pypi
Security Advisories in pypi
Moderate
about 14 hours ago
Wagtail: Improper restriction handling on Page translation API endpoint
pypi
wagtail
Moderate
about 14 hours ago
Wagtail: Improper permission handling when copying snippets
pypi
wagtail
Moderate
about 14 hours ago
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
pypi
wagtail
Moderate
about 14 hours ago
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
pypi
django-cms
Moderate
about 14 hours ago
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
pypi
django-cms
Moderate
about 14 hours ago
django CMS: Stored XSS in edit-mode plugin exception rendering
pypi
django-cms
Moderate
about 14 hours ago
django CMS: Structure endpoint bypasses page-view permission
pypi
django-cms
Moderate
about 14 hours ago
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
pypi
django-cms
Moderate
about 14 hours ago
Wagtail: Pages translations can be created without page permissions when using simple_translation
pypi
wagtail
Moderate
about 14 hours ago
Wagtail: Denial of service via unbounded filter specs in the image preview
pypi
wagtail
Moderate
about 14 hours ago
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
pypi
wagtail
Moderate
about 14 hours ago
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
cargo, pypi
kcl-lib, zoo-kcl
Moderate
about 14 hours ago
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
cargo, pypi
kcl-lib, zoo-kcl
Moderate
about 14 hours ago
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
pypi
stigmem-node
High
about 15 hours ago
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
pypi
langgraph-store-mongodb, langgraph-checkpoint-mongodb
Moderate
about 15 hours ago
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
pypi
asteval
High
1 day ago
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
pypi
document-merge-service
High
1 day ago
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
pypi
copier
Moderate
1 day ago
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
pypi
langgraph-api
Moderate
1 day ago
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
pypi
langgraph-api
Moderate
2 days ago
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
pypi
linuxfabrik-lib
High
2 days ago
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
pypi
lemur
Moderate
2 days ago
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
pypi
lemur
Moderate
2 days ago
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
pypi
lemur
High
2 days ago
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
pypi
lemur
High
3 days ago
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
pypi
monai
Critical
3 days ago
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
pypi
resdata
Moderate
3 days ago
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
pypi
mobsf
Moderate
3 days ago
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
pypi
mobsf
High
3 days ago
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
pypi, npm
geolens, geolens-cli, @geolens/sdk
High
3 days ago
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
pypi
atomic-agents-stack
High
3 days ago
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
pypi
atomic-agents-stack
High
4 days ago
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
pypi
sqlparse
High
4 days ago
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
pypi
sqlparse
Moderate
4 days ago
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
pypi
glances
High
4 days ago
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
pypi
glances
Moderate
4 days ago
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
pypi
sqlparse
High
4 days ago
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
pypi
glances
Moderate
7 days ago
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
pypi
mcp-contextforge-gateway
High
8 days ago
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
pypi
nltk
High
8 days ago
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
pypi
atomic-agents-stack
Moderate
8 days ago
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
pypi
pydantic-ai, pydantic-ai-slim
High
8 days ago
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
pypi
ansible-jailexec
High
9 days ago
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
pypi
stata-mcp
High
9 days ago
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
pypi
compliance-trestle
Moderate
14 days ago
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
pypi
pypdf
High
14 days ago
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
pypi
pymdown-extensions
High
14 days ago
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
pypi
GitPython
Moderate
14 days ago
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
pypi
GitPython
High
14 days ago
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
pypi
GitPython
High
14 days ago
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
pypi
GitPython
Moderate
15 days ago
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
pypi
awscli
Moderate
15 days ago
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
pypi
langgraph-checkpoint-sqlite, langgraph-checkpoint-postgres
High
16 days ago
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
pypi
open-webui
Moderate
16 days ago
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
pypi
open-webui
High
16 days ago
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
pypi
open-webui
Moderate
16 days ago
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
pypi
open-webui
Moderate
17 days ago
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
pypi
open-webui
Moderate
17 days ago
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
pypi
open-webui
Moderate
17 days ago
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
pypi
open-webui
Moderate
17 days ago
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
pypi
open-webui
High
17 days ago
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
pypi
open-webui
High
17 days ago
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
pypi
open-webui
Moderate
17 days ago
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
pypi
open-webui
Moderate
17 days ago
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
pypi
open-webui
Low
17 days ago
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
pypi
open-webui
High
17 days ago
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
pypi
open-webui
Moderate
17 days ago
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
pypi
open-webui
High
17 days ago
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
pypi
open-webui
Moderate
17 days ago
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
pypi
cryptography
High
17 days ago
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
pypi
cryptography
High
17 days ago
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
pypi
cryptography
Filter by Severity
Filter by Package
tensorflow
433
tensorflow-cpu
407
tensorflow-gpu
395
open-webui
147
apache-airflow
128
Django
107
mlflow
80
salt
67
apache-superset
66
ansible
65
vllm
61
picklescan
59
django
56
Plone
54
gradio
49
nova
48
pyload-ng
48
aiohttp
47
matrix-synapse
45
vyper
44
rdiffweb
43
pillow
42
plone
41
pypdf
39
praisonai
39
keystone
39
PraisonAI
37
moin
35
praisonaiagents
33
Pillow
33
langflow
32
opencv-python
31
opencv-contrib-python
31
wagtail
30
litellm
29
pgadmin4
26
GitPython
25
openbabel
24
cryptography
24
weblate
23
ethyca-fides
22
transformers
22
glance
21
langchain
21
neutron
21
praisonai-platform
21
OctoPrint
20
aim
20
mobsf
20
lollms
20
notebook
19
nltk
19
urllib3
19
vantage6
19
changedetection.io
19
mindsdb
19
mistune
19
keras
19
calibreweb
18
lemur
18
cobbler
18
tornado
18
mercurial
18
nicegui
17
nautobot
17
paddlepaddle
16
PaddlePaddle
16
h2o
16
bentoml
16
modoboa
15
wger
15
ckan
15
sentry
15
jupyterlab
14
pyftpdlib
14
fickling
14
zenml
14
trytond
13
onionshare-cli
13
swift
13
glances
13
onnx
13
OpenEXR
13
horizon
13
agentscope
13
roundup
13
copyparty
13
Glances
13
torch
12
indico
12
kiwitcms
12
yt-dlp
12
authlib
12
jupyter-server
12
pip
12
ai.h2o:h2o-core
12
label-studio
12
datamodel-code-generator
12
twisted
12
Weblate
11
motioneye
11
ray
11
langroid
11
pretix
11
sglang
10
stigmem-node
10
lief
10
waitress
10
opencv-python-headless
10
openssl-encrypt
10
bugsink
10
metagpt
10
hermes-agent
10
llama-index-core
10
Flask-AppBuilder
