Tagged “pip”

CVEs tagged pip, newest first.

4636 CVEsRSS

CVE-2026-78683Critical

2w ago

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

▾ Midnightnltk · nltkEPSS 0.51%via OSV

MAL-2026-16017Critical⚠ Exploited

3w ago

Malicious code in telegram-helper (PyPI)

▾ Abyssaltelegram-helper · telegram-helpervia OSV

MAL-2026-16016Critical⚠ Exploited

3w ago

Malicious code in cv-train (PyPI)

▾ Abyssalcv-train · cv-trainvia OSV

CVE-2026-86257Medium· 5.4PoC⚖ disputed

3w ago

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas. Attackers can inject formulas like =HYPERLINK to exfiltrate admin data or ex…

▾ Twilightwger-project · wgerEPSS 0.28%via NVD

CVE-2026-86256Medium· 5.4PoC

3w ago

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py)

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py). After a trainer enters impersonation mode, the view redirects to the user-supplied 'next' GET param…

▾ Twilightwger-project · wgerEPSS 0.23%via NVD

CVE-2026-86255Medium· 6.5

3w ago

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods. Attackers can trigger the date_sequence computation via routine detail endp…

▾ Sunlitwger · wgerEPSS 0.44%via NVD

MAL-2026-15938Critical⚠ Exploited

3w ago

Tagged “pip”

NLTK: Unsafe Pickle Deserialization in TransitionParser Allows Remote Code Execution

Malicious code in telegram-helper (PyPI)

Malicious code in cv-train (PyPI)

wger before 2.6 fails to sanitize first_name and last_name fields in the gym member TSV export endpoint, allowing any gym member to inject spreadsheet formulas

wger before 2.6 (affected versions <= 2.5.0) contains an open redirect vulnerability in the trainer_login view (wger/core/views/user.py)

wger before 2.5 fails to validate the maximum duration of routine date ranges, allowing authenticated users to create routines spanning arbitrarily long periods

Malicious code in dac-tools (PyPI)

Malicious code in minecraftmodes (PyPI)

Malicious code in trongridew (PyPI)

Malicious code in proxycer (PyPI)

Malicious code in dbt-sa-cli (PyPI)

Malicious code in tsshare (PyPI)

Malicious code in houdus (PyPI)

Malicious code in chartkit-core (PyPI)

Malicious code in metricboxlite (PyPI)

Malicious code in tpu-raiden-jax (PyPI)

Malicious code in pymaas (PyPI)

Malicious code in olympuslib (PyPI)

Malicious code in qoeoe (PyPI)

Malicious code in astlsi (PyPI)

Malicious code in timeweave (PyPI)

Malicious code in asti (PyPI)

Malicious code in uvhttp-custom (PyPI)

Malicious code in py-2equests (PyPI)

Malicious code in py-1requests (PyPI)

Malicious code in py-0requests (PyPI)

Malicious code in 0requests (PyPI)

Malicious code in trongridi (PyPI)

Malicious code in telemetry-helper (PyPI)

Malicious code in env-validator-tool (PyPI)