PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-28397Highjs2py: js2py allows remote code execution CVE-2024-34693Mediumapache-superset: Apache Superset server arbitrary file read CVE-2024-38356Mediumtinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp option CVE-2024-38357Mediumtinymce: TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elements CVE-2024-37891Mediumurllib3: urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects CVE-2024-34694Highlnbits: LNbits improperly handles potential network and payment failures when using Eclair backend CVE-2024-38459Highlangchain-experimental: langchain_experimental Code Execution via Python REPL access CVE-2024-25142Lowapache-airflow: Apache Airflow does not return the "Cache-Control" header for dynamic content GHSA-HJX6-F647-MVF9Mediuminvenio-communities: Invenio-Communities has a Cross-Site Scripting (XSS) vulnerability in React components CVE-2024-37300Highoauthenticator: Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0 CVE-2024-36265Criticalorg.apache.submarine:submarine-server-core: Apache Submarine Server Core Incorrect Authorization vulnerability CVE-2024-36264Mediumorg.apache.submarine:submarine-commons-utils: Apache Submarine Commons Utils has a hard-coded secret CVE-2024-4315Criticallollms: parisneo/lollms Local File Inclusion (LFI) attack CVE-2024-35225Criticaljupyter-server-proxy: Jupyter Server Proxy has a reflected XSS issue in host parameter CVE-2024-37301Highdocument-merge-service: document-merge-service vulnerable to Remote Code Execution via Server-Side Template Injection CVE-2024-35255Mediumazure-identity: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability CVE-2024-37014Highlangflow: Langflow remote code execution vulnerability CVE-2024-37568Highauthlib: Authlib has algorithm confusion with asymmetric public keys CVE-2024-4680Lowzenml: zenml-io/zenml does not expire the session after password reset CVE-2024-37388Highebookmeta: ebookmeta XML External Entity vulnerability CVE-2024-36827Highebookmeta: ebookmeta XML External Entity vulnerability GHSA-W235-7P84-XX57Mediumtornado: Tornado has a CRLF injection in CurlAsyncHTTPClient headers GHSA-753J-MPMX-QQ6GMediumtornado: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in tornado CVE-2024-3429Highlollms: LoLLMS Path Traversal vulnerability CVE-2024-3408Highdtale: Authentication bypass in dtale

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.