PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-115580Highpypdf: pypdf: Possible long runtimes for large xref table header limitsCVE-2026-115419Highstrands-agents: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerCVE-2026-115586Highvirtualenv: virtualenv: Bash activator leaves the --prompt value unescaped in PS1 when promptvars is off, so prompt expansion later executes it…CVE-2026-115355Highmistune: Mistune: Path Traversal and XSS in Include directiveCVE-2026-115774MediumTwisted: Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCHCVE-2026-115776HighTwisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line BufferCVE-2026-115778HighTwisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted conch Telnet Transport via an Unbounded Subnegotiation BufferCVE-2026-115775HighTwisted: Twisted: Unauthenticated Remote Denial of Service in the Twisted words domish XML Element Stream via an Unbounded Element TreeCVE-2026-115877MediumTwisted: Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header ValueCVE-2026-114050Mediumvllm: vLLM: Forged multimodal UUID + P0/P1 processor-cache eviction drift: unauthenticated remote crash of the whole vLLM engineCVE-2026-113721Mediumvirtualenv: virtualenv: Generated files can follow existing destination linksGHSA-78G4-XQWV-Q3G8Highpillow: Pillow: Bundled libopenjp2 2.5.4 in all wheels since 11.1.0 carries OSV-2025-219 heap-buffer-overflow write reachable from…CVE-2026-113789Mediumpypdf: pypdf: Possible long runtimes/large memory usage when retrieving form fieldsCVE-2026-113790Mediumpypdf: pypdf: Possible large memory usage when parsing arrays and dictionariesCVE-2026-113791Mediumpypdf: pypdf: Possible large memory usage when parsing content streamsCVE-2026-114145HighGitpython: GitPython validates a submodule's ".git" path only after cloning into it (RCE)CVE-2026-75508Highgraphql-core: GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limitCVE-2026-75507Highgraphql-core: GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation ruleCVE-2026-114140Highnbconvert: nbconvert: Arbitrary file write through path traversal in cell output filenames when exporting to md, latex, rst and asciidocCVE-2026-114603Mediumopentelemetry-api: OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-apiCVE-2026-114134Highblack: Black: GitHub Action installs unvalidated required-version from pyproject.tomlCVE-2026-114137Highdjangorestframework: Django REST framework: TokenProxy.delete() reports success and revokes nothingCVE-2026-114138Highdjangorestframework: Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiationCVE-2026-114136Highdjangorestframework: Django REST framework: JSONParser applies an attacker-named codec to the request streamCVE-2026-96778HighPillow: Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo