PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-46447Mediumironic: OpenStack Ironic allows Boot Script Injection CVE-2026-10783Lowgradio: Gradio: Audio cache key ignores metadata when saving numpy audio outputs CVE-2026-44182Criticaljupyter_enterprise_gateway: Jupyter Enterprise Gateway: Kubernetes Manifest Injection in Jinja2 Template Rendering CVE-2026-44181Criticaljupyter_enterprise_gateway: Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection resulting in Remote Code Execution CVE-2026-47265Mediumaiohttp: AIOHTTP is vulnerable to cross-origin redirect with per-request cookies CVE-2026-10766Lowmlrun: mlrun: DataFrame hash collisions can cause dataset artifact path conflicts and silent data corruption CVE-2026-44180Criticaljupyter_enterprise_gateway: Jupyter Enterprise Gateway: ContainerProcessProxy._enforce_prohibited_ids Bypass CVE-2026-44023Highdocling-core: Docling Core: Unsafe remote filename resolution CVE-2026-44019Highdocling-core: Docling Core: Insufficient validation of image reference URIs CVE-2026-47214Highdocling: Docling: Unsafe URI and Path Handling in HTML Backend CVE-2026-44022Mediumdocling: Docling: Potential Path Traversal via LaTeX \includegraphics and \input Commands CVE-2026-44020Highdocling: Docling: Unsafe XML Entity Expansion in USPTO Patent Backend CVE-2026-44018Mediumdocling: Docling: Unsafe Archive Extraction and XML Parsing in METS-GBS Backend CVE-2026-44016Highdocling: Docling: Unsafe Playwright-based HTML Rendering CVE-2026-43980Mediummalla: malla: Stored XSS via Meshtastic node names in multiple frontend pages CVE-2026-34993Mediumaiohttp: AIOHTTP is Vulnerable to Deserialization of Untrusted Data CVE-2026-44017Highdocling: Docling: Unsafe Zip Extraction in EasyOCR Model Download CVE-2026-7666Lowdjango: Django fails to prevent reuse of a partially-initialized connection after a failed `STARTTLS` handshake CVE-2026-6873Lowdjango: Django: signed cookies are vulnerable to salt namespace collisions CVE-2026-5241Hightransformers: huggingface/transformers: Arbitrary Code Execution During Model Initialization in the LightGlue Model Loading Path CVE-2026-44546Lowdaphne: daphne: WebSocket handshake header smuggling through autobahn splitlines() mishandling of non-standard line separators CVE-2026-8404Lowdjango: Django: UpdateCacheMiddleware may disclose cached responses due to case-sensitive Cache-Control handling CVE-2026-48587Lowdjango: Django: has_vary_header may expose cached responses when Vary values contain whitespace CVE-2026-35193Lowdjango: Django: UpdateCacheMiddleware may disclose private cached responses by omitting Authorization from Vary CVE-2026-44545Mediumdaphne: daphne: Unauthenticated attackers can cause excessive memory consumption by sending arbitrarily large WebSocket messages/frames

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.