CVE-2026-8643 json
pip can extract console_scripts and gui_scripts outside installation directory
published 5mo ago modified last mo. also EUVD-2026-33682 , GHSA-wf93-45jw-7689 , PYSEC-2026-196
- cvss
- 8.0
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 25%
- public exploits
- 0
- none known
Summary
pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation directory.
Patch / fix
- pypi pip 26.1.2
- Python Packaging Authority pip 26.1.2
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:4.6.30-2.el8ap
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:4.6.30-2.el9ap
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9 0:4.7.14-3.el9ap
- Red Hat Red Hat Enterprise Linux 10 0:25.2-3.el10_2.5
- Red Hat Red Hat Enterprise Linux 9 0:25.2-3.el9_8.5
- Red Hat Red Hat Ansible Automation Platform 2.5 1784049109
- Red Hat Red Hat Ansible Automation Platform 2.6 1782711769, 1782713671, 1782761510, 1783969139, 1785753810
- Red Hat Red Hat Discovery 2 1782763840, 1786638573
- Red Hat Red Hat Hardened Images 26.1.1-3.1.hum1, 26.1.2-1.hum1
- Red Hat Red Hat Migration Toolkit for Applications 8.2 1786481481
- Red Hat Red Hat OpenShift AI 2.25 1782475830, 1783024305, 1783082430, 1783342900, 1783998418
- Red Hat Red Hat OpenShift AI 3.0 1782928977, 1782928984, 1782929069, 1782929133, 1782968171
- Red Hat Red Hat OpenShift AI 3.2 1782914629, 1782914721, 1782914751, 1782914833, 1782915184, 1782915416
- Red Hat Red Hat OpenShift AI 3.3 1782471555, 1782471579, 1782471656, 1782471663, 1782887848, 1782914644, 1782914653, 1782914706, 1782914779, 1782914960, 1782915015, 1782915056, 1782916020, 1782991170, 1783010225, 1783069204, 1783073038
- Red Hat Red Hat OpenShift AI 3.4 1782132163, 1782132167, 1782132207, 1782132236, 1782132237, 1782132240, 1782132286, 1782132297, 1782133213, 1782135346, 1782135464, 1782136276, 1782726504, 1786612415, 1786612637, 1786635926, 1787073459, 1787073866, 1787073873, 1787073936
- Red Hat Red Hat Trusted Artifact Signer 1.4 1782485441
- python-pip Debian 14 26.1.2+dfsg-1
debian advisories DEBIAN-CVE-2026-8643
- receptor ansible automation platform 2.6 1.6.6-1.el10ap
- receptor ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1.6.6-1.el9ap
- ansible-core ansible automation platform developer 2.6, ansible automation platform 2.6 2:2.16.19-1.el10ap
- ansible-core ansible automation platform inside 2.6, ansible automation platform inside 2.5, ansible automation platform developer 2.6 +3 more 1:2.16.19-1.el9ap
- python3.12-pulpcore ansible automation platform 2.6, ansible automation platform 2.5 3.49.63-2.el9ap
- python3.12-gitpython ansible automation platform 2.6, ansible automation platform 2.5 3.1.50-1.el9ap
- automation-platform-ui ansible automation platform 2.6 2.6.11-1.el9ap
- automation-gateway-proxy ansible automation platform 2.6 2.6.17-1.el9ap
red hat advisories RHSA-2026:42079RHSA-2026:42078RHSA-2026:36359RHSA-2026:36315RHSA-2026:36193RHSA-2026:34891
- python3 SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +11 more 3.6.15-150300.10.129.1
- python3-core SLES for SAP 15 SP6, SLES for SAP 15 SP5, SLES for SAP 15 SP4 +12 more 3.6.15-150300.10.129.1
- grafana Multi Linux Manager Tools SLE-15 12.4.10-150002.4.27.1
- mgr-push Multi Linux Manager Tools SLE-15 5.2.5-150002.3.12.1
- spacecmd Multi Linux Manager Tools SLE-15 5.2.10-150002.3.15.1
- uyuni-tools Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 5.2.17-150002.3.20.1
- venv-salt-minion Multi Linux Manager Tools SLE-Micro-5, Multi Linux Manager Tools SLE-15 3006.0-150002.5.22.1
- spacewalk-client-tools Multi Linux Manager Tools SLE-15 5.2.7-150002.3.12.1
suse advisories SUSE-SU-2026:4754-1SUSE-SU-2026:4585-1SUSE-SU-2026:4584-1SUSE-SU-2026:4583-1SUSE-SU-2026:4582-1SUSE-SU-2026:4581-1
- python-pip openSUSE Leap 16.0 25.0.1-160000.5.1
- python-pip openSUSE Tumbleweed 26.1.2-1.1
opensuse advisories openSUSE-SU-2026:20993-1openSUSE-SU-2026:10940-1
- python3.14-pip AlmaLinux 10 25.2-3.el10_2.5
- python3.14-pip-wheel AlmaLinux 10 25.2-3.el10_2.5
- python3.14-pip AlmaLinux 9 25.2-3.el9_8.5
- python3.14-pip-wheel AlmaLinux 9 25.2-3.el9_8.5
almalinux advisories ALSA-2026:36193ALSA-2026:36315
- python3.14-pip Rocky Linux 10 25.2-3.el10_2.5
- python3.14-pip Rocky Linux 9 25.2-3.el9_8.5
rocky linux advisories RLSA-2026:36193RLSA-2026:36315
- python-pip Azure Linux 3.0 24.2-9
- python-virtualenv Azure Linux 3.0 20.36.1-5
azure linux advisories AZL-89325AZL-89463
Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT
- github.com/pypa/pip#14000 pull request
Is CVE-2026-8643 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerVendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2026-8643 updated cvss 8.0
python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
-
Red Hat Exploit Intelligence exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 Red Hat Lightspeed Core lightspeed-core/rag-tool-cpu-rhel9, lightspeed-core/rag-tool-cuda-12.9-rhel9affected: workaround, no fix available
-
Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-rhel9-operator, migration-toolkit-virtualization/mtv-rhel9-operator Red Hat AI Inference Server rhaii/vllm-cpu-rhel9, rhaii/vllm-tpu-rhel9, rhaii/vllm-cuda-rhel9, rhaii/vllm-rocm-rhel9, rhaiis/vllm-cpu-rhel9, rhaiis/vllm-tpu-rhel9, +9 more Red Hat Ansible Automation Platform 2 ansible-automation-platform-24/controller-rhel8, ansible-automation-platform-26/hub-rhel9-operator, ansible-automation-platform-26/gateway-rhel9-operator, ansible-automation-platform/automation-dashboard-rhel9, ansible-automation-platform-26/controller-rhel9-operator, ansible-automation-platform-26/lightspeed-rhel9-operator, +4 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Developer Hub 1 rhdh/rhdh-must-gather-rhel9affected: workaround, no fix planned “Will not fix”
-
Red Hat Enterprise Linux 8 ubi8/python-36, ubi8/python-39, ubi8/python-312, rhel8/python-311 Red Hat Enterprise Linux 9 rhel9/python-39, ubi9/python-312, rhel9/python-311, ubi9/python-312-minimal Red Hat Enterprise Linux 10 rhel10/python-312-minimalaffected: workaround, no fix available
-
Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/bootc-gaudi-rhel9, rhelai3/bootc-aws-cuda-rhel9, rhelai3/bootc-gcp-cuda-rhel9, rhelai3/disk-image-cuda-rhel9, +2 moreaffected: workaround, no fix available, no fix planned “Will not fix”
-
Red Hat Enterprise Linux command line assistant rhel-cla/rhel-knowledge-bridge-rhel10 Red Hat OpenShift AI (RHOAI) rhoai/odh-vllm-cuda-rhel9, rhoai/odh-vllm-rocm-rhel9, rhai/base-image-gaudi-rhel9, rhai/base-image-rocm-7.1-rhel9, rhoai/odh-pipelines-components-rhel9, rhoai/odh-th06-cpu-torch291-py312-rhel9, +3 more Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift4/ose-ansible-rhel9-operator Red Hat Trusted Artifact Signer rhtas/segment-reporting-rhel9affected: workaround, no fix available
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/controller-rhel8 1784049109fixed: vendor fix RHSA-2026:42144
-
Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower 4.6.30-2.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower 4.6.30-2.el9apfixed: vendor fix RHSA-2026:42078
show 18 moreshow fewer
-
Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/gateway-rhel9 1782761510, ansible-automation-platform-26/controller-rhel9 1785753810, ansible-automation-platform-26/de-minimal-rhel9 1782711769, ansible-automation-platform-26/de-supported-rhel9 1782713671, ansible-automation-platform-tech-preview/metrics-service-rhel9 1783969139fixed: vendor fix RHSA-2026:50479
-
Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-venv-tower 4.7.14-3.el9apfixed: vendor fix RHSA-2026:42079
-
Red Hat Discovery 2 discovery/discovery-server-rhel9 1782763840, discovery/discovery-server-rhel9 1786638573fixed: vendor fix RHSA-2026:54760
-
Red Hat Enterprise Linux AppStream (v. 9) python3.14-pip 25.2-3.el9_8.5, python3.14-pip-wheel 25.2-3.el9_8.5fixed: vendor fix RHSA-2026:36315
-
Red Hat Enterprise Linux AppStream (v. 10) python3.14-pip 25.2-3.el10_2.5, python3.14-pip-wheel 25.2-3.el10_2.5fixed: vendor fix RHSA-2026:36193
-
Red Hat Hardened Images python-pip 26.1.2-1.hum1, python3-pip 26.1.2-1.hum1, python-pip 26.1.1-3.1.hum1, python3-pip 26.1.1-3.1.hum1, python-pip-wheel 26.1.2-1.hum1, python-pip-wheel 26.1.1-3.1.hum1fixed: vendor fix RHSA-2026:34891
-
Red Hat Migration Toolkit for Applications 8.2 mta/mta-rhel9-operator 1786481481fixed: vendor fix RHSA-2026:56347
-
Red Hat OpenShift AI 2.25 rhoai/odh-caikit-nlp-rhel9 1791448212, rhoai/odh-feature-server-rhel9 1792148523, rhoai/odh-built-in-detector-rhel9 1791364320, rhoai/odh-caikit-tgis-serving-rhel9 1783082430, rhoai/odh-modelmesh-runtime-adapter-rhel9 1783342900, rhoai/odh-kserve-storage-initializer-rhel9 1783024305, +4 morefixed: vendor fix RHSA-2026:87410
-
Red Hat OpenShift AI 3.0 rhai/base-image-cpu-rhel9 1782929133, rhai/base-image-cpu-rhel9 1793042072, rhai/base-image-tpu-rhel9 1782968171, rhai/base-image-cuda-rhel9 1782929069, rhai/base-image-cuda-rhel9 1793042067, rhai/base-image-rocm-rhel9 1782928977, +2 morefixed: vendor fix RHSA-2026:34772
-
Red Hat OpenShift AI 3.2 rhai/base-image-cpu-rhel9 1782915416, rhai/base-image-tpu-rhel9 1782914629, rhai/base-image-cuda-rhel9 1782915184, rhai/base-image-rocm-rhel9 1782914721, rhai/base-image-rocm-rhel9 1782914751, rhai/base-image-spyre-rhel9 1782914833fixed: vendor fix RHSA-2026:34739
-
Red Hat OpenShift AI 3.3 rhoai/odh-mlserver-rhel9 1782887848, rhai/base-image-cpu-rhel9 1782914779, rhai/base-image-tpu-rhel9 1782914653, rhai/base-image-spyre-rhel9 1782916020, rhai/base-image-neuron-rhel9 1782915056, rhai/base-image-rocm-6.4-rhel9 1782914644, +12 morefixed: vendor fix RHSA-2026:34776
-
Red Hat OpenShift AI 3.4 rhoai/odh-automl-rhel9 1786612415, rhoai/odh-autorag-rhel9 1786612637, rhoai/odh-mlserver-rhel9 1782726504, rhai/base-image-cpu-rhel9 1790703631, rhai/base-image-tpu-rhel9 1790703539, rhai/base-image-spyre-rhel9 1790703597, +39 morefixed: vendor fix RHSA-2026:74679
-
Red Hat OpenShift AI 3.5 rhoai/odh-latency-predictor-training-rhel9 1786552250, rhoai/odh-latency-predictor-prediction-rhel9 1786552271fixed: vendor fix RHSA-2026:60367
-
Red Hat OpenShift Dev Spaces 3.31 devspaces/udi-rhel9 1792708612fixed: vendor fix RHSA-2026:90321
-
Red Hat Trusted Artifact Signer 1.4 rhtas/model-transparency-rhel9 1782485441fixed: vendor fix RHSA-2026:37283
-
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed-tech-preview/lightspeed-rag-tool-rhel9 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9-operatornot affected: vulnerable code not in execute path
-
Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9not affected: component not present
-
Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/hub-rhel8 1784050598, ansible-automation-platform-25/gateway-rhel8 1784049566, ansible-automation-platform-25/hub-web-rhel8 1784054665, ansible-automation-platform-25/receptor-rhel8 1784047883, ansible-automation-platform-25/de-minimal-rhel8 1784064978, ansible-automation-platform-25/ee-minimal-rhel8 1784035663, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 8 receptor 1.6.6-1.el8ap, receptorctl 1.6.6-1.el8ap, ansible-core 2.16.19-1.el8ap, ansible-test 2.16.19-1.el8ap, automation-hub 4.10.16-1.el8ap, python3.12-pyjwt 2.13.0-1.el8ap, +20 more Red Hat Ansible Automation Platform 2.5 for RHEL 9 receptor 1.6.6-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-core 2.16.19-1.el9ap, ansible-test 2.16.19-1.el9ap, automation-hub 4.10.16-1.el9ap, python3.12-pyjwt 2.13.0-1.el9ap, +20 more Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/hub-rhel9 1782755272, ansible-automation-platform-26/hub-rhel9 1783979593, ansible-automation-platform-26/hub-rhel9 1785753568, ansible-automation-platform-26/gateway-rhel9 1783969842, ansible-automation-platform-26/gateway-rhel9 1785780020, ansible-automation-platform-26/hub-web-rhel9 1782759318, +82 more Red Hat Ansible Automation Platform 2.6 for RHEL 9 receptor 1.6.6-1.el9ap, molecule 26.6.0-1.el9ap, receptorctl 1.6.6-1.el9ap, ansible-sign 0.1.6-1.el9ap, ansible-lint 26.6.0-1.el9ap, ansible-core 2.16.19-1.el9ap, +39 morenot affected: vulnerable code not present
18 more not affected in the full advisory
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 5mo ago
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 25% of all scored CVEs (FIRST EPSS, 2026-11-11).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 4.1 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N |
| CISA ADP | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| CNA | 4.0 | 4.1 | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| CNA | 3.1 | 8.0 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | pip | <26.1.2 |
26.1.2 |
Affected products
- Python Packaging Authority pip
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Red Hat Ansible Automation Platform 2.6 for RHEL 9
- Red Hat Red Hat Enterprise Linux 10
- Red Hat Red Hat Enterprise Linux 9
- Red Hat Red Hat Ansible Automation Platform 2.5
- Red Hat Red Hat Ansible Automation Platform 2.6
- Red Hat Red Hat Discovery 2
- Red Hat Red Hat Hardened Images
- Red Hat Red Hat Migration Toolkit for Applications 8.2
- Red Hat Red Hat OpenShift AI 2.25
- Red Hat Red Hat OpenShift AI 3.0
- Red Hat Red Hat OpenShift AI 3.2
- Red Hat Red Hat OpenShift AI 3.3
- Red Hat Red Hat OpenShift AI 3.4
- Red Hat Red Hat Trusted Artifact Signer 1.4
- Red Hat Exploit Intelligence
- Red Hat Lightspeed Core
- Red Hat Migration Toolkit for Virtualization
- Red Hat OpenShift Lightspeed
- Red Hat OpenShift Service Mesh 3
- Red Hat Pen Drive Powered by Red Hat Lightspeed
- Red Hat Red Hat AI Inference Server
- Red Hat Red Hat Ansible Automation Platform 2
- Red Hat Red Hat Developer Hub
- Red Hat Red Hat Enterprise Linux 7
- Red Hat Red Hat Enterprise Linux 8
- Red Hat Red Hat Enterprise Linux AI (RHEL AI) 3
- Red Hat Red Hat Enterprise Linux command line assistant
- Red Hat Red Hat OpenShift AI (RHOAI)
- Red Hat Red Hat OpenShift Container Platform 4
- Red Hat Red Hat OpenShift Dev Spaces
- Red Hat Red Hat Quay 3
- Red Hat Red Hat Satellite 6
- Red Hat Red Hat Trusted Artifact Signer
- Red Hat Service Telemetry Framework 1.5
Classification
- Weakness
-
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory
References
-
github.com
/pypa/pip/pull/14000
patch, web, issue-tracking
-
mail.python.org
/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ/
vendor-advisory, mailing-list, advisory
-
access.redhat.com
/errata/RHSA-2026:42078
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:42079
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:36193
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:36315
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:42144
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:50479
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:34374
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:42132
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:54760
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:33313
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34891
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:56347
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:42644
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:34772
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34778
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34780
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34773
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34774
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34739
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34752
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34765
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34758
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34756
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34760
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34776
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34748
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34775
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34740
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34749
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34750
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34741
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:34777
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:37275
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:60520
vendor-advisory
-
access.redhat.com
/errata/RHSA-2026:34456
vendor-advisory, web
-
access.redhat.com
/errata/RHSA-2026:37283
vendor-advisory, web
-
openwall.com
/lists/oss-security/2026/06/01/5
web, mailing-list, third-party-advisory, advisory
-
access.redhat.com
/security/cve/CVE-2026-8643
vdb-entry, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-8643
advisory
-
bugzilla.redhat.com
/show_bug.cgi?id=2460927
web
-
github.com
/pypa/advisory-database/tree/main/vulns/pip/PYSEC-2026-196.yaml
web
-
github.com
/pypa/pip
package
-
mail.python.org
/archives/list/security-announce@python.org/thread/YV63UET5D3OOJY7O4M5XCVYO2YM4NBYJ
web
-
security.access.redhat.com
/data/csaf/v2/vex/2026/cve-2026-8643.json
web
-
github.com
/advisories/GHSA-wf93-45jw-7689
advisory
Sources
- CVE List CVE-2026-8643
- GitHub Advisory GHSA-wf93-45jw-7689
- NVD CVE-2026-8643
- OSV PYSEC-2026-196
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.