PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-1793Criticalllama-index: llama_index vulnerable to SQL Injection CVE-2025-48432MediumDjango: Django Improper Output Neutralization for Logs vulnerability CVE-2025-48994Mediumsignxml: SignXML's signature verification with HMAC is vulnerable to an algorithm confusion attack CVE-2025-48995Mediumsignxml: SignXML's signature verification with HMAC is vulnerable to a timing attack CVE-2025-48957Highastrbot: AstrBot Has Path Traversal Vulnerability in /api/chat/get_file CVE-2025-30167Highjupyter_core: Jupyter Core on Windows Has Uncontrolled Search Path Element Local Privilege Escalation Vulnerability CVE-2018-25111Mediumdjango-helpdesk: django-helpdesk Allows Sensitive Data Exposure CVE-2025-48912Highapache-superset: Apache Superset: Improper authorization bypass on row level security via SQL Injection CVE-2025-48889Mediumgradio: Gradio Allows Unauthorized File Copy via Path Manipulation CVE-2025-5321Lowaim: Aim Vulnerable to Sandbox Escape Leading to Remote Code Execution CVE-2025-5320Lowgradio: Gradio CORS Origin Validation Bypass Vulnerability GHSA-94V7-WXJ6-R2Q5Mediummulticast: multicast in source builds from vulnerable setuptools dependency CVE-2025-48944Mediumvllm: vLLM Tool Schema allows DoS via Malformed pattern and type Fields CVE-2025-48943Mediumvllm: vLLM allows clients to crash the openai server with invalid regex CVE-2025-48942Mediumvllm: vLLM DOS: Remotely kill vllm over http with invalid JSON schema CVE-2025-46722Mediumvllm: vLLM has a Weakness in MultiModalHasher Image Hashing Implementation CVE-2025-46570Lowvllm: Potential Timing Side-Channel Vulnerability in vLLM’s Chunk-Based Prefix Caching GHSA-J828-28RJ-HFHPMediumvllm: vLLM vulnerable to Regular Expression Denial of Service CVE-2025-48887Mediumvllm: vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`CVE-2025-5279Highredshift-connector: Issue with Amazon Redshift Python Connector and the BrowserAzureOAuth2CredentialsProvider plugin CVE-2025-1753Highllama-index-cli: LLama-Index CLI OS command injection vulnerability CVE-2025-48383Highdjango-select2: Django-Select2 Vulnerable to Widget Instance Secret Cache Key Leaking CVE-2025-5174Mediumpypickle: pypickle unsafe deserialization vulnerability CVE-2025-5175Mediumpypickle: pypickle Incorrect Privilege Assignment vulnerability CVE-2025-5173Mediumlabel-studio-ml: HumanSignal label-studio-ml-backend Deserialization of Untrusted Data vulnerability

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.