PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-23980Mediumapache-superset: Apache Superset allows privileged users to conduct error-based SQL Injection CVE-2026-23982Highapache-superset: Apache Superset Improper Authorization allows low-privileged users to bypass access controls CVE-2026-23969Mediumapache-superset: Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine CVE-2026-23983Lowapache-superset: Apache Superset allows authenticated users to view sensitive data without explicit permissions CVE-2025-27555Mediumapache-airflow: Apache Airflow exposes sensitive information in its log files CVE-2024-56373Highapache-airflow: Apache Airflow vulnerable to Code Injection in the web-server context via LogTemplate table CVE-2026-26331Highyt-dlp: yt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` option CVE-2026-26198Criticalormar: ormar is vulnerable to SQL Injection through aggregate functions min() and max()CVE-2026-2970Lowdatapizza-ai-core: datapizza-ai has unsafe deserialization via pickle.loads() in RedisCache CVE-2026-2969Lowdatapizza-ai-core: datapizza-ai: Server-Side Template Injection in ChatPromptTemplate via Jinja2 Template Handler CVE-2025-65995Mediumapache-airflow: Apache Airflow error reporting may expose full kwargs CVE-2026-2635Criticalmlflow: MLflow Use of Default Password Authentication Bypass Vulnerability CVE-2026-2033Highmlflow: MLflow Tracking Server Artifact Handler Directory Traversal Remote Code Execution Vulnerability CVE-2026-2472Highgoogle-cloud-aiplatform: Google Cloud Vertex AI SDK affected by Stored Cross-Site Scripting (XSS)CVE-2026-2473Highgoogle-cloud-aiplatform: Google Cloud Vertex AI has a a vulnerability involving predictable bucket naming CVE-2026-27482Mediumray: Ray dashboard DELETE endpoints allow unauthenticated browser-triggered DoS (Serve shutdown / job deletion)GHSA-83PF-V6QQ-PWMRLowfickling: Fickling has a detection bypass via stdlib network-protocol constructors CVE-2026-27205Lowflask: Flask session does not add `Vary: Cookie` header when accessed in some ways CVE-2026-27199Mediumwerkzeug: Werkzeug safe_join() allows Windows special device names CVE-2026-27194Highdtale: D-Tale affected by Remote Code Execution through the /save-column-filter endpoint CVE-2026-26030Criticalsemantic-kernel: Microsoft Semantic Kernel InMemoryVectorStore filter functionality vulnerable to remote code execution CVE-2026-1669Highkeras: Keras has a Local File Disclosure via HDF5 External Storage During Keras Weight Loading CVE-2026-27026Mediumpypdf: pypdf possibly has long runtimes for malformed FlateDecode streams CVE-2026-27025Mediumpypdf: pypdf has possible long runtimes/large memory usage for large /ToUnicode streams CVE-2026-27024Mediumpypdf: pypdf has a possible infinite loop when processing TreeObject

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.