Tagged “pip”

CVEs tagged pip, newest first.

4537 CVEsRSS

MAL-2026-16346Critical⚠ Exploited

today

Malicious code in rrs (PyPI)

▾ Abyssalrrs · rrsvia OSV

CVE-2026-55074High· 8.2

today

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec. Through version 1.3.0, the jailexec connection plugin's put_file resolved a transfer's destination to a path on the jail host ( + ) and r…

▾ Twilightchofstede · ansible_jailexecvia NVD

CVE-2026-55071High· 8.4PoC

today

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design. Prior to version 1.19.0, the ado_package_install MCP tool in stata-mcp concatenates user-controlled input directly into a Stata command stri…

▾ MidnightSepineTam · mcp-for-statavia NVD

MAL-2026-16298Critical⚠ Exploited

2d ago

Malicious code in urc (PyPI)

▾ Abyssalurc · urcvia OSV

MAL-2026-16296Critical⚠ Exploited

3d ago

Malicious code in py-venv-doctor (PyPI)

▾ Abyssalpy-venv-doctor · py-venv-doctorvia OSV

CVE-2026-59163Critical· 9.1PoC

3d ago

Mnemosyne is a memory layer for artificial intelligence agents

Mnemosyne is a memory layer for artificial intelligence agents. Prior to v3.10.1, the auth check in mnemosyne/core/sync_server.py parsed the JWT's header and payload using base64 decoding, then passed the token to a jwt library call with…

▾ Abyssalmnemosyne-memory · mnemosyne-memoryEPSS 0.25%via NVD

CVE-2025-66455Critical· 9.8

3d ago

LMDeploy is a toolkit for compressing, deploying, and serving large language models

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Starting in version 0.9.2 and prior to version 0.16.0, LMDeploy's PyTorch DistServe/PD-disaggregation control plane used `recv_pyobj()` to deserialize m…

▾ MidnightInternLM · lmdeployEPSS 0.70%via NVD

GHSA-39wr-7q6h-cf68High· 7.5

3d ago

LMDeploy has an SSRF bypass

▾ Twilightlmdeploy · lmdeployvia OSV

CVE-2026-33625High· 8.8

3d ago

LMDeploy is a toolkit for compressing, deploying, and serving large language models

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in `lmdeploy/pytorch/config.py` line 620 that allows an attacker to execute arbitra…

▾ TwilightInternLM · lmdeployEPSS 0.24%via NVD

CVE-2026-64847Medium· 6.8

3d ago

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. Prior to 4.14.2, AnyIO starts process-pool workers with standard error connected to a pipe that the parent never drains,…

▾ Sunlitagronholm · anyioEPSS 0.12%via NVD

CVE-2026-63374Critical

3d ago

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

▾ Midnightanyio · anyiovia OSV

CVE-2026-63349High· 7.0

3d ago

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extra_groups argument in anyio.run_process() and anyio.open_process(), but open_proce…

Tagged “pip”

Malicious code in rrs (PyPI)

Ansible FreeBSD Jail Connection Plugin is an Ansible connection plugin for FreeBSD Jails via jexec

MCP-for-Stata is a MCP server for integrating Stata into agent loops with a safety-first design

Malicious code in urc (PyPI)

Malicious code in py-venv-doctor (PyPI)

Mnemosyne is a memory layer for artificial intelligence agents

LMDeploy is a toolkit for compressing, deploying, and serving large language models

LMDeploy has an SSRF bypass

LMDeploy is a toolkit for compressing, deploying, and serving large language models

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

AnyIO: TLSStream IDNA 2003 host name encoding enables potential TLS certificate spoofing

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio

Malicious code in requests-triwes (PyPI)

Malicious code in requests-auroras (PyPI)

Malicious code in requests-asetwe (PyPI)

Malicious code in index-forum (PyPI)

Malicious code in pyjstat-smooth (PyPI)

Malicious code in aiosendletter (PyPI)

djust: A template binding inherits a context safety grant it never earned (XSS)

djust: Six template-layer defects emit attacker-controlled markup unescaped (XSS)

Jupyter Server is the backend for Jupyter web applications

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4

Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4

Malicious code in marketing-mcp (PyPI)

Sanic is an opensource python web server/framework

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing

Kiwi TCMS is an open source test management system

Malicious code in trongappy (PyPI)

Malicious code in rak-lab-yoav-orca-zrktd2cp5hjmo4x7 (PyPI)

Malicious code in praetorian-mind-rce-test-2026 (PyPI)