Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
CVE-2026-46608High· 7.4Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)
CVE-2026-46611Medium· 5.3Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding Attack
CVE-2026-48487Medium· 6.5zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packet
CVE-2026-12799Medium· 4.3BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
BerriAI litellm: UI User Enumeration leads to System-Wide Information Disclosure
CVE-2026-56265Critical· 9.8PoCCrawl4AI - Authentication Bypass via Hardcoded JWT Signing Key
Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers who know the default key can forge valid authentication tokens for any user, bypassing a…
CVE-2026-12796Medium· 6.3BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session Tokens
CVE-2026-12798Medium· 6.3BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec Loader
CVE-2026-12797Medium· 6.3BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints
GHSA-fh2f-24rh-r2vqHighDuplicate Advisory: Picklescan missing detection when calling built-in python library function timeit.timeit()
Duplicate Advisory: Picklescan missing detection when calling built-in python library function timeit.timeit()
GHSA-fcqg-3mwf-cfcfHigh· 8.1Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx
Duplicate Advisory: Picklescan is missing detection when calling built-in Python cProfile.runctx
GHSA-8mc5-7w9m-fqv6High· 8.1Duplicate Advisory: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
Duplicate Advisory: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
CVE-2025-71378High· 8.1PoCpicklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code
picklescan before 0.0.30 fails to detect cProfile.runctx function calls in pickle file reduce methods, allowing attackers to execute arbitrary code. Malicious pickle files bypass picklescan detection and execute remote code when loaded v…
CVE-2025-71357High· 8.1PoCpicklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods
picklescan before 0.0.30 fails to detect malicious pickle files using idlelib.pyshell.ModifiedInterpreter.runcommand in reduce methods. Attackers can embed undetected code in pickle files that executes remote commands when loaded by vict…
GHSA-qvp4-q2p5-22ggHigh· 8.1Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.utils._config_module.load_config
Duplicate Advisory: Picklescan missing detection when calling pytorch function torch.utils._config_module.load_config
CVE-2026-12795High· 7.3litellm: BerriAI litellm: Missing authentication in SSO Debug Flow allows remote access. (CVE-2026-12795)
A flaw was found in BerriAI litellm. This vulnerability allows a remote attacker to bypass authentication within the SSO Debug Flow component by manipulating the `json.dumps` function. The successful exploitation of this flaw could lead to…
CVE-2026-12773High· 7.3LiteLLM: MCP Proxy Has Improper Authentication
LiteLLM: MCP Proxy Has Improper Authentication
CVE-2026-12770Medium· 5.4LiteLLM: Admin Key Handler Has Improper Authorization
LiteLLM: Admin Key Handler Has Improper Authorization
CVE-2026-12772Medium· 6.3LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session Expiration
CVE-2026-12771Medium· 5.0LiteLLM: M2M JWT Handler Has Improper Authorization
LiteLLM: M2M JWT Handler Has Improper Authorization
CVE-2025-71351Medium· 7.6PoCpicklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution
picklescan before 0.0.25 fails to detect malicious pickle files that use timeit.timeit() in the __reduce__ method, allowing remote code execution. Attackers can craft pickle files that import dangerous libraries like os and execute arbit…
CVE-2026-5366Critical· 9.9PoCPrefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)
GHSA-78fp-cf4h-g36pHigh· 8.8Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164
Duplicate Advisory: vLLM introduced enhanced protection for CVE-2025-62164
GHSA-vfm7-4h43-gp6mMedium· 4.3Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service
Duplicate Advisory: vLLM Vulnerable to Regular Expression Denial of Service
CVE-2026-56304Medium· 6.5PoCpicklescan - Arbitrary File Creation via logging.FileHandler Deserialization
picklescan before 1.0.1 contains an unsafe pickle deserialization vulnerability allowing unauthenticated attackers to create arbitrary zero-byte files via logging.FileHandler class instantiation. Attackers can exploit this by crafting ma…
MAL-2026-6246NoneMalicious code in d0rk3r (PyPI)
Malicious code in d0rk3r (PyPI)
MAL-2026-6245NoneMalicious code in request-cache-py (PyPI)
Malicious code in request-cache-py (PyPI)
MAL-2026-6236NoneMalicious code in query-profile (PyPI)
Malicious code in query-profile (PyPI)
CVE-2025-71379Medium· 4.3vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities
vLLM versions >= 0.6.3 and < 0.9.0 contain multiple regular expression denial of service (ReDoS) vulnerabilities. Several regex patterns — in vllm/lora/utils.py, the phi4mini tool parser, and the OpenAI-compatible serving chat endpoint —…
CVE-2026-66065Highouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
CVE-2026-58198Medium· 5.5ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer