EUVD-2026-84010

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920

The Ajenti modular server admin panel (Linux & BSD) is vulnerable to local privilege escalation prior to version 2.2.16 . An authenticated user can call the /api/core/tasks/start endpoint to enqueue tasks like InstallPlugin , UnInstallPlugin , or UpgradeAll from plugins/plugins/tasks.py without t...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task

Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...

CLSA-2026-1788161320 TuxCare security update for pip (4 CVEs)

TuxCare rebuilt pip to address 4 CVEs. Fixed in 9.0.0.post2+tuxcare...

EulerOS Virtualization 2.10.0 : python-pip (EulerOS-SA-2026-3883)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...

EulerOS Virtualization 2.10.1 : python-pip (EulerOS-SA-2026-3849)

According to the versions of the python-pip packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to t...

PT-2026-105262

TuxCare rebuilt pip to address 4 CVEs. Fixed in 9.0.0.post2+tuxcare...

PT-2026-96164

Name of the Vulnerable Software and Affected Versions Ajenti versions prior to 2.2.16 Description Authenticated users can access the '/api/core/tasks/start' endpoint to enqueue the InstallPlugin, UnInstallPlugin, or UpgradeAll functions from 'plugins/plugins/tasks.py' without requiring...

SUSE SLES12: libpython2_7-1_0 / libpython2_7-1_0-32bit / python / python-32bit / etc (SUSE-SU-2026:4061-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4061-1 advisory. Security issues fixed: - CVE-2026-13346: pip: arbitrary file installation via malicious package indexes bsc1273091. Non security...

SUSE SLED15 / SLES15 Security Update : python313-pip (SUSE-SU-2026:4030-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4030-1 advisory. This update for python313-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package...

OESA-2026-3941 python-pip security update

%changelog Thu May 14 2026 markeryang [email protected] - 23.3.1-11 - Fix CVE-2026-3219 Security Fixes: pip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires...

CLEANSTART-2026-SY12835 Security fix for CVE-2025-47273 applied in: py3.11-pip 26.2-r1, python3 3.11.14-r0

CVE-2025-47273 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QQ77815 Security fix for CVE-2026-57585 applied in: airflow-3 3.1.8-r5, airflow-3 3.2.1-r5, apache-superset 5.0.0-r8, apache-superset 6.0.0-r6, miniforge3 26.1.0.0-r4, miniforge3 26.1.1.0-r3, miniforge3 26.3.2.0-r0, py3.11-pip 26.2-r1

CVE-2026-57585 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-OH23140 pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed o...

Multiple security vulnerabilities affect the python3 package. pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory. See...

Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

downloadwheel runs pip download and hands the result straight to theseeder, with nothing checking the bytes it gets back. The embedded pip andsetuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load,but a wheel fetched over the network for the periodic-update feature or...

PYSEC-2026-4011 Downloaded seed wheels (pip/setuptools) are not integrity-checked before use

downloadwheel runs pip download and hands the result straight to the seeder, with nothing checking the bytes it gets back. The embedded pip and setuptools wheels carry a BUNDLESHA256 that virtualenv checks on every load, but a wheel fetched over the network for the periodic-update feature or the...

PT-2026-102924

Name of the Vulnerable Software and Affected Versions virtualenv versions prior to 21.7.12 Description The download wheel function fails to verify the bytes of pip and setuptools seed wheels fetched during periodic updates or via the --download option against an authoritative digest, unlike the...

EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-3763)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...

EulerOS 2.0 SP10 : python-pip (EulerOS-SA-2026-3716)

According to the versions of the python-pip packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : pip would treat consolescripts and guiscripts as paths instead of file names without sanitizing the resolved absolute path to the installation...