Tagged “pip”
CVEs tagged pip, newest first.
5513 CVEsRSS
CVE-2026-113714Low· 2.3PoCvirtualenv: Downloaded wheel selection and caching precede verification
virtualenv: Downloaded wheel selection and caching precede verification
CVE-2026-113717Low· 2.3PoCvirtualenv: Pip seeding with download omits wheel digest verification
virtualenv: Pip seeding with download omits wheel digest verification
CVE-2026-113719Medium· 4.5PoCvirtualenv: Seed replacement does not contain metadata deletion paths
virtualenv: Seed replacement does not contain metadata deletion paths
CVE-2026-113715Low· 2.0PoCvirtualenv: Venv configuration readback can reinterpret path boundaries
virtualenv: Venv configuration readback can reinterpret path boundaries
CVE-2026-113720Medium· 4.4virtualenv: Seeded files retain permissions from an older cache
virtualenv: Seeded files retain permissions from an older cache
CVE-2026-113718High· 7.1PoCvirtualenv: Xonsh activation literals depend on the script decoding codec
virtualenv: Xonsh activation literals depend on the script decoding codec
CVE-2026-113723High· 7.1PoCvirtualenv: Bash prompt values can change meaning under older compatibility modes
virtualenv: Bash prompt values can change meaning under older compatibility modes
CVE-2026-112906Medium· 4.7PoCfilelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
CVE-2026-112914Medium· 5.3filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the…
filelock: SoftFileLock stale-break restore follows a swapped-in symbolic link and hard-links a file of the user running the lock into the lock directory
CVE-2026-112937Medium· 6.1filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
CVE-2026-112940High· 7.1PoCfilelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process over…
filelock ReadWriteLock: SQLite reopens the lock database by name, so a planted symlink or journal file makes the lock user's process overwrite or unlink its own files
CVE-2026-112398Critical· 9.8PoCPillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
CVE-2026-57117High· 8.8PoCPraisonAI: Compute-bridged file tools allow shell command injection
PraisonAI is a multi-agent teams system. From version 4.6.10 to before version 4.6.59, LocalManagedAgent / SandboxedAgent compute bridging wraps read_file, list_files, and write_file when a compute provider is attached. The bridge conver…
CVE-2026-56838High· 7.8PoCPraisonAI recipe.run_stream skips dangerous-tool policy enforcement
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.59, PraisonAI recipe execution blocks default-denied dangerous tools unless the caller explicitly passes allow_dangerous_tools=True. The normal recipe.run…
CVE-2026-57114High· 7.2PoCPraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding
PraisonAI is a multi-agent teams system. From version 4.5.126 to before version 4.6.59, PraisonAI's Async Jobs API validates webhook_url when a job request is parsed and again when the internal Job object is constructed. That validation …
CVE-2026-57121High· 8.1PraisonAI: Missing ownership check on DELETE endpoints allows members to delete others' content in Platform API
PraisonAI is a multi-agent teams system. From version 0.1.4 to before version 0.1.5 in praisonai-platform, a workspace member can permanently delete any resource — projects, agents, issues, labels, issue dependencies, and issue-label att…
CVE-2026-56835High· 8.3PoCPraisonAI Slack app_mention bypasses configured user/channel authorization
PraisonAI is a multi-agent teams system. From version 3.11.0 to before version 4.6.59, PraisonAI's Slack bot applies its configured allowed_users, allowed_channels, and unknown-user pairing policy in the normal Slack message event handle…
CVE-2026-57146High· 7.5PoCPraisonAI A2U incomplete authentication fix leaves current serve command unauthenticated by default
PraisonAI is a multi-agent teams system. From version 4.5.115 to before version 4.6.61, the published A2U advisory GHSA-f292-66h9-fpmf says unauthenticated A2U event streaming was fixed in praisonai 4.5.115. Current head still exposes th…
CVE-2026-56834High· 7.5PoCPraisonAI dynamic-context artifact tools read arbitrary host files outside artifact storage
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context Discovery feature exposes artifact helper tools through ctx.get_tools(). The implemented artifact tools do not enforce that…
CVE-2026-56837High· 8.6PraisonAI LinearBot processes unsigned webhooks when LINEAR_WEBHOOK_SECRET is missing
PraisonAI is a multi-agent teams system. From version 4.6.56 to before version 4.6.59, PraisonAI's LinearBot starts a public webhook listener on 0.0.0.0 and treats LINEAR_WEBHOOK_SECRET as optional. When the secret is absent, startup onl…
CVE-2026-57113High· 8.1PraisonAI GitHub template cache path traversal allows outside-cache file write and directory deletion
PraisonAI is a multi-agent teams system. From version 2.6.0 to before version 4.6.59, PraisonAI's template loader accepts GitHub template URIs with refs, for example github:owner/repo/[email protected]. The resolver stores the user-control…
CVE-2026-57116Critical· 9.8PoCPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation
PraisonAI is a multi-agent teams system. From version 4.2.1 to before version 4.6.59, PraisonAI's AgentOS FastAPI deployment surface remains unauthenticated in current main and in releases after the published patched version for GHSA-pm9…
CVE-2026-56832High· 8.8PoCPraisonAI DiscordApproval accepts unrelated channel messages as dangerous-tool approvals
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.DiscordApproval approves a pending dangerous tool call when it sees any later non-bot message in the configured Discord channel whose te…
CVE-2026-57142High· 7.8PoCPraisonAI recipe workflow policy can be bypassed by declaring and YAML-approving dangerous tools outside TEMPLATE.yaml
PraisonAI is a multi-agent teams system. From version 4.5.87 to before version 4.6.61, PraisonAI recipe execution has a dangerous-tool policy that is supposed to block default-denied tools unless the caller explicitly passes allow_danger…
CVE-2026-57144High· 8.8PoCPraisonAI SandlockSandbox falls back to unrestricted subprocess execution when Landlock is unavailable
PraisonAI is a multi-agent teams system. From version 4.5.110 to before version 4.6.61, praisonai.sandbox.SandlockSandbox is documented and implemented as the kernel-enforced sandbox backend for untrusted code. Its SandboxConfig.native()…
CVE-2026-56840High· 8.8PoCPraisonAI: HTTPApproval dashboard renders tool arguments as raw HTML, allowing approval-page XSS to approve dangerous tools
PraisonAI is a multi-agent teams system. From version 4.5.2 to before version 4.6.59, praisonai.bots.HTTPApproval renders pending tool approval arguments directly into the approval dashboard HTML. An attacker-controlled tool argument can…
CVE-2026-56836High· 8.2PoCPraisonAI recipe serve Typer command bypasses the non-localhost authentication guard
PraisonAI is a multi-agent teams system. From version 4.5.112 to before version 4.6.59, PraisonAI's installed console entrypoint is Typer-first. In current releases, the recipe command is registered in the Typer app and praisonai recipe …
CVE-2026-56833High· 7.5PraisonAI Dynamic Context history and terminal tools read files outside configured storage via path traversal
PraisonAI is a multi-agent teams system. From version 3.8.1 to before version 4.6.59, PraisonAI's Dynamic Context module provides filesystem-backed history and terminal-log storage. The module also exports agent-callable tool factories. …
CVE-2026-54711Low· 2.4PGHoard: Password written to debug log
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.1, when using .pgpass, database connection information including the username and password will be logged at t…
GHSA-8cqv-vvq2-6p8cHigh· 7.5Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive
Duplicate Advisory: Mistune: Path Traversal and XSS in Include directive