PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-47241Criticalbrowser-use: Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL CVE-2025-46335Mediummobsf: Mobile Security Framework (MobSF) Allows Stored Cross Site Scripting (XSS) via malicious SVG Icon Upload CVE-2025-46560Mediumvllm: vLLM: Quadratic Time Complexity in Input Token Processing leads to denial of service CVE-2025-32444Criticalvllm: vLLM Vulnerable to Remote Code Execution via Mooncake Integration CVE-2025-30202Highvllm: Data exposure via ZeroMQ on multi-node vLLM deployment CVE-2025-1194Mediumtransformers: Transformers Regular Expression Denial of Service (ReDoS) vulnerability CVE-2025-4032Lowaworld: AWorld OS Command Injection vulnerability CVE-2025-46656Lowmarkdownify: markdownify allows large headline prefixes such as <h9999999>, which causes memory consumption CVE-2025-43859Criticalh11: h11 accepts some malformed Chunked-Encoding bodies CVE-2025-46567Mediumllamafactory: LLaMA-Factory Allows Arbitrary Code Execution via Unsafe Deserialization in Ilamafy_baichuan2.py GHSA-GGPF-24JW-3FCWCriticalvllm: CVE-2025-24357 Malicious model remote code execution fix bypass with PyTorch < 2.6.0 CVE-2025-32788Mediumoctoprint: OctoPrint Authenticated Reverse Proxy Page Authentication Bypass CVE-2025-28197MediumCrawl4AI: Crawl4AI SSRF vulnerability GHSA-22FP-MF44-F2MQHighyoutube-dl: youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitization CVE-2025-32434Criticaltorch: PyTorch: `torch.load` with `weights_only=True` leads to remote code execution CVE-2025-32377Mediumrasa-pro: Rasa Pro Missing Authentication For Voice Connector APIs CVE-2024-53924Highpycel: Pycel allows code injection via a crafted formula CVE-2025-3730Mediumtorch: PyTorch Improper Resource Shutdown or Release vulnerability CVE-2024-53305Highwhoogle-search: Whoogle allows attackers to execute arbitrary code via supplying a crafted search query GHSA-HF3C-WXG2-49Q9Mediumvllm: vLLM vulnerable to Denial of Service by abusing xgrammar cache CVE-2025-32021Lowweblate: VCS credentials included in URL parameters are potentially logged and saved into browser history as plaintext CVE-2025-32428Criticaljupyter-remote-desktop-proxy: TigerVNC accessible via the network and not just via a UNIX socket as intended CVE-2025-32381Mediumxgrammar: xgrammar Vulnerable to Denial of Service (DoS) by abusing unbounded cache in memory CVE-2025-32375Criticalbentoml: BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization GHSA-V7X6-RV5Q-MHWCMediumpicklescan: Picklescan missing detection when calling built-in python library function timeit.timeit()

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.