PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2018-20325Highdefinitions: Code injection in Danijar Definitions CVE-2018-1000872Highpykmip: PyKMIP Denial of service vulnerability CVE-2018-1000814Highaiohttp-session: aiohttp-session creates non-expiring sessions CVE-2018-1000843Highluigi: Cross-Site Request Forgery (CSRF) in Luigi CVE-2018-20133Criticalymlref: Code injection in ymlref CVE-2018-16516Mediumflask-admin: Flask-Admin Cross-site Scripting vulnerability CVE-2013-7459Criticalpycrypto: Buffer Overflow in pycrypto CVE-2018-20060Criticalurllib3: Exposure of Sensitive Information to an Unauthorized Actor in urllib3 CVE-2018-19443Hightryton: Session Fixation in Tryton CVE-2018-18920Highpy-evm: Py-EVM is vulnerable to arbitrary bytecode injection CVE-2018-19352Mediumnotebook: Jupyter Notebook XSS via directory name CVE-2018-19351Mediumnotebook: Jupyter Notebook XSS via untrusted notebooks CVE-2017-12612Highorg.apache.spark:spark-core_2.11: Apache Spark Deserialization of Untrusted Data vulnerability CVE-2018-8021Criticalsuperset: Deserialization of Untrusted Data in superset CVE-2014-1927Highpython-gnupg: python-gnupg's shell_quote function does not properly quote strings CVE-2013-7323Highpython-gnupg: python-gnupg allows context-dependent attackers to execute arbitrary commands via shell metacharacters CVE-2014-1928Highpython-gnupg: python-gnupg's shell_quote function does not properly escape characters CVE-2014-1929Criticalpython-gnupg: python-gnupg vulnerable to shell injection CVE-2015-5159Highkdcproxy: Improper Input Validation in kdcproxy CVE-2018-18074Highrequests: Insufficiently Protected Credentials in Requests CVE-2018-14572Highconference-scheduler-cli: conference-scheduler-cli Arbitrary Code Execution CVE-2015-3908Highansible: Ansible does not verify that the server hostname matches a domain name in certificates CVE-2016-3096Highansible: Link Following in ansible CVE-2013-2233Criticalansible: Ansible fails to cache SSH host keys CVE-2016-8647Mediumansible: Improper Input Validation in ansible

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo