PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-24772Mediumapache-superset: Apache Superset: Improper Neutralization of custom SQL on embedded context CVE-2024-27315Mediumapache-superset: Apache Superset: Improper error handling on alerts CVE-2024-25723Highzenml: ZenML Server Remote Privilege Escalation Vulnerability CVE-2024-25711Mediumdiffoscope: diffoscope Path Traversal vulnerability CVE-2024-24564Lowvyper: Vyper's `extract32` can ready dirty memory CVE-2024-26149Lowvyper: Vyper's `_abi_decode` vulnerable to Memory Overflow GHSA-P4M5-32PR-2HQRLowpypop-genomics: PyPop C extensions possible vulnerability: missing arguments and redundant null pointers CVE-2024-27444Criticallangchain-experimental: LangChain Experimental vulnerable to arbitrary code execution CVE-2024-27447Mediumpretix: pretix mishandles file validation CVE-2024-27454Highorjson: orjson does not limit recursion for deeply nested JSON documents CVE-2024-0243Lowlangchain: langchain Server-Side Request Forgery vulnerability CVE-2024-21502Highfastecdsa: Uninitialized Variable in fastecdsa CVE-2024-27133Criticalmlflow: MLFlow Cross-site Scripting vulnerability leads to client-side Remote Code Execution CVE-2024-27132Criticalmlflow: Cross-site Scripting in MLFlow CVE-2024-27319Mediumonnx: Onnx Out-of-bounds Read vulnerability CVE-2024-27318Highonnx: Onnx Directory Traversal vulnerability CVE-2024-1729Mediumgradio: Gradio apps vulnerable to timing attacks to guess password CVE-2024-26152Mediumlabel-studio: Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config GHSA-RC4P-P3J9-6577Highpypqc: pypqc private key retrieval vulnerability CVE-2024-26151Highmjml: Potentially untrusted input is rendered as HTML in final output CVE-2024-26130Highcryptography: cryptography NULL pointer dereference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private…CVE-2024-23346Criticalpymatgen: pymatgen vulnerable to arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string CVE-2024-26134Highcbor2: Potential buffer overflow in CBOR2 decoder CVE-2024-25141Criticalapache-airflow-providers-mongo: Improper Certificate Validation in apache airflow mongo hook CVE-2024-1647Highpyhtml2pdf: Cross-site Scripting in Pyhtml2pdf

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.