PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-30212Mediumfrappe: Frappe has possibility of SQL injection due to improper validations CVE-2024-12029CriticalInvokeAI: InvokeAI Deserialization of Untrusted Data vulnerability CVE-2025-1473Mediummlflow: MLflow Cross-Site Request Forgery (CSRF) vulnerability CVE-2025-1474Lowmlflow: MLflow has Weak Password Requirements CVE-2025-0190Highaim: Aim Excessive Data Query Operations in a Large Data Table vulnerability CVE-2025-0453Mediummlflow: MLflow Uncontrolled Resource Consumption vulnerability CVE-2025-0330Highlitellm: LiteLLM Has a Leakage of Langfuse API Keys CVE-2025-0508Mediumsagemaker: SageMaker Workflow component allows possibility of MD5 hash collisions CVE-2025-0628Highlitellm: LiteLLM Has an Improper Authorization Vulnerability CVE-2025-0189Highaim: Aim Uncontrolled Resource Consumption vulnerability CVE-2024-9606Highlitellm: LiteLLM Reveals Portion of API Key via a Logging File CVE-2024-9701Criticalkedro: Kedro deserialization vulnerability GHSA-5CCF-884P-4JJQHighopen-webui: Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability CVE-2024-9340Highzenml: ZenML unauthenticated DoS via Multipart Boundry CVE-2024-9229Highquivr-core: Quivr unauthenticated Denial of Service (DoS) via Multipart Boundary CVE-2024-9070Criticalbentoml: BentoML deserialization vulnerability CVE-2024-9056Highbentoml: BentoML Denial of Service (DoS) via Multipart Boundary CVE-2024-9053Criticalvllm: vLLM allows Remote Code Execution by Pickle Deserialization via AsyncEngineRPCServer() RPC server entrypoints CVE-2024-9052Criticalvllm: vLLM deserialization vulnerability in vllm.distributed.GroupCoordinator.recv_object CVE-2024-8952Mediumcomposio-core: composio Server-Side Request Forgery (SSRF) vulnerability CVE-2024-8953Highcomposio-core: Composio Eval Injection Vulnerability CVE-2024-8966Highgradio: Gradio DOS in multipart boundry while uploading the file CVE-2024-8984Highlitellm: LiteLLM Vulnerable to Denial of Service (DoS) via Crafted HTTP Request CVE-2024-8955Mediumcomposio-core: composio allows Server-Side Request Forgery (SSRF) in BROWSERTOOL CVE-2024-8859Highmlflow: MLflow has a Local File Read/Path Traversal in dbfs

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo