pypi
Security Advisories in pypi
High
about 4 hours ago
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source
pypi
mlflow
Moderate
about 4 hours ago
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
pypi
mlflow
Critical
about 4 hours ago
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
pypi
mlflow
Moderate
about 4 hours ago
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
pypi
mcp
Moderate
about 4 hours ago
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
pypi
opentelemetry-propagator-jaeger
Moderate
about 4 hours ago
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
pypi
mcp
Moderate
about 4 hours ago
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
pypi
mcp
High
about 9 hours ago
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
pypi
Authlib
Moderate
about 10 hours ago
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
pypi
authlib
Moderate
about 10 hours ago
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
pypi
authlib
Moderate
about 10 hours ago
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
pypi
authlib
Moderate
about 10 hours ago
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
pypi
authlib
High
about 10 hours ago
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
pypi
authlib
Low
about 10 hours ago
Authlib: is_secure_transport() loopback exemption can be bypassed with a userinfo component, allowing cleartext-HTTP URLs to non-loopback hosts
pypi
authlib
High
about 10 hours ago
Datadog dd-trace-py: IAST instrumentation can lead to application DOS
pypi
ddtrace
High
about 10 hours ago
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element
pypi
pymongo
High
about 10 hours ago
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
pypi
vllm
High
about 10 hours ago
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
pypi
strands-agents
Moderate
about 10 hours ago
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
pypi
strands-agents
High
about 10 hours ago
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
pypi
flexible-graphrag
High
about 10 hours ago
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
pypi
litellm
High
about 10 hours ago
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
pypi
GitPython
Moderate
about 10 hours ago
GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
pypi
GitPython
High
about 10 hours ago
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
pypi
GitPython
High
about 10 hours ago
GitPython command wrappers omit unsafe protocol and option checks
pypi
GitPython
Moderate
about 10 hours ago
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
pypi
GitPython
High
about 10 hours ago
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
pypi
GitPython
High
about 10 hours ago
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
pypi
litellm
High
about 10 hours ago
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
pypi
msgpack
High
about 10 hours ago
NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment
pypi
nltk
Critical
about 10 hours ago
Authlib: empty signatures validation in JWS JSON deserialization
pypi
authlib
Moderate
about 11 hours ago
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
pypi
pylint
High
about 11 hours ago
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
pypi
rembg
Low
about 11 hours ago
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
pypi
Twisted
Moderate
about 11 hours ago
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
pypi
fpdf2
Moderate
about 11 hours ago
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
pypi
fpdf2
Critical
about 12 hours ago
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
pypi
agno
High
about 12 hours ago
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
pypi
oauthlib
Critical
about 12 hours ago
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
pypi
monai
Moderate
4 days ago
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
pypi
filelock
Low
4 days ago
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
pypi
filelock
Moderate
4 days ago
virtualenv: Temporary app-data can leave dangling seed package links
pypi
virtualenv
Low
4 days ago
virtualenv: Pip seeding with download omits wheel digest verification
pypi
virtualenv
Low
4 days ago
virtualenv: Downloaded wheel selection and caching precede verification
pypi
virtualenv
High
4 days ago
virtualenv: Xonsh activation literals depend on the script decoding codec
pypi
virtualenv
High
4 days ago
virtualenv: Bash prompt values can change meaning under older compatibility modes
pypi
virtualenv
Low
4 days ago
virtualenv: Venv configuration readback can reinterpret path boundaries
pypi
virtualenv
Moderate
4 days ago
virtualenv: Seed replacement does not contain metadata deletion paths
pypi
virtualenv
Moderate
4 days ago
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
pypi
langgraph-checkpoint-sqlite, langgraph-checkpoint-postgres
Moderate
4 days ago
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
pypi
filelock
Critical
4 days ago
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
pypi
pillow
Moderate
4 days ago
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
pypi
Pillow
Low
4 days ago
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
pypi
setuptools
Moderate
4 days ago
FastMCP: Post-transform component authorization is skipped on direct calls
pypi
fastmcp-slim, fastmcp
Moderate
4 days ago
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
pypi
fastmcp-slim, fastmcp
High
4 days ago
pypdf: Possible long runtimes for repeated references to the same missing object
pypi
pypdf
High
4 days ago
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
pypi
pypdf
High
4 days ago
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
npm, pypi
@strands-agents/sdk, strands-agents
Moderate
4 days ago
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
pypi
Twisted
High
4 days ago
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
pypi
Twisted
Moderate
4 days ago
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
pypi
Twisted
Moderate
5 days ago
virtualenv: Generated files can follow existing destination links
pypi
virtualenv
Moderate
5 days ago
pypdf: Possible long runtimes/large memory usage when retrieving form fields
pypi
pypdf
Moderate
5 days ago
pypdf: Possible large memory usage when parsing arrays and dictionaries
pypi
pypdf
High
5 days ago
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
pypi
Gitpython
High
5 days ago
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
pypi
graphql-core
High
5 days ago
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
pypi
graphql-core
Moderate
5 days ago
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
pypi
opentelemetry-api
High
5 days ago
Black: GitHub Action installs unvalidated required-version from pyproject.toml
pypi
black
High
5 days ago
Django REST framework: TokenProxy.delete() reports success and revokes nothing
pypi
djangorestframework
High
5 days ago
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
pypi
djangorestframework
High
5 days ago
Django REST framework: JSONParser applies an attacker-named codec to the request stream
pypi
djangorestframework
High
5 days ago
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
pypi
Pillow
High
5 days ago
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
pypi
Pillow
High
5 days ago
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
pypi
Pillow
Critical
5 days ago
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
pypi
Pillow
Filter by Severity
Filter by Package
tensorflow
432
tensorflow-gpu
427
tensorflow-cpu
422
open-webui
160
apache-airflow
146
Django
127
mlflow
87
vllm
81
Plone
72
salt
67
apache-superset
66
ansible
65
Pillow
63
pypdf
62
picklescan
59
django
59
pyload-ng
57
aiohttp
55
pillow
53
nltk
52
praisonai
52
PraisonAI
52
gradio
50
praisonaiagents
50
nova
49
vyper
47
matrix-synapse
45
litellm
44
rdiffweb
43
langflow
43
plone
41
keystone
39
GitPython
39
moin
35
opencv-python
31
opencv-contrib-python
31
mcp-atlassian
30
wagtail
30
pgadmin4
26
praisonai-platform
24
virtualenv
24
cryptography
24
weblate
24
openbabel
24
transformers
24
tornado
24
urllib3
22
langchain
22
ethyca-fides
22
glance
22
neutron
21
mistune
21
notebook
21
wger
20
OctoPrint
20
aim
20
keras
20
mobsf
20
lollms
20
vantage6
19
nautobot
19
changedetection.io
19
mindsdb
19
authlib
19
lemur
18
calibreweb
18
cobbler
18
mercurial
18
jupyterlab
18
docling
17
nicegui
17
indico
16
paddlepaddle
16
bentoml
16
h2o
16
djust
16
PaddlePaddle
16
ckan
15
modoboa
15
sentry
15
swift
14
zenml
14
trytond
14
fickling
14
copyparty
14
pydantic-ai-slim
14
pydantic-ai
14
pyftpdlib
14
roundup
13
glances
13
dulwich
13
horizon
13
PyJWT
13
pip
13
onnx
13
datamodel-code-generator
13
onionshare-cli
13
agentscope
13
Glances
13
OpenEXR
13
jupyter-server
13
pyspark
12
torch
12
kiwitcms
12
twisted
12
Weblate
12
ai.h2o:h2o-core
12
homeassistant
12
yt-dlp
12
label-studio
12
pretix
11
motioneye
11
Twisted
11
crawl4ai
11
ray
11
langroid
11
opencv-python-headless
10
stigmem-node
10
fastmcp
10
llama-index-core
10
django-cms
10
waitress
10
hermes-agent
10
Flask-AppBuilder
10
lightrag-hku
10
lief
10
sglang
10
bugsink
10
openssl-encrypt
10
pyjwt
10
lmdeploy
10
justhtml
10
mcp
10
opencv-contrib-python-headless
10
zope
10
metagpt
10
cinder
9
compliance-trestle
9
python-keystoneclient
9
ryu
9
pywasm3
9
ironic
9
langchain-core
9
strawberry-graphql
9
llama-index
9
starlette
9
python-multipart
9
bbot
9
litestar
9
sqlparse
9
requests
8
trac
8
prefect
8
Werkzeug
8
flyto-core
8
bleach
8
jupyterhub
8
aubio
8
dtale
8
numpy
8
codechecker
8
ipython
8
sagemaker
8
docling-slim
8
dbgpt
8
web2py
8
Zope
8
langflow-base
8
snowflake-connector-python
8
keylime
8
monai
8
filelock
8
scrapy
8
fschat
7
ujson
7
executorch
7
djangorestframework
7
uv
7
mayan-edms
7
copier
7
pysaml2
7
omero-web
7
inventree
7
apache-iotdb
7
asyncssh
7
matrix-sydent
7
Products.CMFPlone
7
pymongo
7
rucio-webui
7
lxml
7
tuf
7
ansible-core
7
org.pytorch:executorch-android
6
langchain-chatchat
6
mailman
6
guarddog
6
werkzeug
6
open-webui
6
Mezzanine
6
graphite-web
6
Filter by Repository
https://github.com/tensorflow/tensorflow
433
https://github.com/django/django
121
https://github.com/apache/airflow
105
https://github.com/ansible/ansible
59
https://github.com/python-pillow/Pillow
52
https://github.com/vyperlang/vyper
44
https://github.com/ikus060/rdiffweb
42
https://github.com/saltstack/salt
42
https://github.com/mmaitre314/picklescan
39
https://github.com/gradio-app/gradio
38
https://github.com/openstack/nova
38
https://github.com/plone/Products.CMFPlone
37
https://github.com/mlflow/mlflow
36
https://github.com/opencv/opencv
32
https://github.com/matrix-org/synapse
32
https://github.com/PaddlePaddle/Paddle
31
https://github.com/openstack/keystone
28
https://github.com/vllm-project/vllm
25
https://github.com/langchain-ai/langchain
25
https://github.com/run-llama/llama_index
24
https://github.com/pyload/pyload
24
https://github.com/ethyca/fides
20
https://github.com/huggingface/transformers
19
https://github.com/vantage6/vantage6
17
https://github.com/mindsdb/mindsdb
17
https://github.com/pyca/cryptography
16
https://github.com/cobbler/cobbler
15
https://github.com/MobSF/Mobile-Security-Framework-MobSF
15
https://github.com/aio-libs/aiohttp
15
https://github.com/pgadmin-org/pgadmin4
14
https://github.com/apache/superset
14
https://github.com/janeczku/calibre-web
14
https://github.com/twisted/twisted
14
https://github.com/urllib3/urllib3
14
https://github.com/dpgaspar/Flask-AppBuilder
14
https://github.com/modoboa/modoboa
13
https://github.com/zenml-io/zenml
13
https://github.com/OctoPrint/OctoPrint
13
https://github.com/h2oai/h2o-3
13
https://github.com/getsentry/sentry
12
https://github.com/wagtail/wagtail
12
https://github.com/nautobot/nautobot
12
https://github.com/openstack/glance
12
https://github.com/onionshare/onionshare
11
https://github.com/scrapy/scrapy
11
https://github.com/parisneo/lollms
11
https://github.com/ckan/ckan
10
https://github.com/Pylons/waitress
10
https://github.com/open-webui/open-webui
10
https://github.com/jupyter/notebook
10
https://github.com/HumanSignal/label-studio
10
https://github.com/openstack/horizon
9
https://github.com/BerriAI/litellm
9
https://github.com/WeblateOrg/weblate
9
https://github.com/faucetsdn/ryu
9
https://github.com/element-hq/synapse
9
https://github.com/lief-project/LIEF
9
https://github.com/giampaolo/pyftpdlib
9
https://github.com/aimhubio/aim
9
https://github.com/zopefoundation/Zope
9
https://github.com/keras-team/keras
8
https://github.com/9001/copyparty
8
https://github.com/numpy/numpy
8
https://github.com/pallets/werkzeug
8
https://github.com/tornadoweb/tornado
8
https://github.com/openstack/neutron
8
https://github.com/octoprint/octoprint
8
https://github.com/dgtlmoon/changedetection.io
8
https://github.com/ipython/ipython
8
https://github.com/kiwitcms/Kiwi
8
https://github.com/pytorch/pytorch
7
https://sourceforge.net/projects/sourceforge.net
7
https://github.com/openstack/swift
7
https://github.com/aubio/aubio
7
https://github.com/jupyter-server/jupyter_server
7
https://github.com/pypa/pip
7
https://github.com/indico/indico
7
https://github.com/Ericsson/codechecker
7
https://github.com/pallets/jinja
7
https://github.com/pytorch/executorch
7
https://github.com/py-pdf/pypdf
7
https://github.com/openstack/cinder
7
https://github.com/yt-dlp/yt-dlp
6
https://github.com/psf/requests
6
https://github.com/keylime/keylime
6
https://github.com/matrix-org/sydent
6
https://github.com/corydolphin/flask-cors
6
https://github.com/snowflakedb/snowflake-connector-python
6
https://github.com/roundup-tracker/roundup
6
https://github.com/man-group/dtale
6
https://github.com/modelscope/agentscope
6
https://github.com/lxml/lxml
6
https://github.com/graphite-project/graphite-web
6
https://github.com/benbusby/whoogle-search
6
https://github.com/jupyterlab/jupyterlab
6
https://github.com/ray-project/ray
5
https://github.com/onnx/onnx
5
https://github.com/tryton/trytond
5
https://github.com/ComposioHQ/composio
5
https://github.com/mozilla/bleach
5
https://github.com/ome/omero-web
5
https://github.com/gitpython-developers/GitPython
5
https://github.com/bentoml/BentoML
5
https://github.com/pytorch/serve
5
https://github.com/hwchase17/langchain
5
https://github.com/mitmproxy/mitmproxy
5
https://github.com/home-assistant/core
5
https://github.com/inventree/InvenTree
5
https://github.com/Exiv2/exiv2
5
https://github.com/encode/starlette
5
https://github.com/jupyterhub/oauthenticator
5
https://github.com/esphome/esphome
5
https://github.com/TeamSeri0us/pocs
5
https://github.com/qutebrowser/qutebrowser
4
https://github.com/bytecodealliance/wasmtime
4
https://github.com/langflow-ai/langflow
4
https://github.com/web2py/web2py
4
https://github.com/dbt-labs/dbt-core
4
https://github.com/latchset/jwcrypto
4
https://github.com/saleor/saleor
4
https://github.com/hyperledger/indy-node
4
https://github.com/Cog-Creators/Red-DiscordBot
4
https://github.com/aws/aws-iot-device-sdk-java-v2
4
https://github.com/ronf/asyncssh
4
https://github.com/Kozea/Radicale
4
https://github.com/django-helpdesk/django-helpdesk
4
https://github.com/python-ldap/python-ldap
4
https://github.com/eosphoros-ai/DB-GPT
4
https://github.com/pallets/flask
4
https://github.com/zopefoundation/RestrictedPython
4
https://github.com/wasm3/wasm3
4
https://github.com/mlc-ai/xgrammar
4
https://github.com/grpc/grpc
4
https://github.com/nltk/nltk
4
https://github.com/ietf-tools/xml2rfc
4
https://github.com/pretix/pretix
4
https://github.com/FreeTAKTeam/UI
4
https://github.com/rohe/pysaml2
4
https://github.com/jupyterhub/jupyterhub
4
https://github.com/streamlit/streamlit
4
https://github.com/frappe/frappe
4
https://github.com/simonw/datasette
4
https://github.com/hiyouga/LLaMA-Factory
4
https://github.com/jhpyle/docassemble
4
https://github.com/NVIDIA/NVFlare
4
https://github.com/blacklanternsecurity/bbot
4
https://github.com/AcademySoftwareFoundation/openexr
4
https://github.com/bottlepy/bottle
4
https://github.com/AcademySoftwareFoundation/MaterialX
4
https://github.com/pypa/setuptools
4
https://github.com/berriai/litellm
4
https://github.com/litestar-org/litestar
4
https://github.com/rochacbruno/quokka
3
https://github.com/authlib/authlib
3
https://github.com/GeoNode/geonode
3
https://github.com/apache/streampipes
3
https://github.com/yaml/pyyaml
3
https://github.com/Project-MONAI/MONAI
3
https://github.com/modelscope/ms-swift
3
https://github.com/invoke-ai/InvokeAI
3
https://github.com/theupdateframework/tuf
3
https://github.com/khoj-ai/khoj
3
https://github.com/sosreport/sos
3
https://github.com/apache/iotdb
3
https://github.com/andialbrecht/sqlparse
3
https://github.com/benoitc/gunicorn
3
https://github.com/github/securitylab
3
https://github.com/jlowin/fastmcp
3
https://github.com/mpdavis/python-jose
3
https://github.com/djblets/djblets
3
https://github.com/geyang/ml-logger
3
https://github.com/DavidOsipov/PostQuantum-Feldman-VSS
3
https://github.com/pypa/advisory-db
3
https://github.com/certifi/python-certifi
3
https://github.com/langroid/langroid
3
https://github.com/openstack/python-keystoneclient
3
https://github.com/OpenC3/cosmos
3
https://github.com/ansible/ansible-runner
3
https://github.com/trentm/python-markdown2
3
https://github.com/Gerapy/Gerapy
3
https://gitlab.com/mayan-edms/mayan-edms
3
https://github.com/zopefoundation/AccessControl
3
https://github.com/stephenmcd/mezzanine
3
https://sourceforge.net/projects/roject
3
https://github.com/httplib2/httplib2
3
https://github.com/tinymce/tinymce
3
https://github.com/jupyterhub/jupyter-server-proxy
3
https://github.com/ankitects/anki
3
https://github.com/Kludex/python-multipart
3
https://github.com/NASA-AMMOS/AIT-Core
3
https://github.com/openstack/ironic
3
https://github.com/pyinstaller/pyinstaller
3
https://github.com/pyca/pyopenssl
3
https://github.com/theupdateframework/python-tuf
3
https://github.com/openstack/octavia
3
https://github.com/aws/aws-sam-cli
3
https://github.com/beancount/fava
3
https://github.com/impredicative/bitlyshortener
3
https://github.com/eventlet/eventlet
3