PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-106442Highhydra-core: Hydra instantiate target blacklist bypasses permit code executionCVE-2026-106454MediumTwisted: Twisted: IMAP wildcardToRegexp() ReDoSCVE-2026-105741Highlangflow: Langflow: IP Spoofing Bypass via `X-Forwarded-For` Allowing Remote Configuration WriteCVE-2026-62176CriticalPraisonAI: PraisonAI: Code Injection via f-string Interpolation in Deploy API Server GenerationCVE-2026-62179Mediumpraisonai-platform: PraisonAI: Platform members can delete owner issue dependencies through member-owned related issuesCVE-2026-61436Highpraisonai: PraisonAI: AgentMail webhook mode accepts forged unsigned message.received events and invokes agentsCVE-2026-61428Highpraisonai: PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofingCVE-2026-46438Mediumwger: wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entryCVE-2026-46434Highwger: wger: Trainer Privilege Escalation - Improper Privilege ManagementCVE-2026-46437Mediumwger: wger: API credentials remain valid after logout/password changeCVE-2026-45161Mediumwger: wger: trainer_login accepts GET - CSRF bypass enables forced session rebindingCVE-2026-43976Highwger: wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)CVE-2026-105801Highopenapi-python-client: openapi-python-client: Malicious OpenAPI Documents can cause Arbitrary Code GenerationGHSA-2R3X-4MRV-MCXFMediumvyper: Vyper: Memory corruption using function calls within tuples / nested callsGHSA-4V7V-GQF9-WW2GMediumvyper: Vyper: Call stack corruption when passing complex type containing non-base type members as argumentGHSA-VG88-3V92-RJX2Mediumvyper: Vyper: Return inside for loop more than 1 level deepCVE-2026-105747Mediumdocling: Docling: METS-GBS archive member limit enforced after full member enumeration (memory exhaustion during format detection)GHSA-J8F7-X8JM-WMM4Mediumlangflow: Langflow: SSRF in URL-taking components (protection disabled by default / warn-only, not applied to RSS, SearXNG, Web Search, Home…CVE-2026-10561Criticallangflow: Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authenticated RCE and privilege escalationCVE-2026-105750Mediumdocling: Docling: `enable_local_fetch` is not enforced in HTML browser-rendering modeCVE-2026-105753Mediumvllm: vLLM: Mirrored multimodal IPC caches desync after a rejected request — a later request reusing the same media hash trips a receiver…CVE-2026-105752Lowvllm: vLLM: Harmony tool continuations drop `cache_salt` — restoring a cross-tenant prefix-cache membership oracleCVE-2026-102598MediumWerkzeug: Werkzeug safe_join() allows Windows special device namesCVE-2026-96749Highpymongo: PyMongo: PYTHON-5996 Heap out-of-bounds write via signed size overflow in BSON document encodingCVE-2026-96748Highpymongo: PyMongo: PYTHON-5986 Host injection in PyMongo connection string parsing via percent-encoded delimiters

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo