PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49299Mediumneutron: OpenStack Neutron has an Incorrect Authorization issueGHSA-QP9X-WP8F-QGJJMediumtuf: tuf has platform-dependent delegation path matchingCVE-2026-42563Highdulwich: Dulwich Vulnerable to Command Injection via Merge Driver PathCVE-2026-42305Highdulwich: Dulwich has an arbitrary file write via NTFS-hostile tree entries on WindowsCVE-2026-43000Mediumkeystone: OpenStack Keystone has an Incorrect Authorization issueCVE-2026-44394Mediumkeystone: OpenStack Keystone's federated token rescoping mechanism doesn't propagate the original token's expiry to the newly issued tokenCVE-2026-42999Mediumkeystone: OpenStack Keystone has an Authorization BypassCVE-2026-42998Mediumkeystone: OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credentialCVE-2026-47144Mediumshamefile: Shamefile has an arbitrary file read via shamefile.yaml in shame nextCVE-2026-46526Mediumlocal-deep-research: local-deep-research has an SSRF bypass in `safe_get`CVE-2026-46439Highcompliance-trestle: compliance-trestle Vulnerable to Remote Code Execution via Recursive Server-Side Template Injection (SSTI)CVE-2026-46380Mediumcompliance-trestle: compliance-trestle Vulnerable to SSRF in Remote Fetching SubsystemCVE-2026-44730Highpycti: OpenCTI: Privilege escalation via graphQL API is abusable by organization admins, due to incorrect ACL on userEdit relationAddCVE-2026-46345Highcompliance-trestle: compliance-trestle - jinja has an Arbitrary File Write via Path TraversalCVE-2026-45774Mediumcompliance-trestle: compliance-trestle Profile Import has an Arbitrary File Read via trestle:// URI and Relative Path TraversalCVE-2026-45725Highcompliance-trestle: compliance-trestle Remote Fetching Mechanism has an Arbitrary File Write via Cache Path TraversalCVE-2026-45309Mediumasyncssh: AsyncSSH `AuthorizedKeysFile %u` path traversal allows attacker-selected authorized keys to authenticate a traversal usernameCVE-2026-25879Criticallangroid: Langroid has Prompt to SQL Injection, Leading to RCECVE-2026-9712Lowpretix: pretix vulnerable to Authorization Bypass Through User-Controlled KeyCVE-2026-48544Hightaipy: Taipy contains a path traversal vulnerabilityCVE-2026-48545Highgradio: Gradio contains a cookie injection vulnerabilityCVE-2026-49017Highswift: OpenStack Swift: s3api middleware enters an infinite loop when processing a truncated aws-chunked PUT request bodyCVE-2026-49014Highgdal: GDAL: scanForGeometryContainers in the netCDF driver allows code execution via a stack-based buffer overflowCVE-2025-66407MediumWeblate: Weblate has a Server-Side Request Forgery issueCVE-2026-9540Mediumvllm: vllm has Improper Resource Shutdown or Release

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo