PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2025-24795Mediumsnowflake-connector-python: snowflake-connector-python vulnerable to insecure cache files permissions CVE-2025-24357Highvllm: vllm: Malicious model to RCE by torch.load in hf_model_weights_iterator GHSA-GVVW-RR8M-FJ76Highuniapi: uniapi version 1.0.7 contained an information harvesting script.CVE-2025-24359Highasteval: ASTEVAL Allows Maliciously Crafted Format Strings to Lead to Sandbox Escape GHSA-VP47-9734-PRJWHighasteval: ASTEVAL Allows Malicious Tampering of Exposed AST Nodes Leads to Sandbox Escape CVE-2025-22153HighRestrictedPython: try/except* clauses could allow bypass RestrictedPython via type confusion bug in the CPython interpreter CVE-2024-41672Highduckdb: sniff_csv provides filesystem access even when enable_external_access is disabled in duckdb CVE-2024-53829Highcodechecker: Cross-Site Request Forgery in CodeChecker API CVE-2025-23205Highnbgrader: nbgrader's `frame-ancestors: self` grants all users access to formgrader CVE-2024-50633Mediumindico: Indico Insecure Access CVE-2025-22146Criticalsentry: Sentry's improper authentication on SAML SSO process allows user impersonation CVE-2024-56374MediumDjango: Django has a potential denial-of-service vulnerability in IPv6 validation CVE-2025-21607Lowvyper: Vyper Does Not Check the Success of Certain Precompile Calls CVE-2025-23042Criticalgradio: Gradio Blocked Path ACL Bypass Vulnerability CVE-2024-49375Criticalrasa-pro: Rasa Allows Remote Code Execution via Remote Model Loading CVE-2025-22151Lowstrawberry-graphql: Strawberry GraphQL has type resolution vulnerability in node interface that allows potential data leakage through incorrect type resolution CVE-2023-1907Highpgadmin4: pgAdmin has Incorrect Default Permissions CVE-2024-53995Lowsickchill: GHSL-2024-288: SickChill open redirect in login CVE-2024-53526Mediumcomposio-claude: Composio Command Execution vulnerability CVE-2024-55459Mediumkeras: keras Path Traversal vulnerability CVE-2024-45033Lowapache-airflow-providers-fab: Apache Airflow Fab Provider Insufficient Session Expiration vulnerability CVE-2025-21618Highnicegui: NiceGUI On Air authentication issue CVE-2024-52294Mediumkhoj: khoj has an IDOR in subscription management allows unauthorized subscription modifications CVE-2024-39025Highletta: Letta (previously MemGPT) incorrect access control vulnerability CVE-2024-56509Highchangedetection.io: changedetection.io Vulnerable to Improper Input Validation Leading to LFR/Path Traversal

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.