1274 matches found
CVE-2026-41391 OpenClaw < 2026.3.31 - Environment Variable Bypass in Package Index URL Handling
OpenClaw before 2026.3.31 fails to properly sanitize PIPINDEXURL and UVINDEXURL environment variables in host execution contexts, allowing attackers to redirect Python package-index traffic. Attackers can exploit this bypass to intercept or manipulate package management operations by injecting...
Linux Distros Unpatched Vulnerability : CVE-2026-6357
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These...
OPENSUSE-SU-2026:10645-1 python311-pip-26.1-1.1 on GA media
These are all security issues fixed in the python311-pip-26.1-1.1 package on the GA media of openSUSE Tumbleweed...
Arbitrary Code Injection
Overview Affected versions of this package are vulnerable to Arbitrary Code Injection in the self-version check logic. An attacker can achieve arbitrary code execution by overwriting pip’s modules during a pip install operation, which are later imported at the end of command execution for the...
aaanalysis (>=0.1.2 <=1.0.2), aadetools (>=0.0.3 <=0.0.5) +582 more potentially affected by CVE-2026-6357 via pip (>=10.0.0b2 <=26.0.1)
pip PYPI version =10.0.0b2, =0.1.2, =0.0.3, =0.5.14, =0.1.1, =2.0.0, =0.2.1, =0.1.2, =0.0.1, =0.1.0, =0.1.10, =0.2.0, =0.68.0, =1.8.15, =1.8.17, =1.8.19 and more Source cves: CVE-2026-6357 Source advisory: OSV:GHSA-JP4C-XJXW-MGF9...
GHSA-JP4C-XJXW-MGF9 pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
CVE-2026-6357
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
UBUNTU-CVE-2026-6357
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
CVE-2026-6357 pip self-update functionality can import newly installed modules after wheel installation
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
CVE-2026-6357
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
CVE-2026-6357
CVE-2026-6357 affects pip prior to 26.1, where a self-update check would run after wheel installation and could import recently installed Python modules. The root cause is that imports of certain well-known module names were deferred to speed up CLI startup, allowing a wheel install to trigger im...
CVE-2026-6357
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
CVE-2026-6357 pip self-update functionality can import newly installed modules after wheel installation
pip prior to version 26.1 would run self-update check functionality after installing wheel files which required importing well-known Python modules names. These module imports were intentionally deferred to increase startup time of the pip CLI. The patch changes self-update functionality to run...
CVE-2026-3219 vulnerabilities
Vulnerabilities for packages: pypy-3.11, request-1276, datadog-agent, tensorflow-cpu-jupyter, nemo, nvidia-nsight-compute-13.2, kubeflow-katib, datadog-agent-fips, localstack, py3-virtualenv, py3.14-virtualenv, py3-pip-wheel-bootstrap, py3-cassandra-medusa, azureml-inference-server-http,...
GHSA-58QW-9MGM-455V vulnerabilities
Vulnerabilities for packages: pypy-3.11, request-1276, datadog-agent, tensorflow-cpu-jupyter, nemo, nvidia-nsight-compute-13.2, kubeflow-katib, datadog-agent-fips, localstack, py3-virtualenv, py3.14-virtualenv, py3-pip-wheel-bootstrap, py3-cassandra-medusa, azureml-inference-server-http,...
CVE-2026-3219 vulnerabilities
Vulnerabilities for packages: pypy-3.11, datadog-agent, py3-pip-wheel-bootstrap, py3-cassandra-medusa, py3-virtualenv, py3-pip, pypy-3.10, kubeflow-katib, py3.14-virtualenv, tensorflow-cpu-jupyter...
pip 安全漏洞
pip is a Python package installer developed by the Python Packaging Authority. Versions of pip prior to 26.1 contained security vulnerabilities. These vulnerabilities stemmed from the self-update check feature, which ran after the installation of wheel files, potentially leading to the import of...
PT-2026-35435
Name of the Vulnerable Software and Affected Versions pip versions prior to 26.1 Description The self-update check functionality runs after installing wheel files, which requires importing well-known Python module names. These imports were deferred to improve the startup time of the pip CLI. This...
CVE-2026-3219
A flaw was found in pip. This vulnerability occurs because pip incorrectly processes concatenated tar and ZIP files as ZIP files, regardless of their true format. This improper handling can lead to confusing installation behavior, potentially causing the installation of unintended or 'incorrect'...
pip doesn't reject concatenated ZIP and tar archives
...