headers from the files= three-ele…

▾ Sunlithttpx2 · httpx2EPSS 0.32%via NVD

CVE-2026-84378Medium· 5.9

2mo ago

HTTPX2 is a next generation HTTP client for Python

HTTPX2 is a next generation HTTP client for Python. From 2.5.0 until 2.10.0, the HTTPX2 Server-Sent Events parser in src/httpx2/httpx2/_sse.py repeatedly copies and rescans buffered text in _SSELineDecoder.decode() when an attacker-contr…

▾ Sunlithttpx2 · httpx2EPSS 0.32%via NVD

CVE-2026-32773Medium· 6.1⚖ disputed

2mo ago

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encourag…

▾ Sunlitapache · sparkEPSS 0.41%via NVD

Tagged “pip”

Malicious code in tsshare (PyPI)

Malicious code in houdus (PyPI)

Malicious code in chartkit-core (PyPI)

Malicious code in metricboxlite (PyPI)

Malicious code in tpu-raiden-jax (PyPI)

Malicious code in pymaas (PyPI)

Malicious code in olympuslib (PyPI)

Malicious code in qoeoe (PyPI)

Malicious code in astlsi (PyPI)

Malicious code in timeweave (PyPI)

python-jose through 3.5.0 fails to properly validate asymmetric keys in HMAC initialization, accepting DER-encoded public keys that lack PEM armor or SSH prefixes

Malicious code in asti (PyPI)

python-jose algorithm confusion guard bypassed by DER-encoded public keys

Malicious code in uvhttp-custom (PyPI)

Malicious code in py-2equests (PyPI)

Malicious code in py-1requests (PyPI)

Malicious code in py-0requests (PyPI)

Malicious code in 0requests (PyPI)

Malicious code in trongridi (PyPI)

Malicious code in telemetry-helper (PyPI)

Malicious code in env-validator-tool (PyPI)

Malicious code in company-sdk (PyPI)

pymonocypher uses cython to wrap the Monocypher C library

LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format

Windows ML CLI is a command line tool for building portable, performant, and high-quality AI models for Windows ML

HTTPX2 is a next generation HTTP client for Python

HTTPX2 is a next generation HTTP client for Python

HTTPX2 is a next generation HTTP client for Python

HTTPX2 is a next generation HTTP client for Python

There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser