PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-62379Lowreflex: reflex-dev/reflex has an Open Redirect vulnerability CVE-2025-55039Loworg.apache.spark:spark-network-common_2.13: Apache Spark has Inadequate Encryption Strength CVE-2025-62172Highhomeassistant: Home Assistant has Stored XSS vulnerability in Energy dashboard from Energy Entity Name CVE-2025-7707Highllama-index: llama-index has Insecure Temporary File CVE-2025-62706Mediumauthlib: Authlib : JWE zip=DEF decompression bomb enables DoS CVE-2025-61912Mediumpython-ldap: python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination CVE-2025-61911Mediumpython-ldap: python-ldap has sanitization bypass in ldap.filter.escape_filter_chars CVE-2025-61920Highauthlib: Authlib is vulnerable to Denial of Service via Oversized JOSE Segments CVE-2025-10283Criticalbbot: BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE CVE-2025-10281Mediumbbot: BBOT's git_clone.py can expose users' GitHub API keys to an attacker-controlled webserver CVE-2025-10284Criticalbbot: BBOT's various issues in unarchive.py can cause arbitrary file write and RCE CVE-2025-61783Mediumsocial-auth-app-django: Python Social Auth - Django has unsafe account association CVE-2025-61773Highpyload-ng: pyLoad CNL and captcha handlers allow Code Injection via unsanitized parameters GHSA-M9MP-6X32-5RHGCriticalscio-pypi: scio is vunerable to Remote Command Execution through PyTorch CVE-2025-61672Mediummatrix-synapse: Synapse's invalid device keys degrade federation functionality CVE-2025-6242Highvllm: vLLM is vulnerable to Server-Side Request Forgery (SSRF) through `MediaConnector` class CVE-2025-61784Highllamafactory: LLaMA Factory's Chat API Contains Critical SSRF and LFI Vulnerabilities CVE-2025-61620Mediumvllm: vLLM: Resource-Exhaustion (DoS) through Malicious Jinja Template in OpenAI-Compatible Server CVE-2025-59425Highvllm: vLLM is vulnerable to timing attack at bearer auth CVE-2025-61765Mediumpython-socketio: python-socketio vulnerable to arbitrary Python code execution (RCE) through malicious pickle deserialization in certain multi-server…CVE-2025-59152Highlitestar: Litestar X-Forwarded-For Header Spoofing Vulnerability Enables Rate Limit Evasion CVE-2025-6985Highlangchain-text-splitters: LangChain Text Splitters is vulnerable to XML External Entity (XXE) attacks due to unsafe XSLT parsing CVE-2025-8917Mediumclearml: clearml is vulnerable to Path Traversal through its `safe_extract` function CVE-2025-8406Mediumzenml: ZenML is vulnerable to Path Traversal through its `PathMaterializer` class CVE-2025-53354Mediumnicegui: NiceGUI has a Reflected XSS

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.