PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-27018Mediumapache-airflow-providers-mysql: Apache Airflow MySQL Provider is Vulnerable to SQL Injection GHSA-V432-7F47-9G94HighPostQuantum-Feldman-VSS: PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash CVE-2025-2000Criticalqiskit-terra: Qiskit allows arbitrary code execution decoding QPY format versions < 13 CVE-2025-29779MediumPostQuantum-Feldman-VSS: Post-Quantum Secure Feldman's Verifiable Secret Sharing has Inadequate Fault Injection Countermeasures in `secure_redundant_execution`CVE-2025-29780MediumPostQuantum-Feldman-VSS: Post-Quantum Secure Feldman's Verifiable Secret Sharing has Timing Side-Channels in Matrix Operations CVE-2024-27763Mediumbasicsr: XPixelGroup BasicSR Command Injection CVE-2025-25302Highrembg: Rembg CORS misconfiguration CVE-2025-25301Mediumrembg: Rembg allows SSRF via /api/remove CVE-2025-1550Highkeras: Arbitrary Code Execution via Crafted Keras Config for Model Loading CVE-2025-24986Mediumpromptflow-tools: Azure PromptFlow remote code execution related to Jinja templates CVE-2025-1944Mediumpicklescan: Zip Exploit Crashes Picklescan But Not PyTorch CVE-2025-1945Mediumpicklescan: Zip Flag Bit Exploit Crashes Picklescan But Not PyTorch CVE-2025-2149Lowtorch: PyTorch: Manipulation of the argument scale/zero_point leads to improper initialization via Quantized Sigmoid Module CVE-2025-1497Criticalplotai: PlotAI eval vulnerability CVE-2025-2148Lowtorch: PyTorch Tuple Handler is Vulnerable to Memory Corruption through Manipulation of None Argument CVE-2025-26699MediumDjango: Django vulnerable to Allocation of Resources Without Limits or Throttling CVE-2025-1979Mediumray: ray vulnerable to Insertion of Sensitive Information into Log File CVE-2025-25362Highspacy-llm: Spacy-LLM Server-Side Template Injection (SSTI) vulnerability CVE-2025-27516MediumJinja2: Jinja2 vulnerable to sandbox breakout through attr filter selecting format method GHSA-3X5X-FW77-G54CHighdgl: dmlc/dgl Vulnerable to Remote Code Execution by Pickle Deserialization via rpc.recv_request()CVE-2025-1716Mediumpicklescan: Picklescan Allows Remote Code Execution via Malicious Pickle File Bypassing Static Analysis CVE-2025-1889Mediumpicklescan: PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions CVE-2025-1300Mediumcodechecker: CodeChecker open redirect when URL contains multiple slashes after the product name CVE-2025-24023Lowflask-appbuilder: Flask-AppBuilder Observable Response Discrepancy CVE-2024-24778Mediumorg.apache.streampipes:streampipes-parent: Apache StreamPipes has improper privilege management in a REST interface

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.