PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

GHSA-Q6J3-C4WC-63VWMediumdatasette: CSRF tokens leaked in URL by canned query form CVE-2020-7695Highuvicorn: HTTP response splitting in uvicorn CVE-2020-7694Highuvicorn: Log injection in uvicorn CVE-2020-10177HighPillow: Out-of-bounds reads in Pillow CVE-2020-10379HighPillow: Buffer overflow in Pillow CVE-2020-10994HighPillow: Out-of-bounds reads in Pillow CVE-2020-11538CriticalPillow: Out-of-bounds read in Pillow CVE-2020-15120Mediumihatemoney: Authorization Bypass in I hate money CVE-2020-9485Mediumapache-airflow: Stored XSS in Apache Airflow CVE-2020-11982Criticalapache-airflow: Insecure default config of Celery worker in Apache Airflow CVE-2020-11981Criticalapache-airflow: Command injection via Celery broker in Apache Airflow CVE-2020-11978Highapache-airflow: Remote code execution (RCE) in Apache Airflow CVE-2020-11983Mediumapache-airflow: Multiple stored XSS in RBAC Admin screens in Apache Airflow CVE-2020-15110Highjupyterhub-kubespawner: Possible pod name collisions in jupyterhub-kubespawner CVE-2020-15118Highwagtail: Cross-Site Scripting in Wagtail CVE-2020-15105Mediumdjango-two-factor-auth: User passwords are stored in clear text in the Django session GHSA-6R3C-8XF3-GGRRMediumdjango-sendfile2: Directory traversal outside of SENDFILE_ROOT in django-sendfile2 CVE-2020-4071Mediumdjango-basic-auth-ip-whitelist: Timing attack on django-basic-auth-ip-whitelist CVE-2020-11090Criticalindy-node: Uncontrolled Resource Consumption in Indy Node CVE-2020-13596MediumDjango: XSS in Django CVE-2020-13254HighDjango: Data leakage via cache key collision in Django CVE-2020-10594Criticaldrf-jwt: Django Rest Framework jwt allows obtaining new token from notionally invalidated token CVE-2019-10682Highdjango-nopassword: django-nopassword stores secrets in cleartext CVE-2020-9402HighDjango: SQL injection in Django CVE-2020-11078Mediumhttplib2: CRLF injection in httplib2

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo