PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-V396-V7Q4-X2QJHighGitPython: GitPython unsafe clone option gate bypass through joined short optionsCVE-2026-59886Highpyasn1: pyasn1: Uncontrolled resource consumption when converting decoded REAL valuesCVE-2026-59885Highpyasn1: pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of serviceCVE-2026-59884Highpyssn1: pyasn1 BER/CER/DER decoder denial of service via unbounded long-form tag IDsCVE-2026-59890Mediumsetuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD) on macOS APFS/HFS+CVE-2026-59205Highpillow: Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatchCVE-2026-59204Highpillow: Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of serviceCVE-2026-59203Mediumpillow: Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of serviceCVE-2026-59200HighPillow: Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()CVE-2026-59199HighPillow: Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflowCVE-2026-59198MediumPillow: Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated imagesCVE-2026-59197HighPillow: Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`CVE-2026-61740Criticallightrag-hku: LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionCVE-2026-61736Criticallightrag-hku: LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsCVE-2026-59929Mediummistune: Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionCVE-2026-59930Mediummistune: Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with…CVE-2026-59924Mediummistune: Mistune: Arbitrary File Read via Include directive path traversalCVE-2026-59922Highmistune: Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)CVE-2026-59926Mediummistune: Mistune: XSS via unescaped class option in Admonition directiveCVE-2026-59923Mediummistune: Mistune: XSS via percent-encoded javascript URI bypass in safe_url()CVE-2026-59925Highmistune: Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsCVE-2026-59927Mediummistune: Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two…CVE-2026-59928Highmistune: Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsCVE-2026-55798MediumPillow: Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pathCVE-2026-55380Highpillow: Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo