PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-9636Highpgadmin4: pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability CVE-2025-55037CriticalTkEasyGUI: TkEasyGUI Vulnerable to OS Command Injection CVE-2025-55671HighTkEasyGUI: TkEasyGUI Affected by Uncontrolled Search Path Element Issue GHSA-58P5-R2F6-G2CJCriticalusd-core: Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution CVE-2025-58352LowWeblate: Weblate has a long session expiry when verifying second factor CVE-2025-6984Highlangchain-community: Langchain Community Vulnerable to XML External Entity (XXE) Attacks CVE-2025-58367Criticaldeepdiff: DeepDiff Class Pollution in Delta class leading to DoS, Remote Code Execution, and more CVE-2025-58161Lowmobsf: MobSF Path Traversal in GET /download/<filename> using absolute filenames CVE-2025-58162Mediummobsf: MobSF Vulnerable to Arbitrary File Write (AR-Slip) via Absolute Path in .a Extraction CVE-2025-57808Highesphome: ESP-IDF web_server basic auth bypass using empty or incomplete Authorization header CVE-2025-57806Mediumlocal-deep-research: Local Deep Research's API keys are stored in plain text CVE-2025-58068Mediumeventlet: Eventlet affected by HTTP request smuggling in unparsed trailers CVE-2025-55304LowExiv2: Exiv2 has quadratic performance in ICC profile parsing in JpegBase::readMetadata CVE-2025-54080LowExiv2: Exiv2 Segmentation Faults in Exiv2::EpsImage::writeMetadata() via crafted EPS file GHSA-Q77W-MWJJ-7MQXMediumpicklescan: Picklescan is missing detection when calling built-in python library asyncio.unix_events._UnixSubprocessTransport._start GHSA-49GJ-C84Q-6QM9Mediumpicklescan: Picklescan is missing detection when calling built-in python cProfile.run GHSA-9W88-8RMG-7G2PMediumpicklescan: Picklescan is missing detection when calling built-in python cProfile.runctx GHSA-FQQ6-7VQF-W3FGMediumpicklescan: Picklescan is missing detection when calling built-in python doctest.debug_script GHSA-3GF5-CXQ9-W223Mediumpicklescan: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcode GHSA-J343-8V2J-FF7WMediumpicklescan: Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand GHSA-M869-42CG-3XWRMediumpicklescan: Picklescan is missing detection when calling built-in python idlelib.run.Executive.runcode GHSA-P9W7-82W4-7Q8MMediumpicklescan: Picklescan is missing detection when calling built-in python lib2to3.pgen2.pgen.ParserGenerator.make_label CVE-2025-71344Highpicklescan: Picklescan is missing detection when calling built-in python ensurepip._run_pip GHSA-4WHJ-RM5R-C2V8Mediumpicklescan: Picklescan is missing detection when calling pytorch function torch.utils.bottleneck.__main__.run_autograd_prof GHSA-9XPH-J2H6-G47VMediumpicklescan: Picklescan has a missing detection when calling built-in python library idlelib.calltip.get_entity

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo