PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2018-1000164Highgunicorn: Gunicorn contains Improper Neutralization of CRLF sequences in HTTP headers CVE-2018-1000159Hightlslite-ng: tlslite-ng off-by-one error on mac checking CVE-2018-6596Criticaldjango-anymail: Django-Anymail prone to a timing attack CVE-2018-0023Highjsnapy: JSNAPy allows unprivileged local users to alter files under the directory CVE-2018-9856HighKotti: Kotti CSRF in the local roles implementation CVE-2018-1002150Criticalkoji: Koji hub call does not perform correct access checks CVE-2018-8097Criticaleve: Eve allows execution of arbitrary code CVE-2018-7750Criticalparamiko: Paramiko not properly checking authentication before processing other requests CVE-2018-6594Highpycrypto: Pycrypto generates weak key parameters CVE-2018-5773Mediummarkdown2: markdown2 is vulnerable to cross-site scripting CVE-2016-9190HighPillow: Arbitrary code using "crafted image file" approach affecting Pillow CVE-2017-5524MediumPlone: Plone Sandbox Escape CVE-2018-8768Highnotebook: Jupyter Notebook file bypasses sanitization, executes JavaScript

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo