Tagged “pip”

CVEs tagged pip, newest first.

5529 CVEsRSS

CVE-2026-81700Critical· 9.8

openssl_encrypt before 1.4.9 GPG Signature Verification Bypass

openssl_encrypt versions before 1.4.9 contain a signature verification vulnerability in gpg_runner.verify_detached that accepts revoked and expired keys by only checking VALIDSIG status without inspecting REVKEYSIG, EXPKEYSIG, or gpg exi…

▾ Midnightjahlives · openssl_encryptEPSS 0.35%via CVEORG

CVE-2026-81698High· 7.5

2mo ago

openssl_encrypt before 1.4.9 Shell Injection via info command

openssl_encrypt versions before 1.4.9 contain a shell injection vulnerability in the info command's reconstructed CLI block that interpolates untrusted metadata fields without quoting. Attackers can craft metadata values like pepper_name…

▾ Twilightjahlives · openssl_encryptEPSS 0.43%via CVEORG

CVE-2026-81696Low· 3.3

2mo ago

openssl_encrypt before 1.4.9 Terminal Injection via info Command

openssl_encrypt versions before 1.4.9 fail to sanitize terminal control characters in file metadata printed by the info command. Attackers can craft malicious files containing escape sequences to repaint terminal output and forge verific…

▾ Sunlitjahlives · openssl_encryptEPSS 0.25%via CVEORG

CVE-2026-81695Low· 3.3

2mo ago

openssl_encrypt before 1.4.9 Terminal Injection via key_id

openssl_encrypt versions before 1.4.9 fail to escape attacker-controlled key_id values printed to stderr during decrypt auto-detection. Attackers can craft encrypted files with malicious key_id containing escape sequences to repaint term…

▾ Sunlitjahlives · openssl_encryptEPSS 0.25%via CVEORG

CVE-2026-81725Medium· 5.9

2mo ago

nltk: NLTK: Regular Expression Denial of Service via malformed TEI blocks (CVE-2026-81725)

A flaw was found in NLTK, specifically within the Pl196xCorpusReader component. A remote attacker can exploit this by supplying malformed Text Encoding Initiative (TEI) blocks containing numerous unmatched opening tags. This triggers a reg…

▾ SunlitRed Hat · Red Hat OpenShift AI 3.4EPSS 0.37%via CSAF

CVE-2026-79720Medium· 5.0

2mo ago

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, …

Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.

▾ Sunlitnetron · netronEPSS 0.26%via OSV

CVE-2026-81724High· 7.5⚖ disputed

2mo ago

nltk: NLTK: Denial of Service via Uncontrolled Recursion (CVE-2026-81724)

A flaw was found in NLTK. This uncontrolled recursion vulnerability in `nltk.featstruct.FeatStructReader` allows unauthenticated attackers to cause a denial of service. Attackers can achieve this by supplying deeply nested feature-structur…

▾ TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.46%via CSAF

CVE-2026-81723Low· 3.7⚖ disputed

2mo ago

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read

NLTK versions before 3.10.3 contain a quadratic CPU exhaustion vulnerability in XMLCorpusView._read_xml_fragment() that rescans accumulated XML fragments on every 1 KiB block read. Attackers can provide malformed XML corpus files to caus…

▾ Sunlitnltk · nltkEPSS 0.28%via NVD

CVE-2026-81727High· 7.1

2mo ago

nltk: NLTK: Filesystem containment bypass allows local file overwrite (CVE-2026-81727)

A flaw was found in NLTK. This vulnerability, a filesystem containment bypass, allows a local attacker with write access to a shared downloader directory to create special links (hardlinks) that point to files outside the intended installa…

▾ TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.19%via CSAF

CVE-2026-81722High· 7.5

2mo ago

nltk: nltk PorterStemmer: Denial of Service due to inefficient token processing (CVE-2026-81722)

A flaw was found in the nltk PorterStemmer component. A remote attacker could exploit this vulnerability by providing a specially crafted, untrusted token. The inefficient algorithmic complexity in the stemming process, specifically within…

▾ TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.52%via CSAF

MAL-2026-14584None

2mo ago

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the catalog-generate, profile-generate, and ssp-generate author comma…

▾ Twilightcompliance-trestle · compliance-trestleEPSS 0.22%via NVD

GHSA-2rrw-hpqm-36pvHigh· 7.5

2mo ago

Duplicate Advisory: ReDoS in nltk.text.Text.findall() via unvalidated user-supplied regular expressions

▾ Twilightnltk · nltkvia GHSA

CVE-2026-80206Medium· 5.9

2mo ago

nltk: NLTK: Denial of Service vulnerability in tgrep module (CVE-2026-80206)

A flaw was found in NLTK, specifically within its tgrep module. This vulnerability, known as Regular Expression Denial of Service (ReDoS), allows a remote attacker to provide specially crafted regular expressions. When processed, these exp…

▾ SunlitRed Hat · Red Hat OpenShift AI (RHOAI)EPSS 0.44%via CSAF

CVE-2026-80205High· 7.5

2mo ago

nltk: NLTK: Denial of Service via unvalidated regular expressions (CVE-2026-80205)

A flaw was found in NLTK. A remote attacker can exploit a regular expression denial of service (ReDoS) vulnerability in the `Text.findall()` and `TokenSearcher.findall()` methods. These methods accept user-supplied regular expressions with…

▾ TwilightRed Hat · Red Hat OpenShift AI 3.4EPSS 0.65%via CSAF

CVE-2026-57170High· 7.8

2mo ago

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents

Compliance-trestle (Trestle) is a Python SDK and command-line tool for managing OSCAL compliance documents. In versions prior to 3.12.4 and 4.0.0 through 4.0.3, the custom Jinja2 include tags mdsection_include and md_clean_include re-par…

▾ Twilightcompliance-trestle · compliance-trestleEPSS 0.24%via NVD

MAL-2026-14545Critical⚠ Exploited

2mo ago