https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T11:00:57.780818+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2026-09330 bdu:2026-09330 2026-10-02T11:00:58.093536+00:00 bdu:2026-09330 https://cve.radiocsirt.org/vuln/bell-cve-2026-3219 BELL-CVE-2026-3219 2026-10-02T11:00:58.093578+00:00

Affected: Alpaquita:stream: py3-pip, BellSoft Hardened Containers:stream: py3-pip

 https://cve.radiocsirt.org/vuln/brew-azure-cli-cve-2026-3219 BREW-azure-cli-CVE-2026-3219 — pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files 2026-10-02T11:00:58.093610+00:00

Affected: Homebrew: azure-cli

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0556 certfr-2026-avi-0556 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-02T11:00:58.093639+00:00 certfr-2026-avi-0556 https://cve.radiocsirt.org/vuln/cleanstart-2026-bc05591 Withdrawn: CLEANSTART-2026-BC05591 — Security fixes in k8s-sidecar 2.4.0-r0 2026-10-02T11:00:58.093656+00:00

Withdrawn by the publisher.

Affected: CleanStart: k8s-sidecar

Package k8s-sidecar version 2.4.0-r0 fixes 10 vulnerabilities: CVE-2026-44431, CVE-2026-44432, ghsa-mf9v-mfxr-j63j, ghsa-qccp-gfcp-xxvc, CVE-2026-3219...

 https://cve.radiocsirt.org/vuln/euvd-2026-292148 EUVD-2026-292148 2026-10-02T11:00:58.093677+00:00 EUVD-2026-292148 https://cve.radiocsirt.org/vuln/fkie_cve-2026-3219 fkie_cve-2026-3219 2026-10-02T11:00:58.093689+00:00

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

 https://cve.radiocsirt.org/vuln/ghsa-58qw-9mgm-455v GHSA-58qw-9mgm-455v — pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files 2026-10-02T11:00:58.093711+00:00

Affected: PyPI: pip

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-3219 msrc_CVE-2026-3219 — pip doesn't reject concatenated ZIP and tar archives 2026-10-02T11:00:58.093732+00:00 msrc_CVE-2026-3219 https://cve.radiocsirt.org/vuln/oesa-2026-2360 OESA-2026-2360 — python-pip security update 2026-10-02T11:00:58.093748+00:00

Affected: openEuler:24.03-LTS: python-pip

%changelog * Thu Apr 9 2026 yixiangzhike <yixiangzhike007@163.com> - 23.3.1-10 - Fix CVE-2026-25645 Security Fix(es):

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.(CVE-2026-3219)

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10645-1 openSUSE-SU-2026:10645-1 — python311-pip-26.1-1.1 on GA media 2026-10-02T11:00:58.093771+00:00

python311-pip-26.1-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-2875 PYSEC-2026-2875 — pip has an interpretation conflict due to handling both concatenated tar and ZIP files as ZIP files 2026-10-02T11:00:58.093786+00:00

Affected: PyPI: pip

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

 https://cve.radiocsirt.org/vuln/rhsa-2026:20074 RHSA-2026:20074 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T11:00:58.093806+00:00

pip: pip: Incorrect file installation due to improper archive handling

 https://cve.radiocsirt.org/vuln/suse-su-2026:22018-1 SUSE-SU-2026:22018-1 — Security update for python-pip 2026-10-02T11:00:58.093821+00:00

Security update for python-pip

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-3219 UBUNTU-CVE-2026-3219 2026-10-02T11:00:58.093836+00:00

Affected: Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-pip, Ubuntu:Pro:22.04:LTS: python-pip, Ubuntu:Pro:24.04:LTS: python-pip, Ubuntu:25.10: python-pip, Ubuntu:Pro:26.04:LTS: python-pip

pip handles concatenated tar and ZIP files as ZIP files regardless of filename or whether a file is both a tar and ZIP file. This behavior could result in confusing installation behavior, such as installing "incorrect" files according to the filename of the archive. New behavior only proceeds with installation if the file identifies uniquely as a ZIP or tar archive, not as both.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2455 WID-SEC-W-2026-2455 — Oracle Solaris Drittanbieterkomponenten: Mehrere Schwachstellen 2026-10-02T11:00:58.093866+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Komponenten von Drittanbietern in Oracle Solaris ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.