redhat/rubygem-pulp_python_client vulnerabilities

Latest redhat/rubygem-pulp_python_client CVEs

Newest publication first

1. CVE-2026-103871 pulp_python: Simple index renders project names without HTML escaping

   Published 2026-10-07

   Medium·CVSS 5.4

   A flaw was found in pulp-python's PyPI simple index. Project names are written into the HTML index without escaping. A user who can publish a Python package can store markup in the package name. A person who opens that index in a browser runs the markup in the origin that served...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.