VulnSea

Tagged “pip”

CVEs tagged pip, newest first.

5529 CVEsRSS

CVE-2026-84381High· 8.1
2mo ago

HTTPX2 is a next generation HTTP client for Python

HTTPX2 is a next generation HTTP client for Python. Prior to 2.10.0, httpcore2 fails to start TLS in src/httpcore2/httpcore2/_sync/socks_proxy.py and src/httpcore2/httpcore2/_async/socks_proxy.py when the remote origin uses wss through a…

▾ Twilighthttpcore2 · httpcore2EPSS 0.08%via NVD
CVE-2026-12876Medium
2mo ago

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

NLTK: Uncontrolled resource consumption in RecursiveDescentParser via ambiguous or left-recursive grammars

▾ Sunlitnltk · nltkvia OSV
CVE-2026-81726High· 7.0
2mo ago

NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

NLTK: Model-artifact APIs bypass pathsec and touch files outside allowed roots

▾ Twilightnltk · nltkEPSS 0.34%via OSV
CVE-2026-80047High· 7.8
2mo ago

A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate()

A vulnerability in Hugging Face Transformers (versions 4.57.0 to 5.16.1) allows remote Python files to be written to local disk without user consent when using GenerativePreTrainedModel.load_custom_generate(). The function fetches and ca…

▾ TwilightHugging Face · TransformersEPSS 0.10%via NVD
CVE-2026-84366High· 7.4
2mo ago

Scrapy is a high-level web crawling and scraping framework for Python

Scrapy is a high-level web crawling and scraping framework for Python. Prior to 2.17.0, in scrapy/core/downloader/handlers/s3.py, Scrapy's S3DownloadHandler converts an S3-scheme bucket and key request into a plaintext HTTP request to th…

▾ Twilightscrapy · scrapyEPSS 0.25%via NVD
MAL-2026-15811None
2mo ago

Malicious code in syswatch (PyPI)

Malicious code in syswatch (PyPI)

▾ Sunlitsyswatch · syswatchvia OSV
MAL-2026-15810Critical⚠ Exploited
2mo ago

Malicious code in gcphelpit (PyPI)

Malicious code in gcphelpit (PyPI)

▾ Abyssalgcphelpit · gcphelpitvia OSV
MAL-2026-15809None
2mo ago

Malicious code in tallyboxlite (PyPI)

Malicious code in tallyboxlite (PyPI)

▾ Sunlittallyboxlite · tallyboxlitevia OSV
CVE-2026-84305Medium· 6.2
2mo ago

sqlparse is a non-validating SQL parser module for Python

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, sqlparse.format(sql, reindent=True) and sqlformat --reindent route attacker-controlled parenthesized tuple lists through ReindentFilter._get_offset() in sqlparse/…

▾ Sunlitsqlparse · sqlparseEPSS 0.19%via NVD
CVE-2026-84309Medium· 5.5
2mo ago

pypdf is a free and open-source pure-python PDF library

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.0, an attacker can craft a PDF whose cyclic tree structure causes pypdf/generic/_data_structures.py TreeObject.insert_child to follow /Next links indefinitely when a …

▾ Sunlitpypdf_project · pypdfEPSS 0.19%via NVD
CVE-2026-84311Low· 3.3⚖ disputed
2mo ago

pypdf is a free and open-source pure-python PDF library

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_page.py PageObject._extract_text and PageObject.extract_xform_text to traverse a directed acyclic graph of reused fo…

▾ Sunlitpypdf_project · pypdfEPSS 0.14%via NVD
CVE-2026-84310Low· 3.3⚖ disputed
2mo ago

pypdf is a free and open-source pure-python PDF library

pypdf is a free and open-source pure-python PDF library. Prior to 6.16.1, an attacker can craft a PDF that causes pypdf/_doc_common.py _get_outline to consume long runtimes and large amounts of memory when retrieving document outlines wi…

▾ Sunlitpypdf_project · pypdfEPSS 0.14%via NVD
GHSA-wwv5-g3v4-889xLow
2mo ago

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_…

Tornado: Incomplete fix for CVE-2026-35536: cookie attribute injection re-opened via the legacy case-insensitive `**kwargs` path in `set_cookie`

