Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
CVE-2026-58501Medium· 5.9Zeep: Server-Side Request Forgery (SSRF)
Zeep: Server-Side Request Forgery (SSRF)
CVE-2026-59152High· 7.7LangSmith SDK TracingMiddleware: Arbitrary server-side file read
LangSmith SDK TracingMiddleware: Arbitrary server-side file read
CVE-2026-58266Medium· 6.5Anki: User scripts in iframes have access to the internal Anki API
Anki: User scripts in iframes have access to the internal Anki API
CVE-2026-59153HighAnki's local HTTP server does not sufficiently validate requests
Anki's local HTTP server does not sufficiently validate requests
GHSA-fwh2-95jw-g4j6High· 8.8Duplicate Advisory: PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling
Duplicate Advisory: PraisonAI has Memory State Leakage and Path Traversal in MultiAgent Context Handling
GHSA-x44p-gg67-52fcMedium· 5.5Duplicate Advisory: PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands
Duplicate Advisory: PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands
CVE-2026-12530High· 7.3Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
Improper neutralization of argument delimiters in AWS Bedrock AgentCore Python SDK install_packages()
GHSA-wg5p-8h9p-3mr7High· 8.6agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
agent-coderag: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution
GHSA-vmhf-c436-hxj4MediumJupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
JupyterLab: Stored XSS in extension manager through package metadata unsanitized URI protocol
GHSA-jv2h-4p9v-wf5wHighouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
ouroboros-ai: Incomplete fix of CVE-2026-47211: untrusted project .env can still reach RCE via omitted execution-routing keys
CVE-2026-23879High· 8.0py7zr: Arbitrary File Write Vulnerability
py7zr: Arbitrary File Write Vulnerability
CVE-2026-54317High· 7.6Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
Home Assistant: Konnected alarm-panel switch state and zone topology disclosed to unauthenticated actors on the LAN
CVE-2026-54499High· 7.5Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
Stanza: Remote Code Execution via Unsafe Pickle Deserialization in Model Loaders
CVE-2026-54528High· 7.1jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
jupyterlab-git excluded_paths Case-Sensitivity Bypass Allows Reading Excluded Directories
CVE-2026-55865MediumPython Liquid: Infinite loop when parsing malformed `{% case %}` tags
Python Liquid: Infinite loop when parsing malformed `{% case %}` tags
CVE-2026-54911Medium· 6.5UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
UltraJSON: Malformed/Truncated UTF-8 Accepted and Silently Rewritten in ujson.dumps()
GHSA-8823-qg2x-pv9fHigh· 7.5Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
Ultimate Sitemap Parser (USP): Gzip Decompression Bomb Bypasses Sitemap Size Limit
GHSA-p5wc-9w9r-m232High· 7.5Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
Ultimate Sitemap Parser (USP): XML Entity Expansion (Billion Laughs) DoS in XMLSitemapParser
GHSA-rpj2-4hq8-938gHigh· 7.8VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files
VCR.py: Arbitrary code execution via unsafe YAML deserialization of cassette files
CVE-2026-55195Mediumpy7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
py7zr: Decompression bomb (zip bomb) denial of service via unchecked extraction size
CVE-2026-55206Mediumpy7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()
CVE-2026-55423Medium· 6.1Langflow: Logout button does not clear session
Langflow: Logout button does not clear session
CVE-2026-55446High· 7.5Langflow: Unauthenticated DoS through multipart form boundary file upload
Langflow: Unauthenticated DoS through multipart form boundary file upload
CVE-2026-55447Critical· 9.6Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit
GHSA-6v7p-g79w-8964High· 7.5MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
GHSA-x26h-xmv8-gxf7Highstigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)
GHSA-xhv3-q4xx-349rHighstistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)
GHSA-6gqw-jqv7-v88mHighstigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)
GHSA-c795-2g9c-j48mHigh· 8.2EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id
GHSA-wvrh-2f4m-924vMedium· 5.5ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer
ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer