PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-48817Mediumstarlette: Starlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`GHSA-537C-GMF6-5CCFHighcryptography: Vulnerable OpenSSL included in cryptography wheelsCVE-2026-54274Mediumaiohttp: aiohttp: Incomplete websocket frame payloads bypass memory limitsCVE-2026-54275Lowaiohttp: aiohttp: TLS Server Hostname Override Is Ignored When Reusing HTTPS ConnectionsCVE-2026-54280Lowaiohttp: aiohttp: Payload Response Resources Are Not Closed After Mid-Body DisconnectCVE-2026-54273Mediumaiohttp: aiohttp: HTTP/1 Pipelined Requests Queue Without LimitCVE-2026-54278Mediumaiohttp: aiohttp: Unread Compressed Request Bodies Bypass client_max_size During CleanupCVE-2026-54277Mediumaiohttp: aiohttp: C HTTP Parser Bypasses max_line_size for Fragmented LinesCVE-2026-54276Mediumaiohttp: aiohttp: DigestAuthMiddleware Applies Credentials to Cross-Origin Redirect ChallengesCVE-2026-54279Lowaiohttp: aiohttp: Host-Only Cookies Become Domain Cookies After CookieJar PersistenceCVE-2026-50269Lowaiohttp: aiohttp: CRLF injection in multipart headersCVE-2026-48525Mediumpyjwt: PyJWT: Unauthenticated DoS via unbounded Base64URL decoding of unused payload segment in b64=false detached JWSCVE-2026-48522MediumPyJWT: PyJWKClient: missing scheme allowlist enables CVE-2024-21643-class SSRF + token forgery via file://, ftp://, data: schemesCVE-2026-48526Highpyjwt: PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowedCVE-2026-48523Mediumpyjwt: PyJWT: Algorithm allow-list bypass when decoding with `PyJWK` / `PyJWKClient` keysCVE-2026-48524Lowpyjwt: PyJWKClient unbounded JWKS endpoint requests via attacker-controlled kid values (DoS)CVE-2026-54421Mediumironic: OpenStack Ironic can return unredacted sensitive information when applying a PATCH to update fields in volume propertiesCVE-2026-45833Criticalchromadb: ChromaDB has a code injection vulnerabilityCVE-2026-45831Highchromadb: ChromaDB's SimpleRBACAuthorizationProvider doesn't check which tenant, database, or collection a permission applies toCVE-2026-45830Highchromadb: ChromaDB allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collectionCVE-2026-49854Lowtornado: Tornado has out-of-bounds memory access via C extensionCVE-2026-48156Mediumpypdf: pypdf: Possible long runtimes for zero-only width values in cross-reference streamsuntimes for zero-only width values in cross-reference…CVE-2026-48155Mediumpypdf: pypdf: Possible large memory usage for large offsets for layout mode textCVE-2026-48099Highwsgidav: WsgiDAV encoded dot segments can escape filesystem share rootsCVE-2026-48053Mediumkolibri: Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo