PatchTheCVEpypi vulnerabilities
Recent CVEs affecting pypi products. 15 tracked.
pypi has 15 tracked vulnerabilities, 15 critical. A fixed release or vendor patch exists for 10. Most recent: 2022-07-22. Highest priority: CVE-2022-34056 (score 65/100).
- CVE-2022-34501 CRITICAL 9.8 UPGRADE The bin-collection package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
- CVE-2022-34500 CRITICAL 9.8 UPGRADE The bin-collect package in PyPI before v0.1 included a code execution backdoor inserted by a third party.
- CVE-2022-34056 CRITICAL 9.8 DOWNGRADE The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request pack
- CVE-2022-34055 CRITICAL 9.8 DOWNGRADE The drxhello package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request packag
- CVE-2022-34054 CRITICAL 9.8 UPGRADE The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the reque
- CVE-2022-34053 CRITICAL 9.8 DOWNGRADE The DR-Web-Engine package in PyPI v0.2.0b0 was discovered to contain a code execution backdoor via the request
- CVE-2022-33004 CRITICAL 9.8 UPGRADE The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the requ
- CVE-2022-33003 CRITICAL 9.8 UPGRADE The watools package in PyPI v0.0.1 to v0.0.8 was discovered to contain a code execution backdoor via the reque
- CVE-2022-33002 CRITICAL 9.8 UPGRADE The KGExplore package in PyPI v0.1.1 to v0.1.2 was discovered to contain a code execution backdoor via the req
- CVE-2022-33001 CRITICAL 9.8 DOWNGRADE The AAmiles package in PyPI v0.1.0 was discovered to contain a code execution backdoor via the request package
- CVE-2022-33000 CRITICAL 9.8 UPGRADE The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the re
- CVE-2022-32999 CRITICAL 9.8 DOWNGRADE The cloudlabeling package in PyPI v0.0.1 was discovered to contain a code execution backdoor via the request p
- CVE-2022-32998 CRITICAL 9.8 UPGRADE The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution ba
- CVE-2022-32997 CRITICAL 9.8 UPGRADE The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor vi
- CVE-2022-32996 CRITICAL 9.8 UPGRADE The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via
FAQ
How do I fix pypi vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is pypi being exploited right now?
None of the tracked pypi CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which pypi CVE should I patch first?
CVE-2022-34056 currently ranks highest (65/100): The Watertools package in PyPI v0.0.0 was discovered to contain a code execution backdoor via the request pack.