PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-34291Criticallangflow: Langflow CORS misconfiguration enables Account Takeover and RCE CVE-2025-66471Highurllib3: urllib3 streaming API improperly handles highly compressed data CVE-2025-66418Highurllib3: urllib3 allows an unbounded number of links in the decompression chain CVE-2025-65958Highopen-webui: Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web CVE-2025-63681Lowopen-webui: open-webui is Vulnerable to Incorrect Access Control CVE-2025-56427Mediumcomposio: ComposioHQ has a directory traversal vulnerability CVE-2025-14010Mediumansible: Ansible Community General Collection is vulnerable to exposure of sensitive information CVE-2025-65896Criticalasyncmy: asyncmy is vulnerable to SQL injection via crafted dict keys CVE-2025-64460MediumDjango: Django is vulnerable to DoS via XML serializer text extraction CVE-2025-13372MediumDjango: Django is vulnerable to SQL injection in column aliases CVE-2025-66454Mediumarcade-mcp-server: arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints CVE-2025-66448Highvllm: vLLM vulnerable to remote code execution via transformers_utils/get_config CVE-2025-66416Highmcp: Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default CVE-2025-65858Lowcalibreweb: Calibre-Web Has a Stored Cross-Site Scripting (XSS) Vulnerability via the 'username' Field During User Creation CVE-2025-12060Highkeras: Keras Directory Traversal Vulnerability CVE-2025-66221Mediumwerkzeug: Werkzeug safe_join() allows Windows special device names CVE-2025-66040Lowspotipy: Spotipy has a XSS vulnerability in its OAuth callback server CVE-2025-66034Mediumfonttools: fontTools is Vulnerable to Arbitrary File Write and XML injection in fontTools.varLib CVE-2025-66423Hightrytond: trytond does not enforce access rights for the route of the HTML editor.CVE-2025-66424Mediumtrytond: trytond does not enforce access rights for data export CVE-2025-66422Mediumtrytond: trytond allows remote attackers to obtain sensitive trace-back (server setup) information CVE-2025-66371Mediumpeppol_py: Peppol-py is vulnerable to XXE attacks due to Saxon configuration CVE-2025-13742Lowpretix: pretix has Email Content Injection Through Maliciously Formatted Names CVE-2025-34351Criticalray: Ray's New Token Authentication is Disabled By Default CVE-2025-65681Lowtutor: Overhang Tutor Discloses Sensitive Information due to Improper Cache-Control

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.