PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59894Mediumsqlparse: sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashesCVE-2026-68517Mediumglances: Glances: REST API CORS Credentials Guard Uses Exact-Match Instead of Membership Test — Bypassed by Any Multi-Origin Allowlist Containing…CVE-2026-68518Highglances: Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstructionCVE-2026-53708Mediummcp-contextforge-gateway: ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)CVE-2026-12243Highnltk: nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded SequencesCVE-2026-73559Mediumvllm: vLLM: Completion prompt lists fan out into unbounded engine requestsGHSA-RM43-82J9-R4MJHighatomic-agents-stack: atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file readCVE-2026-54249Mediumpydantic-ai-slim: Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentialsCVE-2026-55074Highansible-jailexec: Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)CVE-2026-55071Highstata-mcp: MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`CVE-2026-68970Mediumapache-airflow: Apache Airflow Task SDK fails to mask list-shaped JSON VariablesCVE-2026-68969Mediumapache-airflow: Apache Airflow bulk endpoints log Variable and Connection secrets in cleartextCVE-2026-68971Mediumapache-airflow: Apache Airflow missing team context permits cross-team Dag actions and XCom readsCVE-2026-67260Highapache-airflow: Apache Airflow scheduler unsafely deserializes human-in-the-loop task next_kwargsCVE-2026-59242Mediumapache-airflow: Apache Airflow XCom API permits unsafe deserialization through JSON string literalsCVE-2026-67587Highapache-airflow: Apache Airflow Task SDK Callback deserialization can import arbitrary modules in the schedulerCVE-2026-54183Mediumapache-airflow: Apache Airflow Variables UI fails to mask sensitive values in deeply nested iterablesCVE-2026-65017Mediumapache-airflow: Apache Airflow Config API exposes team-scoped sensitive configuration valuesCVE-2026-68076Mediumapache-airflow: Apache Airflow environment-variable secrets backend permits cross-team credential useCVE-2026-68968Highapache-airflow: Apache Airflow Backfill API parser discrepancy permits cross-DAG authorization bypassCVE-2026-59244Mediumapache-airflow: Apache Airflow exposes dict-valued var.json secrets in Rendered TemplatesCVE-2026-58076Highapache-airflow: Apache Airflow exception-node deserialization permits arbitrary callable executionCVE-2026-52776Highcompliance-trestle: compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0CVE-2026-9318Mediumtablib: tablib: Stored XSS in the HTML export via unescaped dataset titleCVE-2026-18948Criticalfeast: Feast vulnerable to arbitrary code execution via unsafe deserialization of dill-serialized UDFs

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo