PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-48487Mediumzeroconf: zeroconf: Unvalidated rdlength in record payload readers allows LAN-local cache corruption via crafted mDNS packetCVE-2026-46611Mediumglances: Glances: XML-RPC Server Missing Host Header Validation Enables DNS Rebinding AttackCVE-2026-46608Highglances: Glances: XML-RPC Multi-Origin CORS Configuration Silently Falls Back to Wildcard (Incomplete Fix for CVE-2026-33533)CVE-2026-46607Highglances: Glances has Insecure Pickle Deserialization in its Version Cache that Leads to Arbitrary Code ExecutionCVE-2026-46606Highglances: Glances is Vulnerable to Command Injection via KVM/QEMU VM Domain Names in glances/plugins/vms/engines/virsh.pyCVE-2026-46488Criticalmotioneye: motionEye: Authentication possible via password hashCVE-2025-67303Highcomfyui-manager: ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)CVE-2026-56104Criticalchainlit: Chainlit contains a session hijacking vulnerabilityCVE-2026-12479Mediumkeras: Keras: DiskIOStore permits path traversal through crafted layer namesCVE-2026-32315Mediummotioneye: motionEye's World-Readable Configuration File Exposes Admin Password HashCVE-2026-31978Mediummotioneye: motionEye has an Arbitrary File Read via Path Traversal in Picture/Movie Preview EndpointCVE-2026-21887Highpycti: OpenCTI has Semi-Blind SSRF via Unvalidated External URL in Data Ingestion FeatureCVE-2024-37155Mediumpycti: OpenCTI May Bypass Introspection RestrictionCVE-2025-66336Highdoris-mcp-server: Apache Doris MCP Server is vulnerable to SQL Injection via metadata query pathCVE-2026-56265Criticalcrawl4ai: Crawl4AI: authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API serverCVE-2026-12799Lowlitellm: BerriAI litellm: UI User Enumeration leads to System-Wide Information DisclosureCVE-2026-12798Lowlitellm: BerriAI litellm has SSRF via Unvalidated spec_path URL in MCP OpenAPI Spec LoaderCVE-2026-12797Lowlitellm: BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async EndpointsCVE-2026-12796Lowlitellm: BerriAI litellm: SSO Login Does Not Invalidate Previous UI Session TokensCVE-2026-12795Mediumlitellm: LiteLLM: SSO Debug Flow Has Improper AuthenticationCVE-2026-12773Mediumlitellm: LiteLLM: MCP Proxy Has Improper AuthenticationCVE-2026-12770Lowlitellm: LiteLLM: Admin Key Handler Has Improper AuthorizationCVE-2026-12771Lowlitellm: LiteLLM: M2M JWT Handler Has Improper AuthorizationCVE-2026-12772Lowlitellm: LiteLLM: PROXY_ADMIN database API Key Generator Has Insufficient Session ExpirationCVE-2026-5366Criticalprefect: Prefect has Git Flag Injection via commit_sha and directories Parameters Leading to Remote Code Execution (RCE)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo