PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-44181Criticaljupyter_enterprise_gateway: Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution CVE-2026-47265Mediumaiohttp: AIOHTTP is vulnerable to cross-origin redirect with per-request cookies CVE-2026-10766Lowmlrun: mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption CVE-2026-44180Criticaljupyter_enterprise_gateway: Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass CVE-2026-44023Highdocling-core: Docling Core: Unsafe remote filename resolution CVE-2026-44019Highdocling-core: Docling Core: Insufficient validation of image reference URIs CVE-2026-47214Highdocling: Docling: Unsafe URI and Path Handling in HTML Backend CVE-2026-44022Mediumdocling: Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands CVE-2026-44020Highdocling: Docling: Unsafe XML Entity Expansion in USPTO Patent Backend CVE-2026-44018Mediumdocling: Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend CVE-2026-44016Highdocling: Docling: Unsafe Playwright-based HTML Rendering CVE-2026-43980Mediummalla: malla: Stored XSS via Meshtastic node names in multiple frontend pages CVE-2026-34993Mediumaiohttp: AIOHTTP is Vulnerable to Deserialization of Untrusted Data CVE-2026-44017Highdocling: Docling: Unsafe Zip Extraction in EasyOCR Model Download CVE-2026-6657Mediumjupyter-server: jupyter-server is vulnerable to CORS origin validation bypass when the `allow_origin_pat` configuration is used CVE-2026-7666Lowdjango: Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake CVE-2026-5241Hightransformers: huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path CVE-2026-44546Lowdaphne: daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators CVE-2026-44545Mediumdaphne: daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames CVE-2026-4035Criticalmlflow: MLflow: Environment variable injection in AI Gateway secrets enables server-side credential exfiltration CVE-2026-10692Lowcode-index-mcp: Code Index MCP is vulnerable to Uncontrolled Resource Consumption CVE-2026-47117Criticalopenmed: OpenMed vulnerable to remote code injection through privacy-filter model loading path CVE-2026-5422Mediumjupyter-server: Jupyter Server vulnerable to Path Traversal via incorrect root directory boundary check in _get_os_path() CVE-2026-3514Highprefect: Prefect has an Authentication Middleware Bypass when URL paths are appended with 'health' or 'ready'CVE-2026-3198Mediummlflow: MLflow: Any authenticated user can enumerate all gateway secrets, endpoints, and model definitions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.