python supply chain

CVE-2026-6357 is a medium-severity flaw disclosed in April 2026 in pip before version 26.1, where pip’s post-install self-update check could import newly installed Python modules after wheel installation and potentially execute attacker-controlled code in a local install scenario. That...

CVE-2026-34591 is a reminder that the most dangerous software supply chain bugs are not always found in operating systems, browsers, or cloud control planes. This newly disclosed Poetry wheel path traversal vulnerability affects a widely used Python dependency and packaging tool, allowing a...