PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-48519Criticallangflow: Langflow: Unauthenticated RCE in Shareable PlaygroundsCVE-2026-42867Mediumlangflow: Langflow: Path Traversal in Knowledge Bases API via Creation EndpointCVE-2026-41523Highvllm: vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code ExecutionCVE-2026-33760Highlangflow: Langflow: IDOR/BOLA in Monitor API — Missing Ownership Enforcement on 7 Endpoints CVE-2026-12398Highgalaxy-ng: Galaxy NG: command injection vulnerabilityCVE-2026-55443Mediumlangchain: LangChain: Path traversal and sandbox escape in LangChain file-search middleware and loadersCVE-2026-54293Highnltk: Natural Language Toolkit (NLTK): URL-Encoded Path Traversal in nltk.data.load() Allows Arbitrary Local File ReadGHSA-GJ48-438W-JH9VMediumbleach: Bleach clean() / Cleaner() fails to sanitize dangerous URI schemes in allowed formaction attributesGHSA-G75F-G53V-794XMediumbleach: Bleach linkify(parse_email=True) CPU exhaustion via unbounded email regex scanningGHSA-8RFP-98V4-MMR6Lowbleach: Bleach: URI sanitization allows disallowed URI schemes with Unicode > U+00A0 in outputCVE-2026-54531Mediumpypdf: pypdf: Possible infinite loop when processing outlines/bookmarks in writerCVE-2026-54530Mediumpypdf: pypdf: Possible infinite loop when retrieving fonts for layout-mode text extractionCVE-2026-49461Mediumpypdf: pypdf: Possible large memory usage for form XObjects during text extractionCVE-2026-49460Mediumpypdf: pypdf: Inefficient decoding of FlateDecode PNG predictor streamsCVE-2026-48735Mediumpypdf: pypdf: Manipulated XMP metadata streams can exhaust RAMCVE-2026-54283Highstarlette: Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoSCVE-2026-54282LowStarlette: Starlette: Unvalidated request path concatenated into authority poisons request.url.hostnameGHSA-PW6J-QG29-8W7FMediumtornado: Tornado: CurlAsyncHTTPClient leaks per-request credentials on handle reuseCVE-2026-53539Highpython-multipart: python-multipart: Quadratic-time querystring parsing with semicolon separators causes CPU denial of serviceCVE-2026-53540Lowpython-multipart: python-multipart: Negative Content-Length in parse_form buffers the entire body in memoryCVE-2026-53538Lowpython-multipart: python-multipart: Semicolon treated as querystring field separator enables parameter smugglingCVE-2026-53537Lowpython-multipart: python-multipart: Content-Disposition parameter smuggling via RFC 2231/5987 extended parametersCVE-2026-49853Hightornado: Tornado: Authorization header forwarded across cross-origin redirects in SimpleAsyncHTTPClientCVE-2026-49855Hightornado: tornado AsyncHTTPClient accumulates decompressed chunks without size limit (gzip bomb)CVE-2026-48818Highstarlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo