P
Vendor security profile
pypa
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs8
Critical0
CISA KEV0
Public exploit1
Patch rate%50
Avg. CVSS6.5
12-month vulnerability rate
0
0
1
0
0
0
0
1
1
0
4
0
CVE KEV
CVE severity distribution
8toplam CVE
High4 (50%)
Medium4 (50%)
Patch and exploitation view
%50
Verified patch
%0
CISA KEV
%13
Public exploit
4Patch available
0Partial
0Workaround
0Vendor: no patch
4Unknown
Latest vulnerabilities
5.8
CVE-2026-102938
virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection
P
Patch status unknownEPSS %0
7.3
CVE-2026-102937
virtualenv: Command injection via --prompt in activate.bat (batch activator)
P
Patch status unknownEPSS %0
7.7
CVE-2026-102930
virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before use
P
Patch status unknownEPSS %0
7.8
CVE-2026-102925
virtualenv bash and fish activation scripts execute commands embedded in paths
P
Patch status unknownEPSS %0
6.5
CVE-2026-13346
Vulnerability in Pypa Pip
P
Patch verifiedEPSS %0
4.1
CVE-2026-8643
pip can extract console_scripts and gui_scripts outside installation directory
PP
Patch verifiedEPSS %0
7.1
CVE-2026-24049
wheel Allows Arbitrary File Permission Modification via Path Traversal
P
Patch verifiedEPSS %0
5.7
CVE-2021-3572
Improper input validation in N/a Python Pip
N
Patch verifiedEPSS %2