PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-96747Mediumpymongo: PyMongo: PYTHON-5990 Forced Unix domain socket connection via a .sock KMS endpoint in client-side field level encryptionCVE-2026-102275MediumPyJWT: PyJWT accepts inconsistent OKP x/d JWKs, causing public/private key identity confusionCVE-2026-105758Mediumvllm: vLLM: Qwen2-VL / Qwen3-VL video samplers bound on request-controlled max_frames, which the num_frames ceiling does not reachCVE-2026-105760Mediumvllm: vLLM: GLMGA video sampling permits request-driven CPU and memory exhaustionCVE-2026-105754Mediumvllm: vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied featuresCVE-2026-105757Mediumvllm: vLLM: Structured-output request errors escape the request boundary and terminate the shared EngineCore — engine-fatal denial of service (3…CVE-2026-105755Mediumvllm: vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and…CVE-2026-105756Mediumvllm: vLLM: Loose `cache_salt` validation lets a single request kill EngineCore on LMCache-MP deployments — uncaught downstream `ValueError`…CVE-2026-104843Mediumuv: uv: Path traversal on Windows through wheel extractionCVE-2026-102991MediumMako: Mako: Path traversal via drive-letter URI on Windows in TemplateLookupCVE-2026-104874Mediummultidict: Multidict: Reference leak in CIMultiDict/MultiDict items-view union and subtractionCVE-2026-88029Mediumpymongo: pymongo: PYTHON-5994 Use exact match for file ID in GridFS delete methodsCVE-2026-86597Mediumsnowflake-sdk: Snowflake drivers writes sensitive information to logsCVE-2026-104851Highfsspec: fsspec: Server-Side Template Injection in ReferenceFileSystem leads to Remote Code ExecutionGHSA-V853-P72Q-4CFWHighquart: Quart leaks raw request body (incl. plaintext passwords) to stdout via stray debug print in Body.__await__CVE-2026-104873Highlanggraph-sdk: LangGraph SDK custom auth silently ignores actions= on resource decoratorsCVE-2026-105751Mediumdocling: Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocument backendCVE-2026-9205Criticallangflow: Langflow: Weak Fernet Key via random.seed()CVE-2026-8505Criticallangflow: Langflow: Unauthenticated Flow Execution via Webhook Authentication BypassCVE-2026-51886Highlangflow: Langflow: Title Authenticated Remote Code Execution in validate_code via Malicious Decorators DescriptionCVE-2026-7700Highlangflow: Langflow: Prompt injection in Langflow Smart Transform can lead to code executionCVE-2026-71416Highheadroom-ai: Headroom vulnerable to Cross-Site WebSocket Hijacking (CSWSH)GHSA-V2F8-6655-7GRJCriticalvibe-trading-ai: Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chainGHSA-5RMQ-CHC7-M22FHighvibe-trading-ai: Vibe-Trading file-read tools expose arbitrary server-readable filesGHSA-JQMF-MX4F-HFR6Criticalvibe-trading-ai: Vibe-Trading LLM-callable tools permit command execution, code injection, and SSRF

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo