PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-102832Mediumjupyterlab: JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clickedCVE-2026-104266Mediumtinytag: tinytag: Infinite loop when parsing certain M4A files containing invalid atomsCVE-2026-104102Mediumcopyparty: copyparty FTP: upload outside defined volumes (limited path traversal)CVE-2026-104250Mediumunstructured: unstructured: Stored XSS via unescaped HTML generationCVE-2026-59951Mediummcp: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource ExhaustionCVE-2026-62268Mediumborgbackup: borg extract might modify out-of-tree files when extracting maliciously crafted archivesCVE-2026-62322Mediumsocial-auth-core: Python Social Auth: Login CSRF in LINE backend (LineOAuth2) — missing OAuth state validation (incomplete fix of 5.0.0 campaign)CVE-2026-14966Lowbbot: BBOT's Symlink guard bypass in unarchive module allows planting symlinks during extractionCVE-2026-59180Lowapprise: Apprise forwards configured auth headers across cross-origin HTTP redirectsCVE-2026-108258Mediumshiny: Shiny for Python has path traversal in bookmark restoreCVE-2026-107841Mediumpacioli-guard: pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documentsGHSA-68W4-83FH-F2W8Highpyload-ng: pyload-ng: getUserData/get_userdata exposed at Perms.ANY allow any authenticated account to brute-force the administrator passwordGHSA-9Q47-3CM2-2RP8Mediumpyload-ng: pyLoad: Rate-Limit Bypass and Audit-Log Spoofing via Trusted Client-Controlled `X-Forwarded-For` HeaderGHSA-JQ7H-WRVP-3RGXHighpyload-ng: pyLoad: Privilege revocation and password change through the REST API do not invalidate the user's sessionGHSA-889W-M37P-88M5Highpyload-ng: pyLoad: Api.set_user_permission never invalidates the target's sessionGHSA-P3PR-8F3M-4QP8Mediumpyload-ng: pyLoad WindowsPhoneNotify addon: non-admin SETTINGS user triggers SSRF via unguarded http.client notification hostGHSA-FR26-JJHM-638CHighpyload-ng: pyLoad: Tar extraction creates device nodes and FIFOs (member types not filtered; tarfile extractall without filter=)GHSA-R44W-V6GF-X3P6Highpyload-ng: pyLoad has an authentication bypass in API key validation (check_apikey cache)CVE-2026-75597Mediumpyload-ng: pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via…CVE-2026-48484Mediumpyload-ng: pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process TerminationCVE-2026-107727Lowstrawberry-graphql: Strawberry legacy graphql-ws retains naturally completed subscription slotsCVE-2026-107728Highstrawberry-graphql: Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthyCVE-2026-107716Mediumbanks: Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistryCVE-2026-107717Mediumbanks: Banks: User-controlled prompt input can be parsed as privileged chat messagesCVE-2026-107394Mediumindico: Indico: Incomplete Server-Side Request Forgery (SSRF) check

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo