pypa
- Products in analyzed data
- 5
- Catalog vulnerabilities
- 16
Severity across 6 analyzed records
Verify to analyze this security profile
A short verification protects source data and prevents automated AI requests.
en
Severity across 6 analyzed records
A short verification protects source data and prevents automated AI requests.
As of 09/11/2026, pypa recorded 1 security vulnerabilities in the last 90 days across 1 products, including 0 rated High or above and 0 known exploited vulnerabilities (KEV) that should be prioritized for immediate remediation.
Over the last 90 days, setuptools had the most security vulnerabilities in the pypa ecosystem, with 1 vulnerabilities—approximately 100% of the provider's total vulnerabilities during this period.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan
| CVE | Exploitation status | Fix | Affected product | Published | Severity |
|---|---|---|---|---|---|
CVE-2026-13346pip absolute path traversal during download from malicious package indexes | Exploitation statusNot known exploited | FixYes | Affected productpip | Published07/29/2026 | SeverityMedium |
CVE-2026-59890setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+ | Exploitation statusPublic exploit | FixYes | Affected productsetuptools | Published07/08/2026 | SeverityMedium |
CVE-2026-8643pip can extract console_scripts and gui_scripts outside installation directory | Exploitation statusNot known exploited | FixYes | Affected productpip | Published06/01/2026 | SeverityMedium |
CVE-2026-24049wheel Allows Arbitrary File Permission Modification via Path Traversal | Exploitation statusPublic exploit | FixYes | Affected productwheel | Published01/22/2026 | SeverityHigh |
CVE-2026-22702virtualenv Has TOCTOU Vulnerabilities in Directory Creation | Exploitation statusNot known exploited | FixYes | Affected productvirtualenv | Published01/10/2026 | SeverityMedium |
CVE-2025-47273setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write | Exploitation statusPublic exploit | FixNot confirmed | Affected productsetuptools | Published05/17/2025 | SeverityHigh |
CVE-2024-6345Remote Code Execution in pypa/setuptools | Exploitation statusPublic exploit | FixYes | Affected productpypa/setuptools | Published07/15/2024 | SeverityHigh |
CVE-2023-5752Mercurial configuration injectable in repo revision when installing via pip | Exploitation statusNot known exploited | FixYes | Affected productpip | Published10/24/2023 | SeverityMedium |
CVE-2022-21668Pipenv's requirements.txt parsing allows malicious index url in comments | Exploitation statusNot confirmed | FixYes | Affected productpipenv | Published01/10/2022 | SeverityHigh |
CVE-2021-3572CVE-2021-3572 | Exploitation statusNot confirmed | FixYes | Affected productpython-pip | Published11/10/2021 | SeverityUnknown |
CVE-2019-20916CVE-2019-20916 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published09/04/2020 | SeverityUnknown |
CVE-2018-20225CVE-2018-20225 | Exploitation statusNot known exploited | FixNot confirmed | Affected productNot confirmed | Published05/08/2020 | SeverityHigh |
CVE-2013-5123CVE-2013-5123 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/05/2019 | SeverityUnknown |
CVE-2014-8991CVE-2014-8991 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published11/24/2014 | SeverityUnknown |
CVE-2013-1888CVE-2013-1888 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/16/2013 | SeverityUnknown |
CVE-2013-1629CVE-2013-1629 | Exploitation statusNot confirmed | FixNot confirmed | Affected productNot confirmed | Published08/06/2013 | SeverityUnknown |