PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-71307Highlemur: Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the…CVE-2026-71303Highlemur: Lemur: Incomplete fix for GHSA-v2wp-frmc-5q3v -- ACME authority update endpoint allows non-admin to replace `acme_url` with internal IP,…CVE-2026-70667Mediumlemur: Lemur: SSRF protection in certificate revocation checking bypassable via HTTP redirects and DNS rebinding (incomplete fix for…CVE-2026-70666Highlemur: Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLsCVE-2026-54723Mediumdevpi-server: devpi-server may leak database contentsGHSA-WG9G-W2J2-8PGRHighmonai: MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy filesGHSA-RGHG-Q7WP-9767HighMONAI: MONAI vulnerable to OS command injectionGHSA-QXQ5-QHX6-94QWHighmonai: Incomplete Fix in MONAI: algo_from_pickle() pickle.loads() RCE still present in v1.5.2 despite GHSA-89gg-p5r5-q6r4 claiming patchCVE-2026-55211Criticalsurfio: surfio has an out-of-bounds readCVE-2026-55209Criticalresdata: resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds ReadCVE-2026-68922Mediummobsf: MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP UploadsCVE-2026-68923Mediummobsf: MobSF's CSRF checks not enforced after Django migrationCVE-2026-68927Lowmobsf: MobSF has SSRF port restriction bypass in assetlinks_checkCVE-2026-68924Mediummobsf: MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK ExtractionCVE-2026-55178High@geolens/sdk: GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile…CVE-2026-70657Mediumcopyparty: Copyparty vulnerable to file/dirkey confusionCVE-2026-64849Criticalmlflow: MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS…GHSA-J659-8XH6-5PQ5Highatomic-agents-stack: atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out…GHSA-XHCR-CQFR-M3HVHighatomic-agents-stack: atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)CVE-2026-59893Highsqlparse: sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)CVE-2026-54284Highsqlparse: sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps triggerCVE-2026-71491Highsqlparse: sqlparse: Quadratic O(n²) DoS in group_commentsCVE-2026-68520Mediumglances: Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/configCVE-2026-68519Highglances: Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)CVE-2026-62982Highglances: Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo