PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-6051Mediumtransformers: Hugging Face Transformers library has Regular Expression Denial of Service CVE-2025-6638Mediumtransformers: Hugging Face Transformers is vulnerable to ReDoS through its MarianTokenizer CVE-2025-10193Highmcp-neo4j-cypher: Neo4j Cypher MCP server is vulnerable to DNS rebinding CVE-2025-58065Mediumflask-appbuilder: Flask App Builder has an Authentication Bypass vulnerability when using non AUTH_DB methods CVE-2025-59036Mediuminfrahub-server: Infrahub: Deleted and expired API tokens can still authenticate CVE-2025-11059Highxml2rfc: xml2rfc is vulnerable to arbitrary file reads through prepped files CVE-2025-59042Highpyinstaller: PyInstaller has local privilege escalation vulnerability CVE-2025-59035Mediumindico: Indico vulnerable to Cross-Site Scripting via LaTeX math code CVE-2025-59034Mediumindico: Indico may disclose unauthorized user details access via legacy API CVE-2025-10155Criticalpicklescan: Picklescan Bypass is Possible via File Extension Mismatch CVE-2025-10156Criticalpicklescan: Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check CVE-2025-10157Criticalpicklescan: Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports CVE-2025-10164Mediumsglang: SGLang Remote Code Execution Vulnerability via Unsafe Deserialization in update_weights_from_tensor CVE-2025-58757Highmonai: Monai: Unsafe use of Pickle deserialization may lead to RCE CVE-2025-58756Highmonai: MONAI: Unsafe torch usage may lead to arbitrary code execution CVE-2025-58755Highmonai: MONAI does not prevent path traversal, potentially leading to arbitrary file writes CVE-2025-58180Highoctoprint: OctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File Upload CVE-2025-58753Mediumcopyparty: copyparty: Sharing a single file does not fully restrict access to other files in source folder CVE-2025-57817Highethyca-fides: Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation CVE-2025-57816Mediumethyca-fides: Fides Webserver API Rate Limiting Vulnerability in Proxied Environments CVE-2025-57815Lowethyca-fides: Fides has a Lack of Brute-Force Protections on Authentication Endpoints CVE-2025-57766Lowethyca-fides: Fides' Admin UI User Password Change Does Not Invalidate Current Session CVE-2025-57833HighDjango: Django is subject to SQL injection through its column aliases CVE-2025-58446Mediumxgrammar: xgrammar vulnerable to denial of service by huge enum grammar CVE-2025-58438Criticalinternetarchive: internetarchive Vulnerable to Directory Traversal in File.download()

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.