PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-115878Highstanza: Stanza: RCE via pickle deserialization in the lemmatizer CVE-2026-119203Highpypdf: pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search CVE-2026-119204Highpypdf: pypdf has possible large memory usage when parsing page tree CVE-2026-119205Highpypdf: pypdf has possible infinite loop when cloning dictionaries CVE-2026-116672HighAuthlib: Authlib RFC 7592 examples omit registration-access-token client binding CVE-2026-119206Highpypdf: pypdf has possible long runtimes when retrieving page labels CVE-2026-119207Highpypdf: pypdf has possible large memory usage for exceptions in strict mode CVE-2026-119208Highpypdf: pypdf has possible long runtimes/large memory usage for encrypted PDF files CVE-2026-119209Highpypdf: pypdf has possible large memory usage when parsing cross-reference streams CVE-2026-119196Highpyasn1: pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding CVE-2026-119197Highpyasn1: pyasn1 has quadratic-complexity denial of service in binary REAL decoding CVE-2026-119195Highpyasn1: pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding CVE-2026-119194Highpyasn1: pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding CVE-2026-119286Highgraphql-core: GraphQL-core has denial of service via memory leak in aborted validations CVE-2026-118669Highoauthlib: OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client CVE-2026-116677Mediumopenwisp-controller: OpenWISP Controller CA CRL REST API does not scope requests to managed organizations CVE-2026-119284Mediumjoserfc: joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection CVE-2026-119283Highjoserfc: joserfc: Unbounded JWE General JSON `recipients` Array Leads to CPU Exhaustion (DoS) via Repeated RSA Private-Key Decryption GHSA-VPP8-G58W-M8MPHighTwisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset CVE-2026-61438Highpraisonai: PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox CVE-2026-115927Mediumtornado: Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks CVE-2026-116578Lowtornado: Tornado: Open redirect in RedirectHandler via protocol-relative URLs CVE-2026-116577Mediumtornado: Tornado: Quadratic CPU usage when parsing HTTP headers with line folding CVE-2026-117601Criticalelectrum: Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it CVE-2026-116575Mediummem0ai: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.