{"items":[{"id":"CVE-2026-13346","published":"2026-07-29T18:33:50.820Z","updated":"2026-07-29T20:21:34.281Z","title":"pip absolute path traversal during download from malicious package indexes","severity":"MEDIUM","score":5.6,"vendor":"Python Packaging Authority","product":"pip","kev":false,"epss":0.00292,"kevAdded":null,"exploit":false},{"id":"CVE-2026-8643","published":"2026-06-01T15:01:32.143Z","updated":"2026-09-16T12:04:18.796Z","title":"pip can extract console_scripts and gui_scripts outside installation directory","severity":"MEDIUM","score":4.1,"vendor":"Python Packaging Authority","product":"pip","kev":false,"epss":0.0032,"kevAdded":null,"exploit":false},{"id":"CVE-2026-3219","published":"2026-04-20T14:55:38.282Z","updated":"2026-04-20T20:15:23.710Z","title":"pip doesn't reject concatenated ZIP and tar archives","severity":"MEDIUM","score":4.6,"vendor":"Python Packaging Authority","product":"pip","kev":false,"epss":0.00144,"kevAdded":null,"exploit":false},{"id":"CVE-2026-1703","published":"2026-02-02T14:43:02.919Z","updated":"2026-02-02T17:21:25.369Z","title":"Limited path traversal when installing wheel archives","severity":"LOW","score":2,"vendor":"Python Packaging Authority","product":"pip","kev":false,"epss":0.00436,"kevAdded":null,"exploit":false},{"id":"CVE-2025-8869","published":"2025-09-24T14:56:56.027Z","updated":"2025-11-03T17:45:31.574Z","title":"Fallback tar extraction in pip doesn't check symbolic links point to extraction directory","severity":"MEDIUM","score":5.9,"vendor":"Python Packaging Authority","product":"pip","kev":false,"epss":0.00493,"kevAdded":null,"exploit":false}]}