PYSEC-2026-2387 AWS Encryption SDK for Python: Key commitment policy bypass via shared key cache

Summary AWS Encryption SDK ESDK for Python is a client-side encryption library. An issue exists where, under certain circumstances, a specific cryptographic algorithm downgrade in the caching layer might allow an authenticated local threat actor to bypass key commitment policy enforcement via a...

pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...

python-dev-tools (>=2019.7.25, <=2019.8.8) potentially affected by CVE-2026-6357 via pip (19.2.1)

pip PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.7.25, =2019.8.8 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

python-dev-tools (>=2019.8.14, <=2019.8.24) potentially affected by CVE-2026-6357 via pip (19.2.2)

pip PYPI version 19.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.8.14, =2019.8.24 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

datanator-query-python (0.6.2), light-the-torch (>=0.5.0rc0, <=0.5.0) potentially affected by CVE-2026-6357 via pip (22.3.0)

pip PYPI version 22.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - datanator-query-python 0.6.2 - light-the-torch =0.5.0rc0, =0.5.0 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

codecraft-chat (>=0.82.4.dev64, <=0.82.4.dev69), cryptobot-python (0.1.9) +2 more potentially affected by CVE-2026-6357 via pip (25.1.0)

pip PYPI version 25.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - codecraft-chat =0.82.4.dev64, =0.0.21, =0.2.8 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

aider-chat (>=0.73.0, <=0.74.2), contextualize (>=0.0.4, <=0.0.5) +2 more potentially affected by CVE-2026-6357 via pip (25.0.0)

pip PYPI version 25.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - aider-chat =0.73.0, =0.0.4, =0.1.7, =0.1.8 - opentips 1.0.0 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

cryptobot-python (0.1.5), ops-py-azure-key-vault-alert (>=7.0.0, <=7.0.1) +2 more potentially affected by CVE-2026-6357 via pip (24.1.0)

pip PYPI version 24.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cryptobot-python 0.1.5 - ops-py-azure-key-vault-alert =7.0.0, =1.3.1, =2.0.1 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

PYSEC-2026-2876 pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...

notebooktoall (>=0.1.7, <=0.2.0), python-dev-tools (>=2019.2.25, <=2019.3.1) potentially affected by CVE-2026-6357 via pip (19.0.2)

pip PYPI version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - notebooktoall =0.1.7, =2019.2.25, =2019.3.1 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

python-dev-tools (>=2019.4.24, <=2019.5.3) potentially affected by CVE-2026-6357 via pip (19.1.0)

pip PYPI version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.4.24, =2019.5.3 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

python-dev-tools (>=2019.4.24, <=2019.5.3) potentially affected by CVE-2026-3219 via pip (19.1.0)

pip PYPI version 19.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.4.24, =2019.5.3 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

notebooktoall (>=0.1.7, <=0.2.0), python-dev-tools (>=2019.2.25, <=2019.3.1) potentially affected by CVE-2026-3219 via pip (19.0.2)

pip PYPI version 19.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - notebooktoall =0.1.7, =2019.2.25, =2019.3.1 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

datanator-query-python (0.6.2), light-the-torch (>=0.5.0rc0, <=0.5.0) potentially affected by CVE-2026-3219 via pip (22.3.0)

pip PYPI version 22.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - datanator-query-python 0.6.2 - light-the-torch =0.5.0rc0, =0.5.0 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

cryptobot-python (0.1.5), ops-py-azure-key-vault-alert (>=7.0.0, <=7.0.1) +2 more potentially affected by CVE-2026-3219 via pip (24.1.0)

pip PYPI version 24.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - cryptobot-python 0.1.5 - ops-py-azure-key-vault-alert =7.0.0, =1.3.1, =2.0.1 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

python-dev-tools (>=2019.8.14, <=2019.8.24) potentially affected by CVE-2026-3219 via pip (19.2.2)

pip PYPI version 19.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.8.14, =2019.8.24 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

codecraft-chat (>=0.82.4.dev64, <=0.82.4.dev69), cryptobot-python (0.1.9) +2 more potentially affected by CVE-2026-3219 via pip (25.1.0)

pip PYPI version 25.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - codecraft-chat =0.82.4.dev64, =0.0.21, =0.2.8 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

python-dev-tools (>=2019.7.25, <=2019.8.8) potentially affected by CVE-2026-3219 via pip (19.2.1)

pip PYPI version 19.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - python-dev-tools =2019.7.25, =2019.8.8 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

PYSEC-2026-2890 Poetry has Path Traversal in tar extraction on Python 3.10.0 - 3.10.12 and 3.11.0 - 3.11.4

Summary The extractall function in src/poetry/utils/helpers.py:410-426 extracts sdist tarballs without path traversal protection on Python versions where tarfile.datafilter is unavailable. Considering only Python versions which are still supported by Poetry, these are 3.10.0 - 3.10.12 and 3.11.0 ...

ddaemon-core-python (0.5.1), doopass (>=2.7.0, <=2.9.0) +4 more potentially affected by CVE-2026-41140 via poetry (1.8.3)

poetry PYPI version 1.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on poetry and may be impacted: - ddaemon-core-python 0.5.1 - doopass =2.7.0, =3.0.0.0a0, =0.2.0.1, =0.2.1.0 - reqstool-python-poetry-plugin 0.0.4 Source cves: CVE-2026-41140 Source...