PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-3044Mediumllama-index-readers-papers: LlamaIndex vulnerability in ArxivReader class can cause MD5 hash collisions CVE-2025-3262Mediumtransformers: Transformers vulnerable to ReDoS attack through its SETTING_RE variable CVE-2025-3108Mediumllama-index-core: LlamaIndex has Incomplete Documentation of Program Execution related to JsonPickleSerializer component CVE-2025-53366Highmcp: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS CVE-2025-53365Highmcp: MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service CVE-2025-48379Highpillow: Pillow vulnerability can cause write buffer overflow on BCn encoding CVE-2025-6855Lowlangchain-chatchat: Langchain-Chatchat vulnerable to path traversal CVE-2025-6854Lowlangchain-chatchat: Langchain-Chatchat vulnerable to path traversal CVE-2025-6853Lowlangchain-chatchat: Langchain-Chatchat has a Path Traversal vulnerability CVE-2025-6773Mediumlightrag-hku: HKUDS LightRAG allows Path Traversal via function upload_to_input_dir CVE-2024-54000Highmobsf: MobSF vulnerability allows SSRF due to the allow_redirects=True parameter CVE-2025-53002Highllamafactory: LLaMA-Factory allows Code Injection through improper vhead_file safeguards CVE-2025-50213Criticalapache-airflow-providers-snowflake: Apache Airflow Providers Snowflake package allows for Special Element Injection via CopyFromExternalStageToSnowflakeOperator CVE-2025-6518Lowpyspur: pyspur Incomplete Filtering of Special Elements allowed by SingleLLMCallNode function CVE-2025-2828Highlangchain-community: LangChain Community SSRF vulnerability exists in RequestsToolkit component CVE-2025-52558Highchangedetection.io: ChangeDetection.io XSS in watch overview CVE-2025-52967Mediummlflow: MLFlow SSRF via gateway_proxy_handler CVE-2025-52556Criticalrfc3161-client: rfc3161-client has insufficient verification for timestamp response signatures CVE-2025-6279Lowupsonic: Upsonic has vulnerability in Pickle Handler component that can lead to deserialization CVE-2025-6278Lowupsonic: Upsonic is vulnerable to Path Traversal attack through its os.path.join function CVE-2025-6272Lowpywasm3: pywasm3 has Improper Restriction of Operations within the Bounds of a Memory Buffer CVE-2025-50182Mediumurllib3: urllib3 does not control redirects in browsers and Node.js CVE-2025-50181Mediumurllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation CVE-2025-3248Criticallangflow: Langflow Unauth RCE CVE-2025-6050MediumMezzanine: Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.