pypa records
11 published records for vendor pypa.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 1
- With a fix record
- 90.9%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-20 Improper Input Validation4
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')2
- CWE-287 Improper Authentication1
- CWE-36 Absolute Path Traversal1
- CWE-59 Improper Link Resolution Before File Access ('Link Following')1
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAll records
11 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
35Monitor | CVE-2022-21668Proof of concept | Pipenv's requirements.txt parsing allows malicious index url in commentspypa · pipenv · CWE-20 | High8.6 | — | 3.8% | Jan 10, 2022 |
32Monitor | CVE-2018-20225Proof of concept | An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intendedpypa · pip · CWE-20 | High7.8 | — | 1.7% | May 8, 2020 |
31Monitor | CVE-2019-20916No exploit | The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition hpypa · pip · CWE-22 | High7.5 | — | 3.0% | Sep 4, 2020 |
29Monitor | CVE-2013-1629No exploit | pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allpypa · pip · CWE-20 | Medium6.8 | — | 6.1% | Aug 5, 2013 |
25Monitor | CVE-2013-5123Proof of concept | The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackerspypa · pip · CWE-287 | Medium5.9 | — | 7.9% | Nov 5, 2019 |
23Monitor | CVE-2021-3572Proof of concept | A flaw was found in python-pip in the way it handled Unicode separators in git references.pypa · pip · CWE-20 | Medium5.7 | — | 1.8% | Nov 10, 2021 |
22Monitor | CVE-2026-13346No exploit | pip absolute path traversal during download from malicious package indexespypa · pip · CWE-36 | Medium5.6 | — | 0.2% | Jul 29, 2026 |
16Monitor | CVE-2026-8643No exploit | pip can extract console_scripts and gui_scripts outside installation directorypypa · pip · CWE-22 | Medium4.1 | — | 0.4% | Jun 1, 2026 |
13Monitor | CVE-2023-5752No exploit | Mercurial configuration injectable in repo revision when installing via pippypa · pip · CWE-77 | Low3.3 | — | 0.4% | Oct 25, 2023 |
8Monitor | CVE-2014-8991No exploit | pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* fipypa · pip | Low2.1 | — | 0.3% | Nov 24, 2014 |
8Monitor | CVE-2013-1888No exploit | pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.pypa · pip · CWE-59 | Low2.1 | — | 0.3% | Aug 17, 2013 |
- CVE-2022-2166835Monitor
Pipenv's requirements.txt parsing allows malicious index url in comments
HighCVSS 8.6Proof of conceptEPSS 3%pypa · pipenvJan 10, 2022
- CVE-2018-2022532Monitor
An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended
HighCVSS 7.8Proof of conceptEPSS 1%pypa · pipMay 8, 2020
- CVE-2019-2091631Monitor
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition h
HighCVSS 7.5No exploitEPSS 3%pypa · pipSep 4, 2020
- CVE-2013-162929Monitor
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which all
MediumCVSS 6.8No exploitEPSS 6%pypa · pipAug 5, 2013
- CVE-2013-512325Monitor
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers
MediumCVSS 5.9Proof of conceptEPSS 7%pypa · pipNov 5, 2019
- CVE-2021-357223Monitor
A flaw was found in python-pip in the way it handled Unicode separators in git references.
MediumCVSS 5.7Proof of conceptEPSS 1%pypa · pipNov 10, 2021
- CVE-2026-1334622Monitor
pip absolute path traversal during download from malicious package indexes
MediumCVSS 5.6No exploitEPSS 0%pypa · pipJul 29, 2026
- CVE-2026-864316Monitor
pip can extract console_scripts and gui_scripts outside installation directory
MediumCVSS 4.1No exploitEPSS 0%pypa · pipJun 1, 2026
- CVE-2023-575213Monitor
Mercurial configuration injectable in repo revision when installing via pip
LowCVSS 3.3No exploitEPSS 0%pypa · pipOct 25, 2023
- CVE-2014-89918Monitor
pip 1.3 through 1.5.6 allows local users to cause a denial of service (prevention of package installation) by creating a /tmp/pip-build-* fi
LowCVSS 2.1No exploitEPSS 0%pypa · pipNov 24, 2014
- CVE-2013-18888Monitor
pip before 1.3 allows local users to overwrite arbitrary files via a symlink attack on a file in the /tmp/pip-build temporary directory.
LowCVSS 2.1No exploitEPSS 0%pypa · pipAug 17, 2013