PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-61677Lowdatachain: DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables CVE-2025-59682Lowdjango: Django vulnerable to partial directory traversal via archives CVE-2025-59681Highdjango: Django vulnerable to SQL injection in column aliases GHSA-XJV7-6W92-42R7Mediummarimo: marimo vulnerable to proxy abuse of /mpl/{port}/CVE-2025-57275Mediumspdk: SPDK is vulnerable to buffer overflow in the NVMe-oF target component CVE-2025-61622Criticalpyfory: Apache Pyfory python is vulnerable to deserialization of untrusted data CVE-2025-59940Mediummkdocs-include-markdown-plugin: mkdocs-include-markdown-plugin susceptible to unvalidated input colliding with substitution placeholders CVE-2025-7647Highllama-index-core: llama-index-core insecurely handles temporary files CVE-2025-59842Lowjupyterlab: JupyterLab LaTeX typesetter links did not enforce `noopener` attribute CVE-2025-54831Mediumapache-airflow: Apache Airflow: Connection sensitive details exposed to users with READ permissions CVE-2025-10952Mediumml-logger: ml-logger file handler allows reading arbitrary files CVE-2025-10950Lowml-logger: ml-logger deserialization vulnerability CVE-2025-10951Mediumml-logger: ml-logger has path traversal in the file argument CVE-2025-55178Mediumllama-stack: Llama Stack could potentially allow for remote code execution CVE-2025-8869Mediumpip: pip's fallback tar extraction doesn't check symbolic links point to extraction directory CVE-2025-48459Criticalorg.apache.iotdb:iotdb-confignode: Apache IoTDB: Deserialization of untrusted Data CVE-2025-6921Mediumtransformers: Hugging Face Transformers vulnerable to Regular Expression Denial of Service (ReDoS) in the AdamWeightDecay optimizer CVE-2025-6544Criticalai.h2o:h2o-core: H2O affected by a deserialization vulnerability CVE-2025-40843Mediumcodechecker: CodeChecker has a buffer overflow in the log command CVE-2025-59420Highauthlib: Authlib: JWS/JWT accepts unknown crit headers (RFC violation → possible authz bypass)CVE-2025-9905Highkeras: The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is…CVE-2025-9906Highkeras: Keras is vulnerable to Deserialization of Untrusted Data CVE-2025-6237Criticalinvokeai: InvokeAI has External Control of File Name or Path CVE-2025-59376Mediummcp-kubernetes-server: mcp-kubernetes-server has a Command Injection vulnerability CVE-2025-59377Criticalmcp-kubernetes-server: mcp-kubernetes-server has an OS Command Injection vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.