Priority HIGH 73
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages.
CVSS 4.0HIGH 7.7· Network · No auth · No interaction · EPSS 0.01592 · Published 2025-05-17 · Partial fix · 78.1.1 CWE-22
Priority HIGH 73
A vulnerability in the package_index module of pypa/setuptools versions up to 69.1.1 allows for remote code execution via its download functions.
CVSS 3.0HIGH 8.8· Network · No auth · User interaction · EPSS 0.01939 · Published 2024-07-15 · Partial fix · 70.0, 70.0.0 CWE-94
Priority HIGH 69
virtualenv is a tool for creating isolated virtual python environments.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00285 · Published 2026-10-20 · Partial fix · 21.14.9 CWE-78
Priority HIGH 66
virtualenv is a tool for creating isolated virtual python environments.
CVSS 4.0HIGH 7.1· Local · No auth · User interaction · EPSS 0.00242 · Published 2026-10-20 · Partial fix · 21.14.9 CWE-78
Priority HIGH 66
virtualenv is a tool for creating isolated virtual python environments.
CVSS 4.0HIGH 7.1· Local · No auth · User interaction · EPSS 0.00242 · Published 2026-10-20 · Partial fix · 21.14.9 CWE-94
Priority MEDIUM 64
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.0035 · Published 2026-01-22 · Partial fix · 0.46.2 CWE-22
Priority MEDIUM 60
setuptools is a package that allows users to download, build, install, upgrade, and uninstall Python packages.
CVSS 3.1MEDIUM 6.1· Local · No auth · User interaction · EPSS 0.0053 · Published 2026-07-08 · Fixed in 83.0.0 CWE-176
Priority MEDIUM 54
virtualenv is a tool for creating isolated virtual python environments.
CVSS 3.1MEDIUM 4.5· Local · Low privileges · No interaction · EPSS 0.00203 · Published 2026-10-20 · Partial fix · 21.14.9 CWE-59
Priority MEDIUM 54
virtualenv is a tool for creating isolated virtual python environments.
CVSS 3.1MEDIUM 4.5· Local · Low privileges · No interaction · EPSS 0.00203 · Published 2026-10-20 · Partial fix · 21.14.9 CWE-22
Priority MEDIUM 54
virtualenv is a tool for creating isolated virtual python environments.
CVSS 4.0MEDIUM 4.4· Local · Low privileges · User interaction · EPSS 0.00204 · Published 2026-10-20 · Partial fix · 21.14.10 CWE-377
Priority MEDIUM 45
virtualenv is a tool for creating isolated virtual python environments.
CVSS 4.0LOW 2.3· Network · No auth · User interaction · EPSS 0.00293 · Published 2026-10-20 · Partial fix · 21.14.9 CWE-494
Priority MEDIUM 45
virtualenv is a tool for creating isolated virtual python environments.
CVSS 4.0LOW 2.3· Network · No auth · User interaction · EPSS 0.00249 · Published 2026-10-20 · Partial fix · 21.14.9 CWE-354
Priority MEDIUM 44
virtualenv is a tool for creating isolated virtual python environments.
CVSS 4.0LOW 2.0· Local · No auth · User interaction · EPSS 0.00242 · Published 2026-10-20 · Partial fix · 21.14.9 CWE-93
Priority MEDIUM 44
pipenv is a Python development workflow tool.
CVSS 3.1HIGH 8.6· Local · No auth · User interaction · EPSS 0.03931 · Published 2022-01-10 · Fixed in 2022.1.8 CWE-20
Priority MEDIUM 40
An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.0178 · Published 2020-05-08 · Will not fix CWE-20
Priority LOW 39
virtualenv is a tool for creating isolated virtual python environments.
CVSS 4.0HIGH 7.3· Local · No auth · User interaction · EPSS 0.00208 · Published 2026-09-29 · Partial fix · 21.7.12 CWE-78
Priority LOW 39
pip before 1.3 uses HTTP to retrieve packages from the PyPI repository, and does not perform integrity checks on package contents, which allows man-in-the-middle attackers to execute arbitrary code via a crafted response…
CVSS 2.0MEDIUM 6.8· Network · No auth · Interaction — · EPSS 0.06194 · Published 2013-08-06 · Fixed in 1.3 CWE-20
Priority LOW 38
The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition header can have ../ in a filename, as demonstrated by overwriting the /root/.ssh/…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03003 · Published 2020-09-04 · Partial fix · 19.2 CWE-22
Priority LOW 37
The mirroring support (-M, --use-mirrors) in Python Pip before 1.5 uses insecure DNS querying and authenticity checks which allows attackers to perform man-in-the-middle attacks.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.07987 · Published 2019-11-05 · Partial fix · 1.5 CWE-287
Priority LOW 36
virtualenv is a tool for creating isolated virtual python environments.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00269 · Published 2026-10-20 · Partial fix · 21.14.2 CWE-78
Priority LOW 36
virtualenv is a tool for creating isolated virtual python environments.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00236 · Published 2026-10-20 · Partial fix · 21.14.2 CWE-116
Priority LOW 36
virtualenv is a tool for creating isolated virtual python environments.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00345 · Published 2026-10-20 · Partial fix · 21.14.4 CWE-116
Priority LOW 36
virtualenv is a tool for creating isolated virtual python environments.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00263 · Published 2026-10-20 · Partial fix · 21.14.7 CWE-116
Priority LOW 35
virtualenv is a tool for creating isolated virtual python environments.
CVSS 4.0HIGH 7.7· Network · No auth · User interaction · EPSS 0.00197 · Published 2026-09-29 · Partial fix · 21.7.12 CWE-494
Priority LOW 35
virtualenv is a tool for creating isolated virtual python environments.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00159 · Published 2026-09-29 · Partial fix · 21.7.13 CWE-78
Load more
THREATIST.IORead the docs