Tagged “pip”
CVEs tagged pip, newest first.
5512 CVEsRSS
MAL-2026-18166Critical⚠ ExploitedMalicious code in speakbench (PyPI)
Malicious code in speakbench (PyPI)
MAL-2026-18165Critical⚠ ExploitedMalicious code in soundsocket (PyPI)
Malicious code in soundsocket (PyPI)
MAL-2026-18164Critical⚠ ExploitedMalicious code in phonemeprobe (PyPI)
Malicious code in phonemeprobe (PyPI)
MAL-2026-18163Critical⚠ ExploitedMalicious code in phonemeforge (PyPI)
Malicious code in phonemeforge (PyPI)
MAL-2026-18162Critical⚠ ExploitedMalicious code in modelworks (PyPI)
Malicious code in modelworks (PyPI)
MAL-2026-18161Critical⚠ ExploitedMalicious code in evalstream (PyPI)
Malicious code in evalstream (PyPI)
MAL-2026-18160Critical⚠ ExploitedMalicious code in benchworks (PyPI)
Malicious code in benchworks (PyPI)
MAL-2026-18159Critical⚠ ExploitedMalicious code in benchbridge (PyPI)
Malicious code in benchbridge (PyPI)
MAL-2026-18158Critical⚠ ExploitedMalicious code in audiokit (PyPI)
Malicious code in audiokit (PyPI)
MAL-2026-18157Critical⚠ ExploitedMalicious code in asrloom (PyPI)
Malicious code in asrloom (PyPI)
MAL-2026-18156Critical⚠ ExploitedMalicious code in asrdock (PyPI)
Malicious code in asrdock (PyPI)
MAL-2026-18155Critical⚠ ExploitedMalicious code in acoustichub (PyPI)
Malicious code in acoustichub (PyPI)
MAL-2026-18154Critical⚠ ExploitedMalicious code in pipegrip (PyPI)
Malicious code in pipegrip (PyPI)
MAL-2026-18153Critical⚠ ExploitedMalicious code in hookgantry (PyPI)
Malicious code in hookgantry (PyPI)
MAL-2026-18152Critical⚠ ExploitedMalicious code in acousticpack (PyPI)
Malicious code in acousticpack (PyPI)
CVE-2026-115324High· 8.1mem0 0.1.117 before 1.0.8 SQL Injection via Databricks Vector Store
mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows attackers to inject SQL by influencing stored memory content. Attackers can supply crafted memory text, metadata, or messag…
CVE-2026-96637High· 6.5Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
Pillow: Decompression bomb check bypass in SpiderImagePlugin.seek() leads to unbounded allocation DoS
CVE-2026-96640High· 8.2PoCPillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
CVE-2026-96639Critical· 9.8Pillow multi-frame loaders can reuse stale native image storage after mode transitions
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
CVE-2026-96638Medium· 6.5Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
Pillow: BMP RLE decoder memory-amplification DoS via unbounded delta escape / absolute mode
CVE-2026-96641Medium· 6.5PoCPillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
Pillow: Reachable undefined behavior in native integer operations, potentially leading to denial of service or logic integrity compromise
CVE-2026-96644High· 8.1PoCPillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
CVE-2026-96643High· 6.5Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
CVE-2026-96778High· 7.7PoCPillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
CVE-2026-113721Medium· 4.5virtualenv: Generated files can follow existing destination links
virtualenv: Generated files can follow existing destination links
GHSA-f623-hjm8-5wg5Critical· 8.1Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
Duplicate Advisory: vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
GHSA-hfwf-hgvp-4rr8High· 7.5Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization
Duplicate Advisory: vLLM vulnerable to remote denial of service through forged multimodal UUID cache desynchronization
GHSA-m3wx-qqmx-qxvfHigh· 5.3Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
GHSA-3cgq-c484-rx5jHigh· 7.5Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
Duplicate Advisory: vLLM 0.7.3 before 0.31.0 DoS via Unvalidated mm_processor_kwargs
MAL-2026-18151Critical⚠ ExploitedMalicious code in zennittts (PyPI)
Malicious code in zennittts (PyPI)