PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-112898MediumPillow: Pillow: Image.quantize() with empty palette leaks uninitialized stack memoryCVE-2026-112401MediumPillow: Pillow: Quadratic GIF comment concatenation allows DoS in Image.open()CVE-2026-112390HighPillow: Pillow: Infinite loop in MIC n_frames when the embedded TIFFCVE-2026-112891Mediumpillow: Pillow: Quadratic GIF comment copying during saveCVE-2026-112392HighPillow: Pillow: NULL dereference in ImagingExpand via rank filters on zero-size imagesCVE-2026-112405Highpillow: Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0CVE-2026-112893Highpillow: Pillow: Invalid free in FreeType glyph rendering when a stroker is activeCVE-2026-112402HighPillow: Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transformCVE-2026-112394MediumPillow: Pillow: P;2L and P;4L decoders may read 1 to 3 bytes past the passed buffer sizeCVE-2026-112900CriticalPillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCECVE-2026-113786Lowpypdf: pypdf: Unvalidated JPEG image data loadingCVE-2026-113731Lowdjust: djust: Arbitrary absolute-path file read in the find_handlers_for_template MCP toolCVE-2026-113792Mediumpypdf: pypdf: Possible infinite loop in PdfWriter.find_outline_itemCVE-2026-113793Mediumpypdf: pypdf: Possible infinite loop when removing tree itemsCVE-2026-113794Mediumpypdf: pypdf: Possible infinite loop when hitting EOF in standard xref tableCVE-2026-113725Highvirtualenv: virtualenv bash activate runs commands from an environment name with a backslash before $CVE-2026-113795Mediumpypdf: pypdf: Possible large memory usage for streams with multiple filtersCVE-2026-113726Highvirtualenv: virtualenv activate runs commands from the environment name in zsh with PROMPT_SUBSTCVE-2026-113732Highvirtualenv: virtualenv activate.fish runs commands from a path or prompt with a backslash before a quoteCVE-2026-113776Highvirtualenv: virtualenv activation scripts run code from a path that contains a placeholder nameCVE-2026-114386Mediumpydantic-ai-harness: Pydantic AI Harness tool-call limit bypass in nested CodeMode callsCVE-2026-112397HighPillow: Pillow: Out-of-bounds access in _imagingmorph on a zero-width imageCVE-2026-112400HighPillow: Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoSCVE-2026-112899MediumPillow: Pillow: EPS load(scale) lets Ghostscript render past the decompression bomb limitCVE-2026-112897HighPillow: Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo