PyPI vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-47872Mediumgradio: Gradio has an XSS on every Gradio server via upload of HTML files, JS files, or SVG files CVE-2024-47871Highgradio: Gradio uses insecure communication between the FRP client and server CVE-2024-47870Highgradio: Gradio has a race condition in update_root_in_config may redirect user traffic CVE-2024-47869Mediumgradio: Gradio performs a non-constant-time comparison when comparing hashes CVE-2024-47868Mediumgradio: Gradio has several components with post-process steps allow arbitrary file leaks CVE-2024-47867Highgradio: Gradio lacks integrity checking on the downloaded FRP client CVE-2024-47168Lowgradio: In Gradio, the `enable_monitoring` flag set to `False` does not disable monitoring CVE-2024-47167Mediumgradio: Gradio vulnerable to SSRF in the path parameter of /queue/join CVE-2024-47166Mediumgradio: Gradio has a one-level read path traversal in `/custom_component`CVE-2024-47165Mediumgradio: Gradio's CORS origin validation accepts the null origin CVE-2024-47164Mediumgradio: Gradio's `is_in_or_equal` function may be bypassed CVE-2024-47084Highgradio: Gradios's CORS origin validation is not performed when the request has a cookie CVE-2024-7037Mediumopen-webui: open-webui allows writing and deleting arbitrary files CVE-2024-7041Mediumopen-webui: open-webui Insecure Direct Object Reference (IDOR) vulnerability CVE-2024-7038Lowopen-webui: open-webui allows enumeration of file names and traversal of directories by observing the error messages CVE-2024-43497Highdeepspeed: DeepSpeed Remote Code Execution Vulnerability CVE-2024-25885Mediumxhtml2pdf: xhtml2pdf Denial of Service via crafted string CVE-2024-45231MediumDjango: Django allows enumeration of user e-mail addresses CVE-2024-45230MediumDjango: Django vulnerable to denial-of-service attack via the urlize() and urlizetrunc() template filters CVE-2024-47211Mediumironic: OpenStack Ironic fails to verify checksums of supplied image_source URLs CVE-2024-47529Mediumopenc3: OpenC3 stores passwords in clear text (`GHSL-2024-129`)CVE-2024-46977Highopenc3: OpenC3 Path Traversal via screen controller (`GHSL-2024-127`)CVE-2024-43795Mediumopenc3: OpenC3 Cross-site Scripting in Login functionality (`GHSL-2024-128`)GHSA-VX3H-QWQW-R2WQMediuminventree: Inventree Server-Side Request Forgery vulnerability exposes server port/internal IP CVE-2024-47532HighRestrictedPython: RestrictedPython information leakage via `AttributeError.obj` and the `string` module

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Browse by ecosystem

Stop the waste.Protect your environment with Kodem.

Stop the waste.
Protect your environment with Kodem.