https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:06:10 +0000 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0701 certfr-2023-avi-0701 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0701 https://cve.radiocsirt.org/vuln/cnvd-2021-39695 cnvd-2021-39695 https://cve.radiocsirt.org/vuln/cnvd-2021-39695 https://cve.radiocsirt.org/vuln/euvd-2026-291519 EUVD-2026-291519 https://cve.radiocsirt.org/vuln/euvd-2026-291519 https://cve.radiocsirt.org/vuln/fkie_cve-2018-20225 <p>An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely</p> <p>An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely</p> https://cve.radiocsirt.org/vuln/fkie_cve-2018-20225 https://cve.radiocsirt.org/vuln/ghsa-7p5p-7qq5-cc86 <p>An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number).</p> <p>An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number).</p> https://cve.radiocsirt.org/vuln/ghsa-7p5p-7qq5-cc86 https://cve.radiocsirt.org/vuln/gsd-2018-20225 gsd-2018-20225 https://cve.radiocsirt.org/vuln/gsd-2018-20225 https://cve.radiocsirt.org/vuln/msrc_cve-2018-20225 msrc_CVE-2018-20225 https://cve.radiocsirt.org/vuln/msrc_cve-2018-20225 https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-20225 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-pip</p> <p>An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: python-pip, Ubuntu:Pro:16.04:LTS: python-pip, Ubuntu:Pro:18.04:LTS: python-pip, Ubuntu:Pro:20.04:LTS: python-pip</p> <p>An issue was discovered in pip (all versions) because it installs the version with the highest version number, even if the user had intended to obtain a private package from a private index. This only affects use of the --extra-index-url option, and exploitation requires that the package does not already exist in the public index (and thus the attacker can put the package there with an arbitrary version number). NOTE: it has been reported that this is intended functionality and the user is responsible for using --extra-index-url securely</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2018-20225 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2229 <p>Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen &#39;Denial of Service&#39;-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.</p> <p>Ein entfernter, authentifizierter Angreifer kann mehrere Schwachstellen in Splunk Splunk Enterprise ausnutzen, um beliebigen Code auszuführen, einen &#39;Denial of Service&#39;-Zustand zu verursachen, seine Privilegien zu erweitern und weitere, nicht spezifizierte Auswirkungen zu verursachen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-2229