pypi
Security Advisories in pypi
High
4 days ago
pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search
pypi
pypdf
High
4 days ago
Authlib RFC 7592 examples omit registration-access-token client binding
pypi
Authlib
High
4 days ago
pypdf has possible long runtimes/large memory usage for encrypted PDF files
pypi
pypdf
High
4 days ago
pypdf has possible large memory usage when parsing cross-reference streams
pypi
pypdf
High
4 days ago
pyasn1 has quadratic-complexity denial of service in binary REAL decoding
pypi
pyasn1
High
4 days ago
pyasn1 has quadratic-time denial of service in constructed string and indefinite-length ANY decoding
pypi
pyasn1
High
4 days ago
pyasn1 has quadratic CPU use in schemaless BER/CER/DER container decoding
pypi
pyasn1
High
4 days ago
GraphQL-core has denial of service via memory leak in aborted validations
pypi
graphql-core
High
4 days ago
OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client
pypi
oauthlib
Moderate
4 days ago
OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
pypi
openwisp-controller
Moderate
4 days ago
joserfc: Compact JWS size guard allocates attacker-controlled segments before rejection
pypi
joserfc
High
5 days ago
Twisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset
pypi
Twisted
Moderate
6 days ago
Tornado: Event loop blocking and excess memory use from chunked bodies with many small chunks
pypi
tornado
Moderate
6 days ago
Tornado: Quadratic CPU usage when parsing HTTP headers with line folding
pypi
tornado
Critical
6 days ago
Electrum: Malicious server can replace a just-broadcast tx and try to trick user into RBF-ing it
pypi
electrum
Moderate
6 days ago
Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
npm, pypi
mem0ai
Moderate
6 days ago
Python Social Auth: OpenID Connect nonce is not bound to the browser session, so a stolen authorization code logs the attacker in as the victim
pypi
social-auth-core
Moderate
6 days ago
ONNX: Out-of-bounds read in ConvTranspose shape inference via undersized weight rank
pypi
onnx
Moderate
6 days ago
ONNX: Denial of service via unchecked expansion of packed sub-byte tensors in ONNX Python APIs
pypi
onnx
Moderate
6 days ago
ONNX: Null Pointer Dereference in ScanInferenceFunction Due to Missing Required Attribute
pypi
onnx
Moderate
6 days ago
ONNX: Out-of-Bounds Read in RNN/GRU/LSTM Shape Inference (Old Opsets, Missing Rank Check)
pypi
onnx
Low
6 days ago
vLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP server
pypi
vllm
High
6 days ago
vLLM: Untrusted EPS inputs can trigger denial of service or Ghostscript RCE
pypi
vllm
Moderate
6 days ago
vLLM: Responses API bypasses trust_request_chat_template for chat_template_kwargs
pypi
vllm
Moderate
6 days ago
vLLM: DoS via unbounded chat_template Jinja2 rendering exhausts the renderer thread pool
pypi
vllm
Moderate
6 days ago
LangGraph CLI prints the registry push token in `langgraph deploy --verbose` output
pypi
langgraph-cli
High
6 days ago
LangGraph JavaScript custom authentication may permit cross-user Store access
pypi
langgraph-api
Moderate
6 days ago
filelock: StrictSoftFileLock and SoftReadWriteLock adopt a protocol directory another user created first, losing mutual exclusion
pypi
filelock
Moderate
6 days ago
filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL
pypi
filelock
Moderate
6 days ago
filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout
pypi
filelock
Moderate
6 days ago
filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker
pypi
filelock
Moderate
6 days ago
filelock: UnixFileLock truncates and chmods any regular file another user renames or hard-links onto the lock path
pypi
filelock
Moderate
6 days ago
filelock: ReadWriteLock follows a symlink at the lock path into SQLite
pypi
filelock
Moderate
6 days ago
filelock: SoftFileLock stale-lock break removes a live lock file on a reused inode number and admits two holders
pypi
filelock
Moderate
6 days ago
LangGraph: Unencoded identifiers in LangGraph SDK v3 streaming can redirect authenticated GET requests
pypi
langgraph, langgraph-sdk
High
7 days ago
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source
pypi
mlflow
Moderate
7 days ago
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
pypi
mlflow
Moderate
7 days ago
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
pypi
opentelemetry-propagator-jaeger
High
7 days ago
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
pypi
Authlib
Moderate
7 days ago
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
pypi
authlib
Moderate
7 days ago
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
pypi
authlib
Moderate
7 days ago
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
pypi
authlib
Moderate
7 days ago
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
pypi
authlib
High
7 days ago
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
pypi
authlib
High
7 days ago
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element
pypi
pymongo
High
7 days ago
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
pypi
vllm
High
7 days ago
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
pypi
strands-agents
Moderate
7 days ago
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
pypi
strands-agents
High
7 days ago
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
pypi
flexible-graphrag
High
7 days ago
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
pypi
litellm
High
7 days ago
GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)
pypi
GitPython
Moderate
7 days ago
GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
pypi
GitPython
High
7 days ago
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
pypi
GitPython
Moderate
7 days ago
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
pypi
GitPython
High
7 days ago
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
pypi
GitPython
High
7 days ago
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
pypi
litellm
High
7 days ago
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
pypi
msgpack
Moderate
7 days ago
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
pypi
pylint
High
7 days ago
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
pypi
rembg
Low
7 days ago
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
pypi
Twisted
Moderate
7 days ago
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
pypi
fpdf2
Moderate
7 days ago
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
pypi
fpdf2
Critical
7 days ago
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
pypi
agno
High
7 days ago
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
pypi
oauthlib
Critical
7 days ago
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
pypi
monai
Moderate
11 days ago
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
pypi
filelock
Filter by Severity
Filter by Package
tensorflow
433
tensorflow-gpu
427
tensorflow-cpu
423
open-webui
160
apache-airflow
146
Django
127
vllm
89
mlflow
87
Plone
72
pypdf
69
salt
67
apache-superset
66
ansible
65
Pillow
63
picklescan
59
django
59
pyload-ng
57
aiohttp
55
pillow
53
praisonai
53
PraisonAI
52
nltk
52
gradio
50
praisonaiagents
50
nova
49
vyper
47
matrix-synapse
45
litellm
44
langflow
43
rdiffweb
43
plone
41
GitPython
39
keystone
39
moin
35
opencv-python
31
opencv-contrib-python
31
mcp-atlassian
30
wagtail
30
tornado
27
pgadmin4
26
transformers
24
cryptography
24
weblate
24
openbabel
24
praisonai-platform
24
virtualenv
24
glance
22
ethyca-fides
22
urllib3
22
langchain
22
neutron
21
mistune
21
notebook
21
OctoPrint
20
lollms
20
keras
20
aim
20
wger
20
filelock
20
mobsf
20
nautobot
19
mindsdb
19
authlib
19
changedetection.io
19
vantage6
19
jupyterlab
18
cobbler
18
lemur
18
mercurial
18
calibreweb
18
docling
17
onnx
17
nicegui
17
PaddlePaddle
16
djust
16
indico
16
h2o
16
bentoml
16
paddlepaddle
16
ckan
15
modoboa
15
sentry
15
pyftpdlib
14
pydantic-ai
14
zenml
14
swift
14
trytond
14
pydantic-ai-slim
14
copyparty
14
fickling
14
dulwich
13
horizon
13
onionshare-cli
13
OpenEXR
13
glances
13
datamodel-code-generator
13
pip
13
PyJWT
13
jupyter-server
13
agentscope
13
Glances
13
roundup
13
yt-dlp
12
kiwitcms
12
label-studio
12
homeassistant
12
ai.h2o:h2o-core
12
Twisted
12
Weblate
12
pyspark
12
torch
12
twisted
12
crawl4ai
11
ray
11
pretix
11
motioneye
11
langroid
11
opencv-contrib-python-headless
10
mcp
10
hermes-agent
10
pyjwt
10
lief
10
sglang
10
openssl-encrypt
10
django-cms
10
lightrag-hku
10
justhtml
10
bugsink
10
stigmem-node
10
Flask-AppBuilder
10
lmdeploy
10
metagpt
10
zope
10
waitress
10
opencv-python-headless
10
fastmcp
10
llama-index-core
10
compliance-trestle
9
ironic
9
langchain-core
9
starlette
9
python-multipart
9
python-keystoneclient
9
llama-index
9
bbot
9
litestar
9
