pypi
Security Advisories in pypi
Critical
about 6 hours ago
Rucio: Unauthenticated administrator impersonation through SSH challenge tokens
pypi
rucio
High
about 6 hours ago
Soup Sieve: Polynomial-time denial of service in the descendant combinator
pypi
soupsieve
Moderate
about 6 hours ago
Soup Sieve: General sibling combinator inside :has() matches untrusted HTML in quadratic time
pypi
soupsieve
Moderate
about 8 hours ago
Pillow: Memory DoS in TIFF and EXIF IFD parsing via overlapping tag data
pypi
Pillow
High
about 8 hours ago
Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size
pypi
Pillow
Low
2 days ago
compose-lint: File paths embedded in pull requests can inject CI workflow commands through command-line error messages
pypi
compose-lint
Low
2 days ago
compose-lint: Text in a pull request can issue CI workflow commands through JSON and SARIF output on stdout
pypi
compose-lint
Moderate
3 days ago
compose-lint: Text in a pull request can still issue CI workflow commands through compose-lint 0.31.0's output
pypi
compose-lint
Low
3 days ago
compose-lint: Incomplete fix for GHSA-jf3h-8jvx-vcrg: a run stopped at the finding limit quotes a secret from a CI-generated `.env`
actions, pypi
tmatens/compose-lint, compose-lint
High
3 days ago
GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover
pypi
gpustack
High
3 days ago
AG2: Newline injection in SandboxShellTool bypasses allowed=[...] and readonly=True, enabling arbitrary command execution
pypi
autogen, ag2
Critical
3 days ago
GPUStack: SAML callback trusts an unverified SAMLResponse, allowing authentication bypass and account takeover
pypi
gpustack
Low
3 days ago
compose-lint: A committed symlink makes compose-lint quote a file from outside the project into its output
actions, pypi
tmatens/compose-lint, compose-lint
Low
3 days ago
compose-lint: A `.compose-lint.yml` symlinked outside the project is read, and a parse error quotes part of the target
actions, pypi
tmatens/compose-lint, compose-lint
Low
3 days ago
compose-lint: A pull request can make compose-lint quote a secret from a CI-generated `.env` into its findings
actions, pypi
tmatens/compose-lint, compose-lint
Moderate
3 days ago
compose-lint: `fix --apply` can delete a line the user did not select, including a security setting
pypi
compose-lint
Moderate
3 days ago
compose-lint: Compose file text can issue GitHub Actions workflow commands through the compose-lint Action
pypi, actions
compose-lint, tmatens/compose-lint
Low
3 days ago
compose-lint: .env read through a symlink outside the project can expose the CI job's environment
actions, pypi
tmatens/compose-lint, compose-lint
Moderate
3 days ago
Kiwi TCMS account confirmation open redirect through protocol-relative URLs
pypi
kiwitcms
Moderate
3 days ago
Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)
pypi
urwid
Moderate
3 days ago
fast-agent: `fast-agent serve` binds HTTP to 0.0.0.0 with no authentication by default; with --shell this is unauthenticated remote command execution
pypi
fast-agent-mcp
High
3 days ago
Code Graph RAG: MCP paginated read_file path traversal / arbitrary file read
pypi
code-graph-rag
Critical
3 days ago
fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator
pypi
fastapi-code-generator
Critical
3 days ago
fastapi-code-generator: Import-time RCE via response status-code key -> unescaped @app.get(..., responses={...}) dict
pypi
fastapi-code-generator
Critical
4 days ago
fastapi-code-generator: Call-time RCE via operation summary -> unescaped route-handler docstring
pypi
fastapi-code-generator
High
4 days ago
Logging Redactor: PII data in str/repr of non primitive objects was not being redacted
pypi
loggingredactor
High
13 days ago
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
pypi
pypdf
High
13 days ago
Authlib RFC 7592 examples omit registration-access-token client binding
pypi
Authlib
High
13 days ago
pypdf has possible long runtimes/large memory usage for encrypted PDF files
pypi
pypdf
High
13 days ago
pypdf has possible large memory usage when parsing cross-reference streams
pypi
pypdf
High
13 days ago
pyasn1 has quadratic CPU consumption in constructed BIT STRING decoding
pypi
pyasn1
High
13 days ago
pyasn1 has quadratic-complexity denial of service in binary REAL decoding
pypi
pyasn1
High
13 days ago
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
pypi
pyasn1
High
13 days ago
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
pypi
pyasn1
High
13 days ago
GraphQL-core has denial of service via memory leak in aborted validations
pypi
graphql-core
High
13 days ago
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
pypi
oauthlib
Moderate
13 days ago
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
pypi
openwisp-controller
Moderate
14 days ago
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
pypi
joserfc
High
15 days ago
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
pypi
Twisted
High
15 days ago
PraisonAI vulnerable to Remote Code Execution via Broken AST Sandbox
pypi
praisonai
Moderate
15 days ago
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
pypi
tornado
Moderate
15 days ago
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
pypi
tornado
Critical
15 days ago
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
pypi
electrum
Moderate
15 days ago
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
npm, pypi
mem0ai
Moderate
15 days ago
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
pypi
social-auth-core
Moderate
15 days ago
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
pypi
onnx
Moderate
15 days ago
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
pypi
onnx
Moderate
15 days ago
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
pypi
onnx
Moderate
15 days ago
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
pypi
onnx
Low
15 days ago
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
pypi
vllm
High
15 days ago
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
pypi
vllm
Moderate
15 days ago
vLLM: Out-of-vocabulary prompt token id passes input validation and triggers a CUDA device-side assert (engine crash / DoS)
pypi
vllm
Moderate
15 days ago
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
pypi
vllm
Moderate
15 days ago
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
pypi
vllm
Moderate
15 days ago
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
pypi
langgraph-cli
Moderate
15 days ago
Autobahn Python: permessage-brotli inflates a whole frame before maxMessagePayloadSize is checked (incomplete fix of GHSA-hxp9-w8x3-p566)
pypi
autobahn
High
15 days ago
LangGraph JavaScript custom authentication may permit cross-user Store access
pypi
langgraph-api
Moderate
15 days ago
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
pypi
filelock
Moderate
15 days ago
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
pypi
filelock
Moderate
15 days ago
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
pypi
filelock
Moderate
15 days ago
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
pypi
filelock
Moderate
15 days ago
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
pypi
filelock
Moderate
15 days ago
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
pypi
filelock
Moderate
15 days ago
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
pypi
filelock
Moderate
15 days ago
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
pypi
langgraph, langgraph-sdk
High
