Tagged “pip”

CVEs tagged pip, newest first.

5529 CVEsRSS

GHSA-gx64-gj6p-pc4cHigh

3mo ago

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

▾ Twilightjupyterlab · jupyterlabvia GHSA

GHSA-pppj-hq3g-57pjHigh

3mo ago

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

▾ Twilightjupyterlab · jupyterlabvia GHSA

CVE-2026-64825Critical· 9.3

3mo ago

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial o…

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial o…

▾ Midnighthome-assistant · Home Assistant CoreEPSS 0.58%via NVD

CVE-2026-47143Medium· 5.9

3mo ago

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `d…

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `decode()` when disassembling 3DNow! opcodes (`0F 0F`) in builds compiled with `-DCAPSTONE_X86_REDUCE`…

Tagged “pip”

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial o…

Capstone is a disassembly framework. Versions prior to 6.0.0-Alpha8 and 5.0.8 have a NULL pointer dereference in `modRMRequired()` and `d…

Malicious code in comp-colors (PyPI)

Malicious code in animated-octo-spoon (PyPI)

Malicious code in reimagined-broccoli (PyPI)

Malicious code in lebinfmt (PyPI)

Malicious code in colorstack (PyPI)

Malicious code in rasterkit-demo (PyPI)

Malicious code in rasterkit (PyPI)

Malicious code in fluffy-octo-broccoli (PyPI)

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

GitPython: command injection via unguarded Git options in `Repo.archive()`, `git.ls_remote()`, and arbitrary file overwrite via `Repo.iter_commits()` / `Repo.blame()`

GitPython unsafe clone option gate bypass through joined short options

GitPython: Command Injection via git long-option prefix abbreviation bypass of CVE-2026-42215 blocklist

Malicious code in trongridmy (PyPI)

Malicious code in trongrider (PyPI)

Malicious code in roles-royce (PyPI)

Malicious code in defi-kit (PyPI)

Malicious code in ml-core-airflow-auth (PyPI)

Malicious code in automatic-octo-invention (PyPI)

Malicious code in shark-e2e-bnsneo (PyPI)

Malicious code in mysuperlicense (PyPI)

Malicious code in mysupergoodpython (PyPI)

Malicious code in ibreak (PyPI)

Malicious code in hello-world-test-mh3 (PyPI)

Malicious code in hello-world-test-mh2 (PyPI)

Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated images

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests