Tagged “pip”
CVEs tagged pip, newest first.
5529 CVEsRSS
CVE-2026-12261Medium· 6.5PoCA vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning
A vulnerability in `nltk.downloader` in nltk/nltk versions <= 3.9.4 allows for cross-package resource and model poisoning. The downloader extracts package archives into shared namespaces such as `corpora/` and `taggers/` instead of packa…
CVE-2026-71870Low· 3.3⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause large memory consumption when pypdf/_cmap.py function parse_bfrange parses unusually large source-code or destination-string tokens in a fo…
MAL-2026-13619NoneMalicious code in atlas-internal (PyPI)
Malicious code in atlas-internal (PyPI)
MAL-2026-13607NoneMalicious code in speed-hashes (PyPI)
Malicious code in speed-hashes (PyPI)
MAL-2026-13606NoneMalicious code in cdktn-provider-azurerm (PyPI)
Malicious code in cdktn-provider-azurerm (PyPI)
MAL-2026-13490NoneMalicious code in fast-hashes (PyPI)
Malicious code in fast-hashes (PyPI)
MAL-2026-13489NoneMalicious code in pydanticc (PyPI)
Malicious code in pydanticc (PyPI)
MAL-2026-13488NoneMalicious code in idnna (PyPI)
Malicious code in idnna (PyPI)
MAL-2026-13487NoneMalicious code in flasq (PyPI)
Malicious code in flasq (PyPI)
MAL-2026-13486NoneMalicious code in fastapii (PyPI)
Malicious code in fastapii (PyPI)
CVE-2026-71852Low· 3.3⚖ disputedpypdf is a free and open-source pure-python PDF library
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, a crafted PDF can cause long runtimes and large memory consumption when pypdf/_font.py function Font._collect_cid_character_widths expands unusually large CID font…
GHSA-4gmw-gg2m-w46pHigh· 8.1GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
GHSA-9rj7-rf2p-w77rHigh· 7.5GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
GHSA-hh9p-6wh2-4mfcMedium· 6.5GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
GHSA-hmq2-w58f-27jcHigh· 8.2GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
GHSA-jm78-9fvv-mhgrHigh· 8.8GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)
GHSA-wvpp-8hx9-p66jHigh· 8.8GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution
CVE-2026-48169High· 8.8PraisonAI is a multi-agent teams system
PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key…
CVE-2026-48039Critical· 9.1Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads
Meta Ads MCP is a Model Context Protocol (MCP) server that lets AI assistants run Meta Ads. Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streama…
CVE-2026-64640NonePoCApache Polaris did not consistently validate storage locations supplied during table and view registration.
Apache Polaris did not consistently validate storage locations supplied during table and view registration. An authenticated principal with permission to register a table or view could, depending on the affected release and registration…
MAL-2026-13473NoneMalicious code in alphalend-layouts (PyPI)
Malicious code in alphalend-layouts (PyPI)
MAL-2026-13472NoneMalicious code in alphalend-abi (PyPI)
Malicious code in alphalend-abi (PyPI)
CVE-2026-67422High· 7.5pymdown-extensions is a collection of extensions for the Python Markdown library
pymdown-extensions is a collection of extensions for the Python Markdown library. In versions up to and including 11.0, four inline processors (caret, tilde, betterem, and magiclink) use regular expressions whose content groups can parti…
CVE-2026-71554Medium· 5.3PoCh2 is a pure-Python implementation of a HTTP/2 protocol stack
h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the co…
CVE-2026-18654Medium· 6.8AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
CVE-2026-71433Medium· 5.3LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver
LangGraph Checkpoint Postgres and SQLite Checkpoint are the Postgres and SQLite implementations of LangGraph's checkpoint saver. Prior to 3.1.1, the langgraph-checkpoint-postgres and langgraph-checkpoint-sqlite packages persisted hierarc…
MAL-2026-13426NoneMalicious code in xayoub-xctxteam (PyPI)
Malicious code in xayoub-xctxteam (PyPI)
MAL-2026-13386NoneMalicious code in decapod-common (PyPI)
Malicious code in decapod-common (PyPI)
CVE-2026-70646High· 7.5aiosend is a synchronous and asynchronous Crypto Pay API client
aiosend is a synchronous and asynchronous Crypto Pay API client. Pror to version 3.0.7, `WebhookHandler.feed_update()` deserializes the entire request body before verifying the HMAC signature. This allows an unauthenticated attacker to f…
GHSA-9pw3-x84f-xcwfHigh· 7.4Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()
Duplicate Advisory: Langflow: Weak Fernet Key via random.seed()