PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2026-22033Highlabel-studio: Label Studio is vulnerable to full account takeover by chaining Stored XSS + IDOR in User Profile via custom_hotkeys field CVE-2025-68472HighMindsDB: MindsDB has improper sanitation of filepath that leads to information disclosure and DOS CVE-2025-14279Highmlflow: MLFlow is vulnerable to DNS rebinding attacks due to a lack of Origin header validation CVE-2025-15506Lowopencolorio: AcademySoftwareFoundation OpenColorIO has an out-of-bounds vulnerability CVE-2025-15504Lowlief: LIEF is vulnerable to segmentation fault CVE-2026-22584Criticaluni2ts: Salesforce Uni2TS has a Code Injection vulnerability CVE-2026-22612Highfickling: Fickling vulnerable to detection bypass due to "builtins" blindness CVE-2026-22609Highfickling: Fickling has Static Analysis Bypass via Incomplete Dangerous Module Blocklist CVE-2026-22608Highfickling: Fickling vulnerable to use of ctypes and pydoc gadget chain to bypass detection CVE-2026-22607Highfickling: Fickling Blocklist Bypass: cProfile.run()CVE-2026-22606Highfickling: Fickling has a bypass via runpy.run_path() and runpy.run_module()CVE-2026-22691Lowpypdf: pypdf has possible long runtimes for malformed startxref CVE-2026-22690Lowpypdf: pypdf has possible long runtimes for missing /Root object with large /Size values CVE-2025-68158Mediumauthlib: Authlib has 1-click Account Takeover vulnerability GHSA-MCMC-2M55-J8JJHighvllm: vLLM introduced enhanced protection for CVE-2025-62164 CVE-2026-21874Mediumnicegui: NiceGUI has Redis connection leak via tab storage causes service degradation CVE-2026-21873Highnicegui: NiceGUI apps which use `ui.sub_pages` vulnerable to zero-click XSS CVE-2026-21872Mediumnicegui: NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links CVE-2026-21871Mediumnicegui: NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace()CVE-2026-21860MediumWerkzeug: Werkzeug safe_join() allows Windows special device names with compound extensions CVE-2026-53872Highpicklescan: picklescan has Arbitrary file read using `io.FileIO` CVE-2025-15346Criticalwolfssl: wolfSSL Python module vulnerable to Improper Authentication CVE-2023-7333Mediumrecords-mover: records-mover Injection vulnerability CVE-2026-22041Lowloggingredactor: loggingredactor converts non-string types to string types in logs CVE-2026-21441Highurllib3: Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.