PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-75526Mediumdjango-cms: django CMS: Stored XSS in edit-mode plugin exception renderingCVE-2026-55468Mediumwagtail: Wagtail: Improper restriction handling on Pages admin APICVE-2026-54624Mediumdjango-cms: django CMS: Structure endpoint bypasses page-view permissionCVE-2026-54622Mediumdjango-cms: django CMS: Clipboard copy IDOR discloses unauthorized plugin contentCVE-2026-54263Highwagtail: Wagtail: Reflected XSS in dynamic image URL generator viewCVE-2026-54262Mediumwagtail: Wagtail: Pages translations can be created without page permissions when using simple_translationCVE-2026-54261Mediumwagtail: Wagtail: Improper permission handling in image previewCVE-2026-54260Mediumwagtail: Wagtail: Denial of service via unbounded filter specs in the image previewCVE-2026-54259Mediumwagtail: Wagtail: Improper restriction handling on Documents and Images chosen endpointsGHSA-MC9M-6FM9-PGHCMediumzoo-kcl: Zoo Design Studio: Memory-corruption in memory handling of lib-kclGHSA-JGVR-6X5W-HX5WMediumzoo-kcl: Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-serviceGHSA-5P3M-VHH6-9236Mediumstigmem-node: stigmem-node has blind SSRF via unvalidated webhook subscription delivery_addressCVE-2026-55253Highlanggraph-checkpoint-mongodb: LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposureCVE-2026-55244Mediumasteval: asteval has a Sandbox Escape via BaseException SubclassesGHSA-9W56-46F6-3QHXMediumasteval: asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval InterpreterGHSA-P77J-G7H5-R2VWHighgeolens: GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)CVE-2026-53964Highdocument-merge-service: Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)CVE-2026-53951Highcopier: Copier has a trust-prefix bypass via path traversal that runs tasks unpromptedCVE-2026-55236Mediumlanggraph-api: langgraph-api: Incomplete assistant authorization in LangGraph Server run creationCVE-2026-55235Mediumlanggraph-api: langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authenticationCVE-2026-73974Mediumlinuxfabrik-lib: linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)CVE-2026-71417Highlemur: Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking itCVE-2026-71322Mediumlemur: Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = FalseCVE-2026-71317Mediumlemur: Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authorityCVE-2026-71308Highlemur: Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo