p
pypa
Security Risk Profile
40
/100
mediumSecurity Risk Score
Comprehensive risk assessment based on 13 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from May 28, 2013 to present
13
Total CVEs
6
Critical+High
0
Exploited
2
Unpatched
Threat Assessment
Avg CVSS
6.7
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
2
Critical/High
Risk Level
40/100
medium
Severity Distribution
Critical
1High
5Medium
7Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
2Age Distribution
Common Weaknesses (CWE)
1
Path Traversal
4
2
Input Validation
4
3
Command Injection
2
4
Code Injection
1
5
OS Command Injection
1
Most Affected Products
1. pypa pip11
2. Fedoraproject Fedora8
3. pip/pip7
4. redhat/python-pip5
5. Oracle Communications Cloud Native Core Network Function Cloud Native Environment4
Recent Vulnerabilities
See more →CVE-2026-13346
CVSS 5.6medium
pip absolute path traversal during download from malicious package indexes
Jul 29, 2026
CVE-2026-8643
CVSS 4.1EPSS 0%medium
pip can extract console_scripts and gui_scripts outside installation directory
Apr 22, 2026
REDHAT-BUG-2460927
CVSS 7.0high
Apr 22, 2026🔧 No Patch
REDHAT-BUG-2297771
CVSS 7.0high
Jul 15, 2024🔧 No Patch
CVE-2023-5752
CVSS 5.5EPSS 0%medium
Mercurial configuration injectable in repo revision when installing via pip
Oct 24, 2023
CVE-2022-21668
CVSS 9.3critical
Pipenv's requirements.txt parsing allows malicious index url in comments
Jan 10, 2022
CVE-2021-3572
CVSS 5.7medium
Apr 24, 2021
CVE-2018-20225
CVSS 7.8high
May 8, 2020
CVE-2013-5123
CVSS 5.9medium
Nov 5, 2019
CVE-2019-20916
CVSS 8.0high
Apr 16, 2019
Monitor pypa in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.