pypi records

16 published records for vendor pypi.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 0
With a fix record: 43.8%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

CWE-787 Out-of-bounds Write1

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

16 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
40Plan	CVE-2022-34056No exploit	The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package.pypi · watertools Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-32999No exploit	The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package.pypi · cloudlabeling Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-33001No exploit	The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package.pypi · aamiles Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-33002No exploit	The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package.pypi · explore Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-33003No exploit	The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package.pypi · watools Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-34053No exploit	The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package.pypi · dr-web-engine Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-34055No exploit	The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package.pypi · drxhello Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-32998No exploit	The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request packagepypi · cryptoasset-data-downloader Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-32996No exploit	The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package.pypi · django-navbar-client Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-32997No exploit	The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package.pypi · rootinteractive Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-33004No exploit	The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package.pypi · beginner Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-34054No exploit	The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package.pypi · perdido Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
40Plan	CVE-2022-33000No exploit	The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package.pypi · ml-scanner Pre-auth	Critical9.8	—	2.0%	Jun 24, 2022
39Monitor	CVE-2022-34500No exploit	The bin-collect package in PyPI before v0.1 included a code execution backdoor inserted by a third party.pypi · pypi Pre-auth	Critical9.8	—	1.5%	Jul 22, 2022
39Monitor	CVE-2022-34501No exploit	The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party.pypi · pypi Pre-auth	Critical9.8	—	1.5%	Jul 22, 2022
31Monitor	CVE-2020-15904No exploit	A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via apypi · bsdiff4 · CWE-787 Memory safety	High7.8	—	1.1%	Jul 22, 2020

CVE-2022-34056
40Plan
The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · watertoolsJun 24, 2022
CVE-2022-32999
40Plan
The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · cloudlabelingJun 24, 2022
CVE-2022-33001
40Plan
The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · aamilesJun 24, 2022
CVE-2022-33002
40Plan
The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · exploreJun 24, 2022
CVE-2022-33003
40Plan
The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · watoolsJun 24, 2022
CVE-2022-34053
40Plan
The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · dr-web-engineJun 24, 2022
CVE-2022-34055
40Plan
The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · drxhelloJun 24, 2022
CVE-2022-32998
40Plan
The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request package
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · cryptoasset-data-downloaderJun 24, 2022
CVE-2022-32996
40Plan
The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · django-navbar-clientJun 24, 2022
CVE-2022-32997
40Plan
The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · rootinteractiveJun 24, 2022
CVE-2022-33004
40Plan
The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · beginnerJun 24, 2022
CVE-2022-34054
40Plan
The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · perdidoJun 24, 2022
CVE-2022-33000
40Plan
The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · ml-scannerJun 24, 2022
CVE-2022-34500
39Monitor
The bin-collect package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
CriticalCVSS 9.8No exploitEPSS 2%
- Pre-auth
pypi · pypiJul 22, 2022
CVE-2022-34501
39Monitor
The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
CriticalCVSS 9.8No exploitEPSS 1%
- Pre-auth
pypi · pypiJul 22, 2022
CVE-2020-15904
31Monitor
A buffer overflow in the patching routine of bsdiff4 before 1.2.0 allows an attacker to write to heap memory (beyond allocated bounds) via a
HighCVSS 7.8No exploitEPSS 1%
- Memory safety
pypi · bsdiff4Jul 22, 2020