Tagged “pip”
CVEs tagged pip, newest first.
5529 CVEsRSS
CVE-2026-54625Medium· 4.8django CMS is a content management system powered by Django
django CMS is a content management system powered by Django. Prior to 5.0.8 and in 5.1.0a1, the django CMS page cache in cms/cache/page.py ignores request headers declared by plugins through get_vary_cache_on(). The _page_cache_key funct…
GHSA-5p3m-vhh6-9236Medium· 6.3stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
GHSA-jgvr-6x5w-hx5wMediumZoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
GHSA-mc9m-6fm9-pghcMediumZoo Design Studio: Memory-corruption in memory handling of lib-kcl
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
CVE-2026-54259Medium· 4.3Wagtail: Improper restriction handling on Documents and Images chosen endpoints
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
CVE-2026-54260Medium· 4.3Wagtail: Denial of service via unbounded filter specs in the image preview
Wagtail: Denial of service via unbounded filter specs in the image preview
CVE-2026-54261Medium· 6.5Wagtail: Improper permission handling in image preview
Wagtail: Improper permission handling in image preview
CVE-2026-54262Medium· 4.3Wagtail: Pages translations can be created without page permissions when using simple_translation
Wagtail: Pages translations can be created without page permissions when using simple_translation
CVE-2026-54263High· 7.3Wagtail: Reflected XSS in dynamic image URL generator view
Wagtail: Reflected XSS in dynamic image URL generator view
CVE-2026-54622Medium· 6.5django CMS: Clipboard copy IDOR discloses unauthorized plugin content
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
CVE-2026-54624Medium· 6.5django CMS: Structure endpoint bypasses page-view permission
django CMS: Structure endpoint bypasses page-view permission
CVE-2026-75526Medium· 4.4django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. From 5.0.8 until 5.0.9, ContentRenderer.render_placeholder in cms/plugin_rendering.py can pass stored, attacker-controlled values…
CVE-2026-63003Medium· 6.5django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django
django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePa…
CVE-2026-61663Medium· 4.3django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
GHSA-92hv-j533-69wcLow· 3.7Wagtail: Identification of documents by SHA1 hash
Wagtail: Identification of documents by SHA1 hash
GHSA-c2xx-cjmh-9q8fMedium· 5.3Wagtail: Improper restriction handling on descendant collections in Documents and Images API
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
GHSA-x5cx-w6p2-mxf2Medium· 6.5Wagtail: Improper permission handling when copying snippets
Wagtail: Improper permission handling when copying snippets
GHSA-jm5p-837g-rv8gMedium· 6.5Wagtail: Improper restriction handling on Page translation API endpoint
Wagtail: Improper restriction handling on Page translation API endpoint
GHSA-9w56-46f6-3qhxMedium· 5.5asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
CVE-2026-54449High· 8.8LangBot is a global IM bot platform designed for LLMs
LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tool…
CVE-2026-49825High· 8.2lxml is a library for processing XML and HTML in the Python language
lxml is a library for processing XML and HTML in the Python language. Prior to 6.1.1, link attributes in ``lxml.html.defs.link_attrs`` were missing ``xlink:href``, which can be used for URL bypass attacks in embedded SVG/MathML/etc. cont…
GHSA-w672-239g-c3grHigh· 6.5Duplicate Advisory: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
Duplicate Advisory: GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
GHSA-wv46-xpj8-pw53High· 8.8Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
Duplicate Advisory: GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
GHSA-7jx3-jqcp-hhgcHigh· 8.1Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
Duplicate Advisory: GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
GHSA-3vrx-526r-64rmHigh· 8.2Duplicate Advisory: GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
Duplicate Advisory: GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
GHSA-298h-jpq4-m665High· 7.5Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
Duplicate Advisory: GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
MAL-2026-14308NoneMalicious code in libasync (PyPI)
Malicious code in libasync (PyPI)
MAL-2026-14306NoneMalicious code in rc4-secure (PyPI)
Malicious code in rc4-secure (PyPI)
CVE-2026-76237Highstigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints
stigmem-node before 0.9.0a12 contains a broken object level authorization (cross-tenant BOLA) vulnerability in the quarantine review endpoints. On multi-tenant deployments running the opt-in stigmem-plugin-multi-tenant, the list/count qu…
CVE-2026-76245Highstigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired
stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliab…