PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-57178Highsocial-auth-core: social-auth-core: VK App backend accepts unsigned callback data when auth_key is missingCVE-2026-57177Mediumsocial-auth-core: social-auth-core has Login CSRF via Missing State Parameter in LoginRadius BackendCVE-2026-57176Mediumsocial-auth-core: social-auth-core Vulnerable to Account Takeover via Identity Binding Flaw in Vend BackendCVE-2026-57175Mediumsocial-auth-core: social-auth-core has an Improper Authentication issueCVE-2026-57171Highcompliance-trestle: Trestle is vulnerable to arbitrary file write via path traversal in author generate commands (Incomplete fix of CVE-2026-46345)CVE-2026-57170Highcompliance-trestle: Trestle SSTI in Jinja2 include tags allows arbitrary code execution (Incomplete fix of CVE-2026-46439)CVE-2026-59980Mediumhpack: hpack: Unbounded variable integer decoding can cause run-away computation on malformed inputGHSA-G28H-2CMM-RJ9XHighlangchain-nvidia-ai-endpoints: langchain-nvidia-ai-endpoints has local file disclosure through VLM image inputsCVE-2026-61732Criticaldecepticon-core: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM contextCVE-2026-92164Mediumstreamlink: Streamlink: HTTPSession follows HTTP redirects into file:// URLs, reading local filesGHSA-8PCW-H6W9-H46GMediumplone.app.contenttypes: plone.app.contenttypes has a Denial of Service in File Upload due to excessive filename lengthCVE-2026-57576Mediumplone.app.dexterity: plone.app.dexterity has a Denial of Service due to excessive title or description lengthCVE-2026-93421Mediummesop: Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting EndpointCVE-2026-61541Mediumzapros: Zapros has an Unbounded Content-Encoding decompression chain that allows denial of serviceCVE-2026-61652Highzapros: Zapros: Streaming decoders ignored the requested chunk size, allowing a single compressed response chunk to allocate unbounded memory…CVE-2026-57149Criticalplone.app.portlets: plone.app.portlets Vulnerable to Remote Code Execution via TALES InjectionCVE-2026-91130Criticalhomeassistant: Home Assistant: XSS in Statistics Graph CardCVE-2026-91129Mediumhomeassistant: Home Assistant: mDNS Server-Side Request ForgeryCVE-2026-86062Mediumlightrag-hku: lightrag-hku: Stored Cross-Site Scripting (XSS) in the LightRAG WebUI chat/answer renderer via ingested contentCVE-2026-85740Highlightrag-hku: lightrag-hku: SSRF via IPv6-transition address bypass (NAT64, IPv4-compatible, 6to4) of the native-markdown image-download guardCVE-2026-85734Criticallightrag-hku: lightrag-hku: No Rate Limiting on /login Endpoint Allows Brute-Force AttacksCVE-2026-85725Mediumlightrag-hku: lightrag-hku: Plaintext Passwords Compared Without Constant-Time FunctionCVE-2026-85709Mediumlightrag-hku: lightrag-hku: Sensitive Information Exposure Through Raw Exception Messages in API Error ResponsesCVE-2026-83805Mediumnautobot: Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobsCVE-2026-83801Mediumnautobot: Nautobot: Stored cross-site scripting (XSS) in object create/edit form help text

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo