PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-59205Highpillow: Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatchCVE-2026-59204Highpillow: Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of serviceCVE-2026-59203Mediumpillow: Pillow EpsImagePlugin negative %%BeginBinary byte count causes infinite loop denial of serviceCVE-2026-59200HighPillow: Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()CVE-2026-59199HighPillow: Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflowCVE-2026-59198MediumPillow: Pillow TGA RLE encoder can serialize up to ~57 KB of adjacent heap data into generated imagesCVE-2026-59197HighPillow: Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`CVE-2026-61740Criticallightrag-hku: LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protectionCVE-2026-61736Criticallightrag-hku: LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed RequestsCVE-2026-59929Mediummistune: Mistune renderers/html.safe_url: HARMFUL_PROTOCOLS list misses legacy and chained schemes that historically chain to `javascript:` executionCVE-2026-59930Mediummistune: Mistune toc / TableOfContents directive: heading IDs use predictable `toc_N` numbering with no slugification, allowing collision with…CVE-2026-59924Mediummistune: Mistune: Arbitrary File Read via Include directive path traversalCVE-2026-59922Highmistune: Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)CVE-2026-59926Mediummistune: Mistune: XSS via unescaped class option in Admonition directiveCVE-2026-59923Mediummistune: Mistune: XSS via percent-encoded javascript URI bypass in safe_url()CVE-2026-59925Highmistune: Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairsCVE-2026-59927Mediummistune: Mistune directives/include: mutual `.. include::` recursion crashes the renderer with `RecursionError`, denial of service via two…CVE-2026-59928Highmistune: Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitionsCVE-2026-55798MediumPillow: Pillow: WindowsViewer.get_command() OS command injection via unescaped shell pathCVE-2026-55380Highpillow: Pillow `GdImageFile._open()`: image dimensions accepted without `_decompression_bomb_check()`CVE-2026-55379Highpillow: Pillow `BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loadingCVE-2026-54060Highpillow: Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`CVE-2026-54059Highpillow: Pillow `PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF…CVE-2026-54058Highpillow: Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)CVE-2026-55514Highvllm: vLLM denial of service via prompt embeds on M-RoPE models

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo