PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-46608Highglances: Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)CVE-2026-46607Highglances: Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code Execution CVE-2026-46606Highglances: Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.py CVE-2026-46488Criticalmotioneye: motionEye: Authentication possible via password hash CVE-2025-67303Highcomfyui-manager: ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)CVE-2026-32315Mediummotioneye: motionEye's World-Readable Configuration File Exposes Admin Password Hash CVE-2026-31978Mediummotioneye: motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview Endpoint CVE-2026-21887Highpycti: OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion Feature CVE-2024-37155Mediumpycti: OpenCTI May Bypass Introspection Restriction CVE-2026-59153Highaqt: Anki's local HTTP server does not sufficiently validate requests GHSA-4XGF-CPJX-PC3JMediumpydantic-settings: pydantic-settings: NestedSecretsSettingsSource follows symlinks outside secrets_dir, enabling local file read and bypassing…GHSA-F4XH-W4CJ-QXQ8Highlangsmith: LangSmith SDK TracingMiddleware: Arbitrary server-side file read GHSA-4CC2-G9W2-FHF6Mediumzeep: Zeep: Server-Side Request Forgery (SSRF)GHSA-CW6H-FFMH-X6VHMediumaqt: Anki: User scripts in iframes have access to the internal Anki API GHSA-WVRH-2F4M-924VMediumChatterBot: ChatterBot: Symlink-Following Arbitrary Write via UbuntuCorpusTrainer GHSA-C795-2G9C-J48MHigheveros: EverOS: Path traversal in EverOS /api/v1/memory/add via unvalidated sender_id GHSA-6GQW-JQV7-V88MHighstigmem-node: stigmem-node: decay sweep expires and counts facts across all tenants (cross-tenant BOLA)GHSA-XHV3-Q4XX-349RHighstigmem-node: stistigmem-node: quarantine review surface exposes and mutates other tenants' quarantined facts (cross-tenant BOLA)GHSA-X26H-XMV8-GXF7Highstigmem-node: stigmem-node: RTBF tombstones are mis-attributed and suppress reads tenant-blind (cross-tenant BOLA)GHSA-6V7P-G79W-8964Highmsgpack: MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error CVE-2026-55447Criticallangflow: Langflow: BaseFileComponent-based nodes arbitrary file read with RCE exploit CVE-2026-55446Highlangflow: Langflow: Unauthenticated DoS through multipart form boundary file upload CVE-2026-55423Mediumlangflow: Langflow: Logout button does not clear session CVE-2026-55255Highlangflow: Langflow: IDOR Vulnerability in `/api/v1/responses` Endpoint Allows Authenticated Attackers to Access Another User's Flow CVE-2026-55206Mediumpy7zr: py7zr: O(n^2) algorithmic complexity DoS in PackInfo._read()

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.