▾ Sunlittornado · tornadovia OSV
GHSA-8423-8fgw-73vqMedium
2mo ago

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

tornado: multipart split() creates huge temp list before max_parts check -> memory amplification DoS (httputil.py:34)

▾ Sunlittornado · tornadovia OSV
GHSA-gqvg-gmmx-x4hmHigh· 8.8
2mo ago

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

MLFLOW_ALLOW_PICKLE_DESERIALIZATION=False safety control bypassed by mlflow.statsmodels flavor — RCE via crafted model artifact

▾ Twilightmlflow · mlflowvia GHSA
CVE-2026-82398Medium· 5.3
2mo ago

pypdf is a free and open-source pure-python PDF library

pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without…

▾ Sunlitpypdf_project · pypdfEPSS 0.52%via NVD
CVE-2026-82397High· 7.5
2mo ago

Tornado is a Python web framework and asynchronous networking library

Tornado is a Python web framework and asynchronous networking library. Prior to 6.5.8, Tornado parses application/x-www-form-urlencoded request bodies with urllib.parse.parse_qs in tornado/escape.py without passing max_num_fields. Reques…

▾ Twilighttornado · tornadoEPSS 0.35%via NVD
MAL-2026-15603Critical⚠ Exploited
2mo ago

Malicious code in pyservercheck (PyPI)

Malicious code in pyservercheck (PyPI)

▾ Abyssalpyservercheck · pyservercheckvia OSV
MAL-2026-15588None
2mo ago

Malicious code in tronlinker (PyPI)

Malicious code in tronlinker (PyPI)

▾ Sunlittronlinker · tronlinkervia OSV
MAL-2026-15578None
2mo ago

Malicious code in trongridor (PyPI)

Malicious code in trongridor (PyPI)

▾ Sunlittrongridor · trongridorvia OSV
MAL-2026-15577None
2mo ago

Malicious code in auth-app-streamlit (PyPI)

Malicious code in auth-app-streamlit (PyPI)

▾ Sunlitauth-app-streamlit · auth-app-streamlitvia OSV
MAL-2026-15566None
2mo ago

Malicious code in flask-header-guard (PyPI)

Malicious code in flask-header-guard (PyPI)

▾ Sunlitflask-header-guard · flask-header-guardvia OSV
MAL-2026-15488None
2mo ago

Malicious code in calcboxlite (PyPI)

Malicious code in calcboxlite (PyPI)

▾ Sunlitcalcboxlite · calcboxlitevia OSV
CVE-2026-55830High· 8.3
2mo ago

RestrictedPython guard hooks can be shadowed via positional-only arguments

RestrictedPython guard hooks can be shadowed via positional-only arguments

▾ Twilightrestrictedpython · restrictedpythonEPSS 0.29%via OSV
MAL-2026-14590None
2mo ago

Malicious code in yamlformatter-utils (PyPI)

Malicious code in yamlformatter-utils (PyPI)

▾ Sunlityamlformatter-utils · yamlformatter-utilsvia OSV
MAL-2026-14589None
2mo ago

Malicious code in yamlformat-tools (PyPI)

Malicious code in yamlformat-tools (PyPI)

▾ Sunlityamlformat-tools · yamlformat-toolsvia OSV
MAL-2026-14588None
2mo ago

Malicious code in yaml-report-formatter (PyPI)

Malicious code in yaml-report-formatter (PyPI)

▾ Sunlityaml-report-formatter · yaml-report-formattervia OSV
MAL-2026-14587None
2mo ago

Malicious code in pygame-renderkit (PyPI)

Malicious code in pygame-renderkit (PyPI)

▾ Sunlitpygame-renderkit · pygame-renderkitvia OSV
CVE-2026-55248Critical· 9.1
2mo ago

plone.app.portlets vulnerable to denial of service via RSS feed portlet

plone.app.portlets vulnerable to denial of service via RSS feed portlet

▾ Midnightplone-app-portlets · plone-app-portletsEPSS 0.44%via OSV
CVE-2026-55520High
2mo ago

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

Protego has exponential backtracking ReDoS in robots.txt URL wildcard matching

▾ Twilightprotego · protegoEPSS 0.51%via OSV
CVEs tagged “pip” — page 34 · VulnSea