PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-24098Mediumapache-airflow: Apache Airflow UI Exposes DAG Import Errors to Unauthorized Authenticated Users CVE-2026-25904Mediummcp-run-python: MCP Run Python Deno Sandbox Misconfiguration Allows SSRF Attacks via Localhost Access CVE-2026-25905Mediummcp-run-python: MCP Run Python has a Sandbox Escape & Server Takeover Vulnerability CVE-2026-1709Criticalkeylime: Keylime Missing Authentication for Critical Function and Improper Authentication GHSA-4F84-67CV-QRV3Criticaldydx-v4-client: A single post-release of dydx-v4-client contained obfuscated multi-stage loader CVE-2026-25650Highmcp-salesforce-connector: MCP-Salesforce's arbitrary attribute access leads to disclosure of Salesforce auth token CVE-2026-25640Highpydantic-ai: Pydantic AI has Stored XSS via Path Traversal in Web UI CDN URL CVE-2026-25592Criticalsemantic-kernel: Semantic Kernel has Arbitrary File Write via AI Agent Function Calling in .NET SDK CVE-2026-25580Highpydantic-ai: Pydantic AI has Server-Side Request Forgery (SSRF) in URL Download Handling CVE-2026-25732Highnicegui: NiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File Write CVE-2026-1707Highpgadmin4: pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability CVE-2026-25516Mediumnicegui: NiceGUI's XSS vulnerability in ui.markdown() allows arbitrary JavaScript execution through unsanitized HTML content CVE-2026-25198Mediumweb2py: web2py has an Open Redirect Vulnerability CVE-2026-25632Criticalepyt-flow: EPyT-Flow vulnerable to unsafe JSON deserialization (__type__)CVE-2026-25517Mediumwagtail: Wagtail has improper permission handling on admin preview endpoints CVE-2025-70560Highboltz: Boltz contains an insecure deserialization vulnerability in its molecule loading functionality CVE-2025-64712Criticalunstructured: Unstructured has Path Traversal via Malicious MSG Attachment that Allows Arbitrary File Write CVE-2026-1312MediumDjango: Django has an SQL Injection issue CVE-2026-1287HighDjango: Django has an SQL Injection issue CVE-2026-1207HighDjango: Django has an SQL Injection issue CVE-2026-1285LowDjango: Django has Inefficient Algorithmic Complexity CVE-2025-14550LowDjango: Django has Inefficient Algorithmic Complexity CVE-2025-13473LowDjango: Django has Observable Timing Discrepancy CVE-2025-70959Mediumtendenci: Tendenci CMS Contains a Cross-site Scripting Vulnerability in its Jobs Module CVE-2025-70960Mediumtendenci: Tendenci CMS contains a stored Cross-site Scripting (XSS) vulnerability in the Forums module

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.