strawberry-graphql
9
cinder
9
sqlparse
9
ryu
9
pywasm3
9
pyasn1
9
dbgpt
8
aubio
8
trac
8
keylime
8
snowflake-connector-python
8
web2py
8
requests
8
ipython
8
flyto-core
8
Zope
8
docling-slim
8
jupyterhub
8
Zope2
8
sagemaker
8
monai
8
langflow-base
8
dtale
8
Werkzeug
8
prefect
8
scrapy
8
codechecker
8
numpy
8
bleach
8
matrix-sydent
7
ansible-core
7
omero-web
7
copier
7
tuf
7
pymongo
7
fschat
7
pysaml2
7
Products.CMFPlone
7
rucio-webui
7
apache-iotdb
7
asyncssh
7
social-auth-core
7
inventree
7
djangorestframework
7
uv
7
mayan-edms
7
lxml
7
executorch
7
ujson
7
joserfc
6
pytorch-lightning
6
langchain-community
6
esphome
6
Mezzanine
6
Filter by Repository
https://github.com/tensorflow/tensorflow
433
https://github.com/django/django
121
https://github.com/apache/airflow
105
https://github.com/ansible/ansible
59
https://github.com/python-pillow/Pillow
52
https://github.com/vyperlang/vyper
44
https://github.com/ikus060/rdiffweb
42
https://github.com/saltstack/salt
42
https://github.com/mmaitre314/picklescan
39
https://github.com/gradio-app/gradio
38
https://github.com/openstack/nova
38
https://github.com/plone/Products.CMFPlone
37
https://github.com/mlflow/mlflow
36
https://github.com/opencv/opencv
32
https://github.com/matrix-org/synapse
32
https://github.com/PaddlePaddle/Paddle
31
https://github.com/openstack/keystone
28
https://github.com/vllm-project/vllm
25
https://github.com/langchain-ai/langchain
25
https://github.com/run-llama/llama_index
24
https://github.com/pyload/pyload
24
https://github.com/ethyca/fides
20
https://github.com/huggingface/transformers
19
https://github.com/vantage6/vantage6
17
https://github.com/mindsdb/mindsdb
17
https://github.com/pyca/cryptography
16
https://github.com/cobbler/cobbler
15
https://github.com/MobSF/Mobile-Security-Framework-MobSF
15
https://github.com/aio-libs/aiohttp
15
https://github.com/pgadmin-org/pgadmin4
14
https://github.com/apache/superset
14
https://github.com/janeczku/calibre-web
14
https://github.com/twisted/twisted
14
https://github.com/urllib3/urllib3
14
https://github.com/dpgaspar/Flask-AppBuilder
14
https://github.com/modoboa/modoboa
13
https://github.com/zenml-io/zenml
13
https://github.com/OctoPrint/OctoPrint
13
https://github.com/h2oai/h2o-3
13
https://github.com/getsentry/sentry
12
https://github.com/wagtail/wagtail
12
https://github.com/nautobot/nautobot
12
https://github.com/openstack/glance
12
https://github.com/onionshare/onionshare
11
https://github.com/scrapy/scrapy
11
https://github.com/parisneo/lollms
11
https://github.com/ckan/ckan
10
https://github.com/Pylons/waitress
10
https://github.com/open-webui/open-webui
10
https://github.com/jupyter/notebook
10
https://github.com/HumanSignal/label-studio
10
https://github.com/openstack/horizon
9
https://github.com/zopefoundation/Zope
9
https://github.com/BerriAI/litellm
9
https://github.com/WeblateOrg/weblate
9
https://github.com/faucetsdn/ryu
9
https://github.com/aimhubio/aim
9
https://github.com/giampaolo/pyftpdlib
9
https://github.com/element-hq/synapse
9
https://github.com/lief-project/LIEF
9
https://github.com/keras-team/keras
8
https://github.com/dgtlmoon/changedetection.io
8
https://github.com/ipython/ipython
8
https://github.com/9001/copyparty
8
https://github.com/numpy/numpy
8
https://github.com/openstack/neutron
8
https://github.com/pallets/werkzeug
8
https://github.com/tornadoweb/tornado
8
https://github.com/kiwitcms/Kiwi
8
https://github.com/octoprint/octoprint
8
https://github.com/pytorch/pytorch
7
https://sourceforge.net/projects/sourceforge.net
7
https://github.com/openstack/swift
7
https://github.com/aubio/aubio
7
https://github.com/jupyter-server/jupyter_server
7
https://github.com/openstack/cinder
7
https://github.com/indico/indico
7
https://github.com/pypa/pip
7
https://github.com/py-pdf/pypdf
7
https://github.com/Ericsson/codechecker
7
https://github.com/pallets/jinja
7
https://github.com/pytorch/executorch
7
https://github.com/yt-dlp/yt-dlp
6
https://github.com/psf/requests
6
https://github.com/keylime/keylime
6
https://github.com/matrix-org/sydent
6
https://github.com/corydolphin/flask-cors
6
https://github.com/snowflakedb/snowflake-connector-python
6
https://github.com/roundup-tracker/roundup
6
https://github.com/man-group/dtale
6
https://github.com/modelscope/agentscope
6
https://github.com/lxml/lxml
6
https://github.com/graphite-project/graphite-web
6
https://github.com/benbusby/whoogle-search
6
https://github.com/jupyterlab/jupyterlab
6
https://github.com/hwchase17/langchain
5
https://github.com/onnx/onnx
5
https://github.com/tryton/trytond
5
https://github.com/ComposioHQ/composio
5
https://github.com/ome/omero-web
5
https://github.com/mozilla/bleach
5
https://github.com/gitpython-developers/GitPython
5
https://github.com/pytorch/serve
5
https://github.com/bentoml/BentoML
5
https://github.com/ray-project/ray
5
https://github.com/mitmproxy/mitmproxy
5
https://github.com/home-assistant/core
5
https://github.com/inventree/InvenTree
5
https://github.com/Exiv2/exiv2
5
https://github.com/encode/starlette
5
https://github.com/jupyterhub/oauthenticator
5
https://github.com/esphome/esphome
5
https://github.com/TeamSeri0us/pocs
5
https://github.com/qutebrowser/qutebrowser
4
https://github.com/bytecodealliance/wasmtime
4
https://github.com/langflow-ai/langflow
4
https://github.com/web2py/web2py
4
https://github.com/dbt-labs/dbt-core
4
https://github.com/latchset/jwcrypto
4
https://github.com/saleor/saleor
4
https://github.com/hyperledger/indy-node
4
https://github.com/Cog-Creators/Red-DiscordBot
4
https://github.com/aws/aws-iot-device-sdk-java-v2
4
https://github.com/ronf/asyncssh
4
https://github.com/Kozea/Radicale
4
https://github.com/django-helpdesk/django-helpdesk
4
https://github.com/python-ldap/python-ldap
4
https://github.com/eosphoros-ai/DB-GPT
4
https://github.com/pallets/flask
4
https://github.com/zopefoundation/RestrictedPython
4
https://github.com/wasm3/wasm3
4
https://github.com/mlc-ai/xgrammar
4
https://github.com/grpc/grpc
4
https://github.com/nltk/nltk
4
https://github.com/ietf-tools/xml2rfc
4
https://github.com/pretix/pretix
4
https://github.com/FreeTAKTeam/UI
4
https://github.com/rohe/pysaml2
4
https://github.com/jupyterhub/jupyterhub
4
https://github.com/streamlit/streamlit
4
https://github.com/frappe/frappe
4
https://github.com/simonw/datasette
4
https://github.com/hiyouga/LLaMA-Factory
4
https://github.com/jhpyle/docassemble
4
https://github.com/NVIDIA/NVFlare
4
https://github.com/blacklanternsecurity/bbot
4
https://github.com/AcademySoftwareFoundation/openexr
4
https://github.com/bottlepy/bottle
4
https://github.com/berriai/litellm
4
https://github.com/pypa/setuptools
4
https://github.com/AcademySoftwareFoundation/MaterialX
4
https://github.com/litestar-org/litestar
4
https://github.com/rochacbruno/quokka
3
https://github.com/authlib/authlib
3
https://github.com/GeoNode/geonode
3
https://github.com/apache/streampipes
3
https://github.com/yaml/pyyaml
3
https://github.com/Project-MONAI/MONAI
3
https://github.com/modelscope/ms-swift
3
https://github.com/invoke-ai/InvokeAI
3
https://github.com/theupdateframework/tuf
3
https://github.com/khoj-ai/khoj
3
https://github.com/sosreport/sos
3
https://github.com/apache/iotdb
3
https://github.com/andialbrecht/sqlparse
3
https://github.com/benoitc/gunicorn
3
https://github.com/github/securitylab
3
https://github.com/jlowin/fastmcp
3
https://github.com/mpdavis/python-jose
3
https://github.com/djblets/djblets
3
https://github.com/geyang/ml-logger
3
https://github.com/DavidOsipov/PostQuantum-Feldman-VSS
3
https://github.com/certifi/python-certifi
3
https://github.com/pypa/advisory-db
3
https://github.com/langroid/langroid
3
https://github.com/openstack/python-keystoneclient
3
https://github.com/OpenC3/cosmos
3
https://github.com/ansible/ansible-runner
3
https://github.com/trentm/python-markdown2
3
https://github.com/Gerapy/Gerapy
3
https://gitlab.com/mayan-edms/mayan-edms
3
https://github.com/zopefoundation/AccessControl
3
https://github.com/stephenmcd/mezzanine
3
https://sourceforge.net/projects/roject
3
https://github.com/httplib2/httplib2
3
https://github.com/tinymce/tinymce
3
https://github.com/jupyterhub/jupyter-server-proxy
3
https://github.com/ankitects/anki
3
https://github.com/Kludex/python-multipart
3
https://github.com/NASA-AMMOS/AIT-Core
3
https://github.com/openstack/ironic
3
https://github.com/pyinstaller/pyinstaller
3
https://github.com/pyca/pyopenssl
3
https://github.com/theupdateframework/python-tuf
3
https://github.com/openstack/octavia
3
https://github.com/aws/aws-sam-cli
3
https://github.com/beancount/fava
3
https://github.com/impredicative/bitlyshortener
3
https://github.com/eventlet/eventlet
3