16 days ago
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source
pypi
mlflow
Moderate
16 days ago
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
pypi
mlflow
Moderate
16 days ago
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
pypi
opentelemetry-propagator-jaeger
High
17 days ago
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
pypi
Authlib
Moderate
17 days ago
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
pypi
authlib
Moderate
17 days ago
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
pypi
authlib
Filter by Severity
Filter by Package
tensorflow
430
tensorflow-gpu
427
tensorflow-cpu
423
open-webui
161
apache-airflow
145
Django
127
vllm
89
mlflow
87
Plone
72
pypdf
69
salt
67
apache-superset
66
ansible
65
Pillow
65
picklescan
59
pyload-ng
57
aiohttp
55
pillow
53
praisonai
53
nltk
52
PraisonAI
52
praisonaiagents
50
gradio
50
nova
49
vyper
47
django
46
matrix-synapse
45
litellm
44
langflow
43
rdiffweb
43
GitPython
39
keystone
39
moin
35
opencv-contrib-python
31
opencv-python
31
mcp-atlassian
30
wagtail
30
plone
28
tornado
27
pgadmin4
26
virtualenv
24
praisonai-platform
24
weblate
24
openbabel
24
transformers
24
cryptography
24
langchain
22
ethyca-fides
22
urllib3
22
glance
22
mistune
21
neutron
21
OctoPrint
21
notebook
21
wger
20
filelock
20
lollms
20
keras
20
aim
20
mobsf
20
mindsdb
19
changedetection.io
19
nautobot
19
vantage6
19
authlib
19
mercurial
18
calibreweb
18
cobbler
18
jupyterlab
18
lemur
18
docling
17
onnx
17
nicegui
17
djust
16
h2o
16
PaddlePaddle
16
bentoml
16
indico
16
paddlepaddle
16
sentry
15
ckan
15
modoboa
15
swift
14
copyparty
14
pyftpdlib
14
fickling
14
trytond
14
zenml
14
pydantic-ai
14
pydantic-ai-slim
14
jupyter-server
13
OpenEXR
13
datamodel-code-generator
13
onionshare-cli
13
Glances
13
horizon
13
dulwich
13
torch
13
kiwitcms
13
roundup
13
agentscope
13
glances
13
PyJWT
13
pip
13
label-studio
12
homeassistant
12
Twisted
12
yt-dlp
12
Weblate
12
ai.h2o:h2o-core
12
pyspark
12
twisted
12
ray
11
langroid
11
crawl4ai
11
pretix
11
motioneye
11
compose-lint
10
opencv-python-headless
10
zope
10
bugsink
10
openssl-encrypt
10
mcp
10
lmdeploy
10
hermes-agent
10
waitress
10
llama-index-core
10
Flask-AppBuilder
10
sglang
10
opencv-contrib-python-headless
10
stigmem-node
10
pyjwt
10
fastmcp
10
justhtml
10
django-cms
10
lief
10
lightrag-hku
10
metagpt
10
litestar
9
compliance-trestle
9
bbot
9
llama-index
9
cinder
9
python-multipart
9
ryu
9
prefect
9
langchain-core
9
pywasm3
9
python-keystoneclient
9
starlette
9
ironic
9
strawberry-graphql
9
sqlparse
9
pyasn1
9
sagemaker
8
dtale
8
monai
8
Zope
8
Zope2
8
docling-slim
8
bleach
8
jupyterhub
8
ipython
8
aubio
8
scrapy
8
keylime
8
codechecker
8
numpy
8
requests
8
snowflake-connector-python
8
trac
8
langflow-base
8
Werkzeug
8
dbgpt
8
flyto-core
8
web2py
8
mayan-edms
7
social-auth-core
7
copier
7
pymongo
7
uv
7
omero-web
7
inventree
7
rucio-webui
7
asyncssh
7
matrix-sydent
7
tuf
7
ansible-core
7
ujson
7
lxml
7
fschat
7
apache-iotdb
7
executorch
7
pysaml2
7
djangorestframework
7
mesop
6
mailman
6
guarddog
6
RestrictedPython
6
org.pytorch:executorch-android
6
Filter by Repository
https://github.com/tensorflow/tensorflow
433
https://github.com/django/django
121
https://github.com/apache/airflow
105
https://github.com/ansible/ansible
59
https://github.com/python-pillow/Pillow
52
https://github.com/vyperlang/vyper
44
https://github.com/ikus060/rdiffweb
42
https://github.com/saltstack/salt
42
https://github.com/mmaitre314/picklescan
39
https://github.com/openstack/nova
38
https://github.com/gradio-app/gradio
38
https://github.com/plone/Products.CMFPlone
37
https://github.com/mlflow/mlflow
36
https://github.com/opencv/opencv
32
https://github.com/matrix-org/synapse
32
https://github.com/PaddlePaddle/Paddle
31
https://github.com/openstack/keystone
28
https://github.com/vllm-project/vllm
25
https://github.com/langchain-ai/langchain
25
https://github.com/pyload/pyload
24
https://github.com/run-llama/llama_index
24
https://github.com/ethyca/fides
20
https://github.com/huggingface/transformers
19
https://github.com/mindsdb/mindsdb
17
https://github.com/vantage6/vantage6
17
https://github.com/pyca/cryptography
16
https://github.com/MobSF/Mobile-Security-Framework-MobSF
15
https://github.com/aio-libs/aiohttp
15
https://github.com/cobbler/cobbler
15
https://github.com/urllib3/urllib3
14
https://github.com/twisted/twisted
14
https://github.com/dpgaspar/Flask-AppBuilder
14
https://github.com/apache/superset
14
https://github.com/pgadmin-org/pgadmin4
14
https://github.com/janeczku/calibre-web
14
https://github.com/h2oai/h2o-3
13
https://github.com/OctoPrint/OctoPrint
13
https://github.com/modoboa/modoboa
13
https://github.com/zenml-io/zenml
13
https://github.com/openstack/glance
12
https://github.com/nautobot/nautobot
12
https://github.com/getsentry/sentry
12
https://github.com/wagtail/wagtail
12
https://github.com/onionshare/onionshare
11
https://github.com/scrapy/scrapy
11
https://github.com/parisneo/lollms
11
https://github.com/Pylons/waitress
10
https://github.com/HumanSignal/label-studio
10
https://github.com/open-webui/open-webui
10
https://github.com/ckan/ckan
10
https://github.com/jupyter/notebook
10
https://github.com/element-hq/synapse
9
https://github.com/giampaolo/pyftpdlib
9
https://github.com/BerriAI/litellm
9
https://github.com/openstack/horizon
9
https://github.com/zopefoundation/Zope
9
https://github.com/lief-project/LIEF
9
https://github.com/faucetsdn/ryu
9
https://github.com/aimhubio/aim
9
https://github.com/WeblateOrg/weblate
9
https://github.com/keras-team/keras
8
https://github.com/pallets/werkzeug
8
https://github.com/numpy/numpy
8
https://github.com/9001/copyparty
8
https://github.com/kiwitcms/Kiwi
8
https://github.com/tornadoweb/tornado
8
https://github.com/ipython/ipython
8
https://github.com/openstack/neutron
8
https://github.com/dgtlmoon/changedetection.io
8
https://github.com/octoprint/octoprint
8
https://github.com/openstack/cinder
7
https://github.com/pytorch/pytorch
7
https://github.com/openstack/swift
7
https://github.com/Ericsson/codechecker
7
https://github.com/pytorch/executorch
7
https://github.com/aubio/aubio
7
https://github.com/pypa/pip
7
https://github.com/indico/indico
7
https://github.com/pallets/jinja
7
https://sourceforge.net/projects/sourceforge.net
7
https://github.com/jupyter-server/jupyter_server
7
https://github.com/py-pdf/pypdf
7
https://github.com/man-group/dtale
6
https://github.com/modelscope/agentscope
6
https://github.com/graphite-project/graphite-web
6
https://github.com/corydolphin/flask-cors
6
https://github.com/yt-dlp/yt-dlp
6
https://github.com/lxml/lxml
6
https://github.com/benbusby/whoogle-search
6
https://github.com/keylime/keylime
6
https://github.com/matrix-org/sydent
6
https://github.com/roundup-tracker/roundup
6
https://github.com/jupyterlab/jupyterlab
6
https://github.com/psf/requests
6
https://github.com/snowflakedb/snowflake-connector-python
6
https://github.com/mozilla/bleach
5
https://github.com/bentoml/BentoML
5
https://github.com/ComposioHQ/composio
5
https://github.com/jupyterhub/oauthenticator
5
https://github.com/onnx/onnx
5
https://github.com/tryton/trytond
5
https://github.com/esphome/esphome
5
https://github.com/ome/omero-web
5
https://github.com/pytorch/serve
5
https://github.com/mitmproxy/mitmproxy
5
https://github.com/hwchase17/langchain
5
https://github.com/ray-project/ray
5
https://github.com/TeamSeri0us/pocs
5
https://github.com/encode/starlette
5
https://github.com/gitpython-developers/GitPython
5
https://github.com/inventree/InvenTree
5
https://github.com/Exiv2/exiv2
5
https://github.com/home-assistant/core
5
https://github.com/dbt-labs/dbt-core
4
https://github.com/simonw/datasette
4
https://github.com/pallets/flask
4
https://github.com/berriai/litellm
4
https://github.com/bytecodealliance/wasmtime
4
https://github.com/zopefoundation/RestrictedPython
4
https://github.com/rohe/pysaml2
4
https://github.com/streamlit/streamlit
4
https://github.com/jhpyle/docassemble
4
https://github.com/qutebrowser/qutebrowser
4
https://github.com/mlc-ai/xgrammar
4
https://github.com/django-helpdesk/django-helpdesk
4
https://github.com/python-ldap/python-ldap
4
https://github.com/blacklanternsecurity/bbot
4
https://github.com/wasm3/wasm3
4
https://github.com/ietf-tools/xml2rfc
4
https://github.com/grpc/grpc
4
https://github.com/Kozea/Radicale
4
https://github.com/nltk/nltk
4
https://github.com/AcademySoftwareFoundation/MaterialX
4
https://github.com/FreeTAKTeam/UI
4
https://github.com/eosphoros-ai/DB-GPT
4
https://github.com/litestar-org/litestar
4
https://github.com/pretix/pretix
4
https://github.com/aws/aws-iot-device-sdk-java-v2
4
https://github.com/AcademySoftwareFoundation/openexr
4
https://github.com/jupyterhub/jupyterhub
4
https://github.com/pypa/setuptools
4
https://github.com/Cog-Creators/Red-DiscordBot
4
https://github.com/frappe/frappe
4
https://github.com/hyperledger/indy-node
4
https://github.com/hiyouga/LLaMA-Factory
4
https://github.com/NVIDIA/NVFlare
4
https://github.com/saleor/saleor
4
https://github.com/latchset/jwcrypto
4
https://github.com/langflow-ai/langflow
4
https://github.com/ronf/asyncssh
4
https://github.com/web2py/web2py
4
https://github.com/bottlepy/bottle
4
https://github.com/andialbrecht/sqlparse
3
https://github.com/benoitc/gunicorn
3
https://github.com/geyang/ml-logger
3
https://github.com/pypa/advisory-db
3
https://github.com/beancount/fava
3
https://github.com/lepture/mistune
3
https://github.com/DavidOsipov/PostQuantum-Feldman-VSS
3
https://github.com/aws/aws-sam-cli
3
https://github.com/furlongm/openvpn-monitor
3
https://github.com/apache/submarine
3
https://github.com/langroid/langroid
3
https://github.com/openstack/octavia
3
https://github.com/OpenC3/cosmos
3
https://github.com/python/cpython
3
https://github.com/chatchat-space/Langchain-Chatchat
3
https://github.com/pyca/pyopenssl
3
https://github.com/paramiko/paramiko
3
https://github.com/moinwiki/moin-1.9
3
https://github.com/rochacbruno/quokka
3
https://github.com/jpadilla/pyjwt
3
https://github.com/certifi/python-certifi
3
https://github.com/github/securitylab
3
https://github.com/jlowin/fastmcp
3
https://github.com/Project-MONAI/MONAI
3
https://github.com/mpdavis/python-jose
3
https://github.com/djblets/djblets
3
https://github.com/eventlet/eventlet
3
https://github.com/apache/streampipes
3
https://github.com/invoke-ai/InvokeAI
3
https://github.com/modelscope/ms-swift
3
https://github.com/khoj-ai/khoj
3
https://github.com/jupyterhub/jupyter-server-proxy
3
https://github.com/theupdateframework/tuf
3
https://sourceforge.net/projects/roject
3
https://github.com/openstack/python-keystoneclient
3
https://github.com/sosreport/sos
3
https://github.com/yaml/pyyaml
3
https://github.com/apache/iotdb
3
https://github.com/zauberzeug/nicegui
3
https://gitlab.com/mayan-edms/mayan-edms
3
https://github.com/aws/sagemaker-python-sdk
3
https://github.com/dlitz/pycrypto
3
https://github.com/authlib/authlib
3
https://github.com/NASA-AMMOS/AIT-Core
3
https://github.com/adamghill/django-unicorn
3
https://github.com/Kludex/python-multipart
3
https://github.com/ankitects/anki
3