[SECURITY] Fedora 42 Update: uv-0.11.11-1.fc42

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

[SECURITY] Fedora 44 Update: uv-0.11.11-1.fc44

An extremely fast Python package and project manager, written in Rust. Highlights: =E2=80=A2 A single tool to replace pip, pip-tools, pipx, poetry, pyenv, twi ne, virtualenv, and more. =E2=80=A2 10-100x faster than pip. =E2=80=A2 Provides comprehensive project management, with a universal lockf...

Fedora 44 : pypy (2026-130f7539d3)

The remote Fedora 44 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-130f7539d3 advisory. Security fix for CVE-2026-3219 in the bundled pip wheel Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Amazon Linux 2023 : python3-pip, python3-pip-wheel (ALAS2023-2026-1689)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1689 advisory. pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferr...

Fedora 43 : pypy (2026-3505a95524)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-3505a95524 advisory. Security fix for CVE-2026-3219 in the bundled pip wheel Tenable has extracted the preceding description block directly from the Fedora security advisory. Not...

Malicious code in always-updates (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dee16a964c16035579f7be2f965a801f87876080603f389e1e75ec3073bd5c2c The package's sole advertised CLI aupd, registered as a consolescripts entry point to alwaysupdates.main:main executes...

GHSA-QCCP-GFCP-XXVC vulnerabilities

Vulnerabilities for packages: wazuh-manager-fips, tensorflow-cpu-jupyter, aws-cli, py3-hashin, pypy-3.11, gitlab-cng, graalvm, kubeflow-pipelines, tritonserver-backend-vllm-cuda-12.9, airflow-core, confluent-docker-utils, label-studio, azureml-inference-server-http, dbt-core, ansible-operator,...

CVE-2026-44431 vulnerabilities

Vulnerabilities for packages: wazuh-manager-fips, tensorflow-cpu-jupyter, aws-cli, py3-hashin, pypy-3.11, gitlab-cng, graalvm, kubeflow-pipelines, tritonserver-backend-vllm-cuda-12.9, airflow-core, confluent-docker-utils, label-studio, azureml-inference-server-http, dbt-core, ansible-operator,...

Fedora 45 : pypy (2026-b58cd376d6)

The remote Fedora 45 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-b58cd376d6 advisory. Automatic update for pypy-7.3.22-2.fc45. Changelog Tue May 5 2026 Charalampos Stratakis - 7.3.22-2 - Security fix for CVE-2026-3219 in the bundled pip wheel ...

CVE-2026-6357 vulnerabilities

Vulnerabilities for packages: py3-pip, py3.14-virtualenv, py3-cassandra-medusa, pypy-3.10, py3-virtualenv, datadog-agent, kubeflow-katib...

GHSA-JP4C-XJXW-MGF9 vulnerabilities

Vulnerabilities for packages: py3-pip, py3.14-virtualenv, py3-cassandra-medusa, pypy-3.10, py3-virtualenv, datadog-agent, kubeflow-katib...

CVE-2026-6357 vulnerabilities

Vulnerabilities for packages: datadog-agent, tensorflow-cpu-jupyter, nvidia-nsight-compute-13.1, localstack, kubeflow-katib, py3-hashin, py3-virtualenv, py3-pip, py3.14-virtualenv, graalvm, ansible-operator-fips, py3-cassandra-medusa, pypy-3.10, nemo, ansible-operator, nvidia-nsight-compute-13.2,...

GHSA-JP4C-XJXW-MGF9 vulnerabilities

Vulnerabilities for packages: datadog-agent, tensorflow-cpu-jupyter, nvidia-nsight-compute-13.1, localstack, kubeflow-katib, py3-hashin, py3-virtualenv, py3-pip, py3.14-virtualenv, graalvm, ansible-operator-fips, py3-cassandra-medusa, pypy-3.10, nemo, ansible-operator, nvidia-nsight-compute-13.2,...

groovestrike

GrooveStrike Autonomous Penetration Testing Framework...

CVE-2026-6357

A flaw was found in pip. Prior to version 26.1, pip's self-update check functionality would execute after installing wheel packages. This process involved importing newly installed Python modules. A malicious actor could craft a specially designed wheel package that, when installed, could lead to...

Important Photon OS Security Update - PHSA-2026-4.0-1008

Updates of 'linux', 'python3-pip', 'cups' packages of Photon OS have been released...

Important Photon OS Security Update - PHSA-2026-5.0-0840

Updates of 'python3-pip' packages of Photon OS have been released...

pip self-update functionality can import newly installed modules after wheel installation

...

Amazon Linux 2 : python-pip, --advisory ALAS2-2026-3256 (ALAS-2026-3256)

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2026-3256 advisory. When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation director...

Low: python-pip

Issue Overview: When pip is installing and extracting a maliciously crafted wheel archive, files may be extracted outside the installation directory. The path traversal is limited to prefixes of the installation directory, thus isn't able to inject or overwrite executable files in typical...