PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-77387Mediumgeopy: geopy: Regular Expression Denial of Service (ReDoS) in geopy.PointGHSA-8MCX-5RQC-VHMFHighdulwich: Dulwich: Arbitrary File Write (RCE) on Windows via Unvalidated Drive Letters in Tree PathsGHSA-35MR-4567-66VGMediumdulwich: Dulwich: Infinite Loop Denial of Service (DoS) in Packfile Object ResolutionGHSA-8W8G-WQ8H-FQ33Highdulwich: Dulwich: Symlink write-through in checkout(paths=[]) via raw os.open bypasses all symlink protectionsGHSA-5FQC-MRG8-W798Highdulwich: Dulwich: Symlink directory traversal in filter-branch index_filter via cross-commit state persistenceGHSA-CM62-GVXX-VMXXHighdulwich: Dulwich: Symlink directory traversal in stash pop allows arbitrary file write via intermediate directory symlinksCVE-2026-102830Mediumjupyterlab: JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)CVE-2026-102904Mediumjupyterlab: JupyterLab: Argument injection in JupyterLab extension uninstall exposes server-readable files and internal URLsCVE-2026-102831Highjupyterlab: JupyterLab: Cross-site scripting (XSS) in JupyterLab via notebook cells pasted from the system clipboardCVE-2026-102925Highvirtualenv: virtualenv bash and fish activation scripts execute commands embedded in pathsCVE-2026-102937Highvirtualenv: virtualenv: Command injection via --prompt in activate.bat (batch activator)CVE-2026-102999Highpypdf: pypdf: Possible long runtimes with large amount of embedded filesCVE-2026-102998Highpypdf: pypdf: Possible long runtimes when generating appearance streamsCVE-2026-103000Highpypdf: pypdf: Possible large memory usage when retrieving alphabetical page labelsCVE-2026-102997Highpypdf: pypdf: Possible long runtimes for partially malformed FlateDecode streams (Follow-up)CVE-2026-102996Highpypdf: pypdf: Possible large memory usage when parsing font dataCVE-2026-102995Highpypdf: pypdf: Possible large memory usage for large /ToUnicode streams (Follow-up 2)CVE-2026-102994Highpypdf: pypdf: Possible long runtimes/large memory usage when parsing indirect objectsCVE-2026-102993Highpypdf: pypdf: Possible large memory usage when retrieving Roman page labelsCVE-2026-102930Highvirtualenv: virtualenv: Downloaded seed wheels (pip/setuptools) are not integrity-checked before useCVE-2026-102938Mediumvirtualenv: virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injectionCVE-2026-103001MediumPyJWT: PyJWT.decode() reintroduces options-dict mutation, enabling silent claim-verification bypass on dict reuseGHSA-3HV7-MJH2-FV65Mediumtornado: Tornado: Unbounded query-string argument count allows event-loop-stalling DoSGHSA-CHX6-46F5-W4VPHightornado: tornado: CurlAsyncHTTPClient enforces no response-size limit — decompression bomb drives unbounded memory accumulation to OOMGHSA-C2M8-H5V5-343RHightornado: Tornado: StaticFileHandler follows symlinks outside static root (path traversal)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo