PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-R3HX-X5RH-P9VVHighdjango-haystack: django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result DeserializationCVE-2026-54254Mediumcyberdrop-dl-patched: Pixeldrain API key shared with unverified thirdparty sitesCVE-2026-54457Hightensorzero: TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpointCVE-2026-53656Mediumfiftyone: FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server dataCVE-2026-58659Highlightning: PyTorch Lightning allows arbitrary code execution through checkpoint _instantiator hyperparametersCVE-2026-54449Highlangbot: LangBot: Authenticated RCE Via MCP ConfigurationCVE-2026-54447Highgarminconnect: garminconnect Has Insecure Permission Assignment for Garmin OAuth Token StoreCVE-2026-54446Highnetlicensing-mcp: NetLicensing-MCP: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP ModeCVE-2025-61670Lowwasmtime-c-api-impl: Wasmtime: Memory leak in C API with `externref` and `anyref` typesCVE-2026-15736Highsnowflake-sqlalchemy: Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilitiesCVE-2026-12482Lowkeras: Keras: tar extraction permits symlink-based path traversalCVE-2026-62240Highcrewai-tools: crewai-tools SSRF redirect bypass exposes internal servicesGHSA-8F6J-263M-G72XMediumapp-store-server-library: Apple App Store Server Python Library: SignedDataVerifier accepts stale OCSP GOOD responses and can bypass certificate revocation checksGHSA-XF7X-X43H-RPQHHighjson-repair: json_repair: Circular JSON Schema `$ref` causes unbounded CPU DoSGHSA-7XW9-549R-8JRCHighDIRAC: DIRAC: SQL injection and lack of access control in PilotManager serviceCVE-2026-61668HighDIRAC: DIRAC: Pilot code downloaded over unverified HTTPS connectionCVE-2026-61667CriticalDIRAC: DIRAC is vulnerable to RCE in FileCatalog DatasetManager via SQL injection + evalCVE-2026-45579CriticalDIRAC: DIRAC is vulnerable to RCE in RequestManager due to eval on untrusted inputCVE-2024-27091Mediumgeonode: GeoNode: Stored XSS to full account takeoverCVE-2026-15529Mediumpyod: PyOD persistence.load deserializes untrusted artifacts before validationGHSA-H4G2-XFMW-Q2C9Highclauster: Clauster: Non-loopback deployments can serve the dashboard unauthenticated when auth.enabled is unsetCVE-2026-73498Highmcp-atlassian: mcp-atlassian: Arbitrary file read via missing path validation in confluence_upload_attachmentGHSA-WM45-QH3G-V83FHighmcp-atlassian: mcp-atlassian: Arbitrary server-side file read via attachment uploadCVE-2026-54071HighBabelDOC: BabelDOC: Arbitrary Code Execution via CMap Pickle Deserialization in babeldoc/pdfminer/cmapdb.pyGHSA-9MQM-QCWF-5QHGMediumcredsweeper: CredSweeper: Recursive archive size-limit bypass in deep scanner allows crafted compressed inputs to exhaust resources

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo