How many Python Packaging Authority pip CVEs are in CISA KEV?

None of Python Packaging Authority pip's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which versions of Python Packaging Authority pip are affected?

10 distinct Python Packaging Authority pip versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.

What are the most common weakness types in Python Packaging Authority pip CVEs?

Python Packaging Authority pip's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-36 (Absolute Path Traversal), CWE-434 (Unrestricted Upload of File with Dangerous Type).

What is the average severity of Python Packaging Authority pip CVEs?

The average CVSS base score across Python Packaging Authority pip's scored CVEs is 4.4.

RadicalNotion.AI

Log in Start free

Python Packaging Authority

5 CVEs

Python Packaging Authority pip Vulnerabilities

Name: Python Packaging Authority pip vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for pip by Python Packaging Authority.

5

Total CVEs

Published

0

In CISA KEV

Exploited in the wild

0

Public exploits

PoC or exploit code

4.4

Avg CVSS

2025–2026

Last updated July 29, 2026

Overview

Python Packaging Authority pip has 5 published CVE records since 2025, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 0 have a known public exploit. The average CVSS base score across scored CVEs is 4.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting Python Packaging Authority pip, with a severity breakdown, the affected and patched versions, the most common weakness types, and the full CVE list.

Severity and exploitation

How the CVSS severity of Python Packaging Authority pip's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical0

High0

Medium4

Low1

In CISA’s Known Exploited Vulnerabilities catalog

0

None of Python Packaging Authority pip's CVEs are currently listed in CISA's KEV catalog.

Public exploits

0

No Python Packaging Authority pip CVEs currently have a tracked public exploit.

Affected versions and CVEs

Browse every Python Packaging Authority pip version named in a CVE, then pick one to see only the CVEs that affect it.

Version ranges

< 25.31 CVE
< 26.01 CVE
< 26.11 CVE
< 26.21 CVE
24.0 <= v < 26.1.21 CVE

Fixed in

25.31 CVE
26.01 CVE
26.11 CVE
26.1.21 CVE
26.21 CVE

Find a version

5 CVEs

Sort

pip absolute path traversal during download from malicious package indexes
CVE-2026-13346
Patch
CWE-36
Medium · CVSS 5.6
EPSS 0.3% (21th pct)2026-07-29
pip can extract console_scripts and gui_scripts outside installation directory
CVE-2026-8643
Patch
Workaround
CWE-22
Medium · CVSS 4.1
EPSS 0.3% (24th pct)2026-06-01
pip doesn't reject concatenated ZIP and tar archives
CVE-2026-3219
Patch
CWE-434
Medium · CVSS 4.6
EPSS 0.1% (4th pct)2026-04-20
Limited path traversal when installing wheel archives
CVE-2026-1703
Patch
CWE-22
Low · CVSS 2.0
EPSS 0.4% (34th pct)2026-02-02
Fallback tar extraction in pip doesn't check symbolic links point to extraction directory
CVE-2025-8869
Patch
Medium · CVSS 5.9
EPSS 0.5% (39th pct)2025-09-24

Common weakness types

The CWE weakness categories most often found in Python Packaging Authority pip CVEs. Follow any weakness for its full explanation.

Disclosure activity by year

How many Python Packaging Authority pip CVEs were published each year.

2025

1

2026

4

Other Python Packaging Authority products

Browse vulnerabilities for other products by Python Packaging Authority.

All Python Packaging Authority vulnerabilities

Frequently asked questions

Common questions about Python Packaging Authority pip vulnerabilities.

How many CVEs does Python Packaging Authority pip have?: Python Packaging Authority pip has 5 published CVE records since 2025.
How many Python Packaging Authority pip CVEs are in CISA KEV?: None of Python Packaging Authority pip's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Are there public exploits for Python Packaging Authority pip vulnerabilities?: No Python Packaging Authority pip CVEs currently have a tracked public exploit in this dataset.
Which versions of Python Packaging Authority pip are affected?: 10 distinct Python Packaging Authority pip versions are named across its CVEs. Use the version filter above to see the CVEs affecting a specific version.
What are the most common weakness types in Python Packaging Authority pip CVEs?: Python Packaging Authority pip's CVEs most often map to these CWE weakness types: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')), CWE-36 (Absolute Path Traversal), CWE-434 (Unrestricted Upload of File with Dangerous Type).
What is the average severity of Python Packaging Authority pip CVEs?: The average CVSS base score across Python Packaging Authority pip's scored CVEs is 4.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track Python Packaging Authority pip vulnerabilities

Monitor new Python Packaging Authority pip vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing