PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-23877Mediumswingmusic: Swing Music has a Directory Traversal & Filesystem can be accessed by a non-admin user CVE-2026-23842Highchatterbot: ChatterBot Vulnerable to Denial of Service via Database Connection Pool Exhaustion CVE-2025-68616Highweasyprint: WeasyPrint has a Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect CVE-2026-22219Highchainlit: Chainlit contain a server-side request forgery (SSRF) vulnerability CVE-2026-26216CriticalCrawl4AI: Crawl4AI is Vulnerable to Remote Code Execution in Docker API via Hooks Parameter CVE-2026-26217Criticalcrawl4ai: Crawl4AI Has Local File Inclusion in Docker API via file:// URLs CVE-2026-23490Highpyasn1: pyasn1 has a DoS vulnerability in decoder CVE-2026-23535Highwlc: Weblate wlc path traversal vulnerability: Unsanitized API slugs in download command CVE-2026-23528Mediumdistributed: Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard CVE-2025-68675Highapache-airflow: Apache Airflow proxy credentials for various providers might leak in task logs CVE-2025-68438Highapache-airflow: Apache Airflow secrets in rendered templates could contain parts of sensitive values when truncated CVE-2026-22779Mediumblacksheep: BlackSheep's ClientSession is vulnerable to CRLF injection CVE-2026-21889Lowweblate: Weblate leaks information via screenshots CVE-2025-68492Lowchainlit: Chainlit contains an authorization bypass vulnerability CVE-2026-22871Highguarddog: GuardDog Path Traversal Vulnerability Leads to Arbitrary File Overwrite and RCE CVE-2026-22870Highguarddog: GuardDog Zip Bomb Vulnerability in safe_extract() Allows DoS CVE-2026-23949Highjaraco.context: jaraco.context Has a Path Traversal Vulnerability CVE-2026-21226Highazure-core: Azure Core is vulnerable to deserialization of untrusted data CVE-2026-22798Mediumhermes: hermes's raw options logging may disclose secrets passed in via subcommand options argument CVE-2026-22777Highcomfy-cli: ComfyUI-Manager is Vulnerable to CRLF Injection in Configuration Handler CVE-2026-22702Mediumvirtualenv: virtualenv Has TOCTOU Vulnerabilities in Directory Creation CVE-2026-22701Mediumfilelock: filelock Time-of-Check-Time-of-Use (TOCTOU) Symlink Vulnerability in SoftFileLock CVE-2026-22773Mediumvllm: vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions CVE-2026-22251Mediumwlc: Weblate wlc has insecure API key configuration CVE-2026-22250Lowwlc: Weblate command-line client susceptible to SSL verification skip

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.