9469 matches found
ROOT-APP-PYPI-CVE-2024-5569 CVE-2024-5569 in zipp - Patched by Root
Root has patched CVE-2024-5569 in the zipp package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-24049 CVE-2026-24049 in setuptools - Patched by Root
Root has patched CVE-2026-24049 in the setuptools package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-6V7P-G79W-8964 GHSA-6v7p-g79w-8964 in msgpack - Patched by Root
Root has patched GHSA-6v7p-g79w-8964 in the msgpack package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-31958 CVE-2026-31958 in tornado - Patched by Root
Root has patched CVE-2026-31958 in the tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-67221 CVE-2025-67221 in orjson - Patched by Root
Root has patched CVE-2025-67221 in the orjson package for Root:PyPI. Multiple fixed versions available...
CVE-2026-54580 mport index decompression can leave partial or corrupt index data after zstd failures
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/util.c did not make every truncated, corrupt, or failed zstd stream fatal in mportdecompresszstd, and libmport/fetch.c did not consistently propagate those failures to index-fetch callers. A malicious or faulty mirror could supply...
ROOT-APP-PYPI-GHSA-GR75-JV2W-4656 GHSA-gr75-jv2w-4656 in langchain - Patched by Root
Root has patched GHSA-gr75-jv2w-4656 in the langchain package for Root:PyPI. Multiple fixed versions available...
CVE-2026-54581: Insufficient Verification of Data Authenticity
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the mportfetchbootstrapindex function in libmport/fetch.c could return success when bootstrap index hash verification encountered a missing or invalid hash because the failure path did not preserve a fatal result. A network attacker or...
CVE-2026-54583: Improper Limitation of a Pathname to a Restricted Directory
mport is the MidnightBSD Package Manager. Prior to 2.7.8, libmport/fetch.c did not consistently reject empty, dot, dot-dot, or slash-containing bundle filenames before composing package download and write paths. Malicious package index data could place an unsafe value in indexEntry-bundlefile, an...
OESA-2026-3788 python-pip security update
%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...
OESA-2026-3786 python-pip security update
%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...
OESA-2026-3785 python-pip security update
%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...
ROOT-APP-PYPI-CVE-2023-28370 CVE-2023-28370 in tornado - Patched by Root
Root has patched CVE-2023-28370 in the tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-GHSA-W235-7P84-XX57 GHSA-w235-7p84-xx57 in tornado - Patched by Root
Root has patched GHSA-w235-7p84-xx57 in the tornado package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-44307 CVE-2026-44307 in mako - Patched by Root
Root has patched CVE-2026-44307 in the mako package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-41066 CVE-2026-41066 in lxml - Patched by Root
Root has patched CVE-2026-41066 in the lxml package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2025-69277 CVE-2025-69277 in PyNaCl - Patched by Root
Root has patched CVE-2025-69277 in the PyNaCl package for Root:PyPI. Multiple fixed versions available...
ROOT-APP-PYPI-CVE-2026-59204 CVE-2026-59204 in pillow - Patched by Root
Root has patched CVE-2026-59204 in the pillow package for Root:PyPI. Multiple fixed versions available...