PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-6167Mediumpython-a2a: python-a2a has a path traversal in the create_workflow function GHSA-5QPG-RH4J-QP35Mediumpycares: pycares has a Use-After-Free Vulnerability CVE-2025-4565Highprotobuf: protobuf-python has a potential Denial of Service issue CVE-2025-49134Lowweblate: Weblate exposes personal IP address via e-mail CVE-2025-47951Mediumweblate: Weblate lacks rate limiting when verifying second factor CVE-2024-38824Criticalsalt: Salt vulnerable to directory traversal attack in file receiving method CVE-2025-22242Mediumsalt: Salt's worker process vulnerable to denial of service through file read operation CVE-2025-22238Mediumsalt: Salt vulnerable to directory traversal attack in minion file cache creation CVE-2025-22237Mediumsalt: Salt's on demand pillar functionality vulnerable to arbitrary command injections CVE-2025-22241Mediumsalt: Salt's file contents overwrite the VirtKey class CVE-2025-22240Mediumsalt: Salt allows arbitrary directory creation or file deletion CVE-2025-22239Highsalt: Salt vulnerable to arbitrary event injection CVE-2024-38825Mediumsalt: Salt's salt.auth.pki module does not properly authenticate callers CVE-2025-22236Highsalt: Salt has minion event bus authorization bypass vulnerability CVE-2025-43866Lowvantage6-server: Vantage6 Server JWT secret not cryptographically secure CVE-2025-43863Lowvantage6: vantage6 lacks brute-force protection on change password functionality CVE-2025-49143Mediumnautobot: Nautobot may allows uploaded media files to be accessible without authentication CVE-2025-49142Mediumnautobot: Nautobot vulnerable to secrets exposure and data manipulation through Jinja2 templating CVE-2025-48879MediumOctoPrint: OctoPrint Vulnerable to Denial of Service through malformed HTTP request in OctoPrint CVE-2025-48067MediumOctoPrint: OctoPrint vulnerable to possible file extraction via upload endpoints CVE-2024-47081Mediumrequests: Requests vulnerable to .netrc credentials leak via malicious URLs CVE-2025-49651Highbackend.ai: Backend.AI Missing Authorization vulnerability CVE-2025-49653Highbackend.ai: BackendAI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor CVE-2025-49652Criticalbackend.ai: BackendAI Missing Authentication for Critical Function CVE-2025-49619Highskyvern: Skyvern has a Jinja runtime leak

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.