PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-27154Highspotipy: Spotipy's cache file, containing spotify auth token, is created with overly broad permissions CVE-2025-27145Lowcopyparty: copyparty renders unsanitized filenames as HTML when user uploads empty files CVE-2023-25574Criticaljupyterhub-ltiauthenticator: LTI JupyterHub Authenticator does not properly validate JWT Signature CVE-2025-26623MediumExiv2: Exiv2 allows Use After Free CVE-2025-27104Lowvyper: Vyper has a double eval in For List Iter CVE-2025-27105Lowvyper: AugAssign evaluation order causing OOB write within the object in Vyper CVE-2025-26622Lowvyper: Vyper's sqrt doesn't define rounding behavior CVE-2025-1403Highqiskit: Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit CVE-2025-25305Highhomeassistant: Home Assistant does not correctly validate SSL for outgoing requests in core and used libs CVE-2025-1057Mediumkeylime: Keylime registrar is vulnerable to Denial-of-Service attack when updated to version 7.12.0 CVE-2025-25297Highlabel-studio: Label Studio allows Server-Side Request Forgery in the S3 Storage Endpoint CVE-2025-25296Mediumlabel-studio: Label Studio allows Cross-Site Scripting (XSS) via GET request to `/projects/upload-example` endpoint CVE-2025-25295Highlabel-studio-sdk: Label Studio has a Path Traversal Vulnerability via image Field CVE-2024-12797Lowcryptography: Vulnerable OpenSSL included in cryptography wheels CVE-2024-12366Criticalpandasai: PandasAI interactive prompt function Remote Code Execution (RCE)GHSA-432C-WXPG-M4Q3Mediumxml2rfc: xml2rfc has file inclusion irregularities CVE-2025-25183Lowvllm: vLLM uses Python 3.12 built-in hash() which leads to predictable hash collisions in prefix cache CVE-2025-23217Highmitmproxy: Mitmweb API Authentication Bypass Using Proxy Server CVE-2025-24805Highmobsf: MobSF Local Privilege Escalation CVE-2025-24804Highmobsf: MobSF Partial Denial of Service (DoS)CVE-2025-24803Highmobsf: MobSF Stored Cross-Site Scripting (XSS)CVE-2025-24372Highckan: CKAN has an XSS vector in user uploaded images in group/org and user profiles CVE-2025-24370Criticaldjango-unicorn: Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass CVE-2025-24793Highsnowflake-connector-python: snowflake-connector-python vulnerable to SQL Injection in write_pandas CVE-2025-24794Mediumsnowflake-connector-python: snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.