PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-11816Highkeras: Keras archive extraction utilities allow path traversal and arbitrary file writesCVE-2026-48045Mediumzeroconf: python-zeroconf: Unbounded TC-deferred queue allows LAN-local memory exhaustion via spoofed-source floodCVE-2026-48039Criticalmeta-ads-mcp: Meta Ads MCP: Unauthenticated HTTP MCP Tool Execution Leaks Operator Meta Access TokenCVE-2026-47781Highpdm: PDM: Project-Controlled `.pdm-plugins` Content Executes Before CLI ParsingCVE-2026-5497Highvllm: vLLM is vulnerable to an Out-of-Memory (OOM) Denial of Service (DoS) attack due to unbounded frame count processing in the…CVE-2026-10142Highkafka-python: kafka-python vulnerable to denial of service through an unvalidated protocol frame lengthCVE-2026-10143Highkafka-python: kafka-python vulnerable to denial of service through an unbounded SCRAM iteration countCVE-2026-47764Highpdm: PDM wheel installation leads to Path Traversal via overridden write_to_fsCVE-2026-47763Mediumpdm: PDM: Project-Local State and Config Writes Follow SymlinksCVE-2026-48061Mediumlitestar: Litestar: AllowedHostsMiddleware bypasses host validation via client-controlled X-Forwarded-Host headerCVE-2026-48060Highlitestar: Litestar has HTML Injection Through its CSRF TokenCVE-2026-47155Mediumvllm: vLLM's Artifact Pin Decay allows pinned deployments to load unpinned code, weights, and processorsCVE-2026-52902Mediumawxkit: awxkit has a path traversal vulnerabilityCVE-2026-49818Mediumapache-airflow-providers-samba: Apache Airflow has a Path Traversal issueCVE-2026-47734Mediumdulwich: Dulwich has unbounded memory allocation in receive-pack from crafted thin packsCVE-2026-47712Lowdulwich: Dulwich doesn't sanitize commit subjects in `porcelain.format_patch`CVE-2026-11529Lowmysql-mcp-server: MySQL MCP Server is Vulnerable to SQL Injection Through its mysql URI HandlerCVE-2026-41479Mediumauthlib: Authlib OAuth 2.0 has Open Redirect in Authorization API that allows attacker-controlled redirect_uri through unsupported response_typeCVE-2026-39922Mediumgeonode: GeoNode contains a server-side request forgery vulnerability in the service registration endpointCVE-2026-11466Lowdeepsearcher: zilliztech deep-searcher has an Incorrect Privilege Assignment issueCVE-2026-53954Mediumbugsink: Bugsink: DOS using large numbers of event tagsCVE-2026-47728Mediumbugsink: Bugsink: Project scoping missing in sourcemap and debug-file lookupCVE-2026-47716Lowbugsink: Bugsink: Issue bulk actions can affect another project’s issue if its UUID is knownCVE-2026-47715Lowbugsink: Bugsink: Issue event views can show an event from another project if its UUID is knownCVE-2026-47731Criticalait-core: NASA AMMOS Instrument Toolkit: Path traversal resulting in arbitrary file append (can be triggered over the network by unauthenticated…

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo