PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-59CR-6R3X-644WMediumGitPython: GitPython submodule update path traversal can write outside the repositoryCVE-2026-87819HighGitPython: GitPython: Denial of Service via catastrophic backtracking (ReDoS) in Actor.name_email_regex — commit author/committer field parsingGHSA-WHH4-5Q6C-9V3XMediumgitpython: GitPython: --no-index bypasses diff unsafe-option protections and enables a blind local-file content oracleCVE-2026-87817Highgitpython: GitPython: Repository content can impersonate the git directory, leading to arbitrary code executionCVE-2026-84377Mediumlitellm: LiteLLM: Authenticated SSRF and provider-credential exfiltration via unvalidated request-body routing parametersCVE-2026-101918MediumPyJWT: PyJWT: Unauthenticated RecursionError DoS in pre-verification payload parse (PyJWKClient.get_signing_key_from_jwt / verify_signature=False)CVE-2026-97688Mediumurllib3: urllib3: Chunked Deflate streaming can enter an infinite loopCVE-2026-97689Highurllib3: urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memoryCVE-2026-97687Highurllib3: urllib3: HTTPS proxy TLS configuration may be ignored or overriddenCVE-2026-102270Mediumpyjwt: PyJWT: ReDoS vulnerability when calling the `is_pem_format` function.CVE-2026-102266HighPyJWT: PyJWT: PyJWK accepts empty HMAC keys, bypassing PyJWT's empty-key validationCVE-2026-102265MediumpyJWT: PyJWT: Uncaught RecursionError in jwt.decode() on deeply nested token headerCVE-2026-102269MediumPyJWT: PyJWT: Non-canonical signature segments enable raw-token revocation bypassCVE-2026-102268CriticalPyJWT: PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guardCVE-2026-102273HighPyJWT: PyJWT accepts public JWK containers as HMAC secretsCVE-2026-102267HighPyJWT: PyJWT: PyJWKClient follows redirects when fetching JWKSCVE-2026-102271Highpyjwt: PyJWT: Public keys in DER form are accepted as HMAC secrets, bypassing the CVE-2022-29217 guardCVE-2026-102272HighPyJWT: PyJWT BOM BypassCVE-2026-101917Mediumpyjwt: PyJWT: PyJWKClient still amplifies unauthenticated JWKS fetches on unknown kid values (incomplete fix of CVE-2026-48524)CVE-2026-102274MediumPyJWT: PyJWT: Malformed RSA JWK aborts parsing of an entire JWK SetCVE-2026-49265Mediumoauthlib: Oauthlib: Timing Attack Vulnerability in PKCE code_verifier Comparison (CWE-208)CVE-2026-49264Mediumoauthlib: Oauthlib : Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generationCVE-2026-57443Highscbe-aethermoore: SCBE-AETHERMOORE Unauthenticated AetherBrowser Ops API Exposes Operator Email DigestsGHSA-62MM-XWMV-CRHGHighkhoj: khoj has an unauthenticated path traversal in /home/ endpoint that allows file read from server filesystemCVE-2026-57179Mediumsocial-auth-core: social-auth-core has a Session Fixation issue

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo