Tagged “pip”
CVEs tagged pip, newest first.
5541 CVEsRSS
MAL-2026-5518NoneMalicious code in hello-dynamic (PyPI)
Malicious code in hello-dynamic (PyPI)
MAL-2026-5519NoneMalicious code in requests-toolbelt-plus (PyPI)
Malicious code in requests-toolbelt-plus (PyPI)
CVE-2026-47734Medium· 6.5dulwich: Dulwich: Denial of Service via crafted Git thin pack (CVE-2026-47734)
A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. A remote attacker with push access to a Dulwich-based Git server could send a specially crafted thin pack. This crafted pack, with a manipulated d…
CVE-2026-48060High· 8.1PoCLitestar has HTML Injection Through its CSRF Token
Litestar has HTML Injection Through its CSRF Token
CVE-2026-52726Medium· 5.4⚖ disputeddulwich: Dulwich: Arbitrary code execution via crafted Git submodules (CVE-2026-52726)
A flaw was found in Dulwich, a pure-Python implementation of Git file formats and protocols. This vulnerability allows a remote attacker to achieve arbitrary code execution by crafting a malicious Git submodule. When a user clones or updat…
CVE-2026-52902Medium· 4.7Awxkit: path traversal via yaml !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML !include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the lo…
CVE-2026-49818Medium· 6.5Apache Airflow has a Path Traversal issue
Apache Airflow has a Path Traversal issue
MAL-2026-5345NoneMalicious code in dstill (PyPI)
Malicious code in dstill (PyPI)
CVE-2026-11466Medium· 5.4zilliztech deep-searcher has an Incorrect Privilege Assignment issue
zilliztech deep-searcher has an Incorrect Privilege Assignment issue
MAL-2026-5334NoneMalicious code in spaysrbx (PyPI)
Malicious code in spaysrbx (PyPI)
MAL-2026-5329NoneMalicious code in spaysdatarbx (PyPI)
Malicious code in spaysdatarbx (PyPI)
CVE-2026-11529Medium· 6.3MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler
MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI Handler
MAL-2026-5330NoneMalicious code in bittensor-burn-alert (PyPI)
Malicious code in bittensor-burn-alert (PyPI)
MAL-2026-5335NoneMalicious code in xfoobar (PyPI)
Malicious code in xfoobar (PyPI)
MAL-2026-5332NoneMalicious code in xforpy (PyPI)
Malicious code in xforpy (PyPI)
MAL-2026-5305NoneMalicious code in tlask (PyPI)
Malicious code in tlask (PyPI)
MAL-2026-5304NoneMalicious code in rsquests (PyPI)
Malicious code in rsquests (PyPI)
MAL-2026-5303NoneMalicious code in rlask (PyPI)
Malicious code in rlask (PyPI)
MAL-2026-5302NoneMalicious code in nhmpy (PyPI)
Malicious code in nhmpy (PyPI)
MAL-2026-5367NoneMalicious code in odoo-addon-spp-base (PyPI)
Malicious code in odoo-addon-spp-base (PyPI)
MAL-2026-5333NoneMalicious code in nerfstudio-gs (PyPI)
Malicious code in nerfstudio-gs (PyPI)
MAL-2026-5326NoneMalicious code in tiktoken-mcp (PyPI)
Malicious code in tiktoken-mcp (PyPI)
MAL-2026-5320NoneMalicious code in openai-mcp (PyPI)
Malicious code in openai-mcp (PyPI)
CVE-2026-41479Medium· 5.4Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_type
CVE-2026-47712Low· 3.3Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`
MAL-2026-5323NoneMalicious code in ppkt2synergy (PyPI)
Malicious code in ppkt2synergy (PyPI)
MAL-2026-5314NoneMalicious code in embiggen (PyPI)
Malicious code in embiggen (PyPI)
MAL-2026-5300NoneMalicious code in funcdesc (PyPI)
Malicious code in funcdesc (PyPI)
MAL-2026-5296NoneMalicious code in magique (PyPI)
Malicious code in magique (PyPI)
MAL-2026-5294NoneMalicious code in magique-ai (PyPI)
Malicious code in magique-ai (PyPI)