10
justhtml
10
homeassistant
10
crawl4ai
10
starlette
9
zope
9
python-multipart
9
pywasm3
9
ryu
9
litestar
9
langchain-core
9
opencv-contrib-python-headless
9
llama-index
9
cinder
9
bbot
8
prefect
8
dtale
8
keylime
8
python-keystoneclient
8
sqlparse
8
ironic
8
bleach
8
sagemaker
8
dulwich
8
aubio
8
ipython
8
codechecker
8
requests
8
web2py
8
docling
8
numpy
8
django-cms
8
dbgpt
8
flyto-core
8
Zope
8
trac
8
fastmcp
8
Zope2
8
executorch
7
strawberry-graphql
7
fschat
7
jupyterhub
7
lxml
7
rucio-webui
7
copier
7
inventree
7
tuf
7
pysaml2
7
ujson
7
scrapy
7
ansible-core
7
mayan-edms
7
matrix-sydent
7
monai
7
whoogle-search
6
lmdeploy
6
compliance-trestle
6
graphite-web
6
omero-web
6
langchain-chatchat
6
mailman
6
apache-airflow-providers-apache-hive
6
werkzeug
6
Moin
6
Werkzeug
6
thumbor
6
AstrBot
6
pyjwt
6
mcp
6
mage-ai
6
torchserve
6
Mezzanine
6
oauthenticator
6
pytorch-lightning
6
open-webui
6
guarddog
6
Flask-Security-Too
6
snowflake-connector-python
6
DIRAC
6
Jinja2
6
mitmproxy
6
esphome
6
ait-core
6
apache-airflow-core
5
lightrag-hku
5
tendenci
5
Filter by Repository
https://github.com/tensorflow/tensorflow
433
https://github.com/django/django
121
https://github.com/apache/airflow
105
https://github.com/ansible/ansible
59
https://github.com/python-pillow/Pillow
52
https://github.com/vyperlang/vyper
44
https://github.com/saltstack/salt
42
https://github.com/ikus060/rdiffweb
42
https://github.com/mmaitre314/picklescan
39
https://github.com/gradio-app/gradio
38
https://github.com/openstack/nova
38
https://github.com/plone/Products.CMFPlone
37
https://github.com/mlflow/mlflow
36
https://github.com/opencv/opencv
32
https://github.com/matrix-org/synapse
32
https://github.com/PaddlePaddle/Paddle
31
https://github.com/openstack/keystone
28
https://github.com/langchain-ai/langchain
25
https://github.com/vllm-project/vllm
25
https://github.com/pyload/pyload
24
https://github.com/run-llama/llama_index
24
https://github.com/ethyca/fides
20
https://github.com/huggingface/transformers
19
https://github.com/mindsdb/mindsdb
17
https://github.com/vantage6/vantage6
17
https://github.com/pyca/cryptography
16
https://github.com/aio-libs/aiohttp
15
https://github.com/cobbler/cobbler
15
https://github.com/MobSF/Mobile-Security-Framework-MobSF
15
https://github.com/janeczku/calibre-web
14
https://github.com/pgadmin-org/pgadmin4
14
https://github.com/dpgaspar/Flask-AppBuilder
14
https://github.com/apache/superset
14
https://github.com/twisted/twisted
14
https://github.com/urllib3/urllib3
14
https://github.com/h2oai/h2o-3
13
https://github.com/OctoPrint/OctoPrint
13
https://github.com/modoboa/modoboa
13
https://github.com/zenml-io/zenml
13
https://github.com/wagtail/wagtail
12
https://github.com/getsentry/sentry
12
https://github.com/openstack/glance
12
https://github.com/nautobot/nautobot
12
https://github.com/scrapy/scrapy
11
https://github.com/open-webui/open-webui
11
https://github.com/onionshare/onionshare
11
https://github.com/parisneo/lollms
11
https://github.com/Pylons/waitress
10
https://github.com/HumanSignal/label-studio
10
https://github.com/ckan/ckan
10
https://github.com/jupyter/notebook
10
https://github.com/aimhubio/aim
9
https://github.com/openstack/horizon
9
https://github.com/giampaolo/pyftpdlib
9
https://github.com/WeblateOrg/weblate
9
https://github.com/faucetsdn/ryu
9
https://github.com/BerriAI/litellm
9
https://github.com/zopefoundation/Zope
9
https://github.com/lief-project/LIEF
9
https://github.com/element-hq/synapse
9
https://github.com/pallets/werkzeug
8
https://github.com/dgtlmoon/changedetection.io
8
https://github.com/ipython/ipython
8
https://github.com/kiwitcms/Kiwi
8
https://github.com/tornadoweb/tornado
8
https://github.com/keras-team/keras
8
https://github.com/numpy/numpy
8
https://github.com/9001/copyparty
8
https://github.com/openstack/neutron
8
https://github.com/octoprint/octoprint
8
https://github.com/pytorch/executorch
7
https://github.com/Ericsson/codechecker
7
https://github.com/pypa/pip
7
https://github.com/openstack/cinder
7
https://github.com/pallets/jinja
7
https://sourceforge.net/projects/sourceforge.net
7
https://github.com/pytorch/pytorch
7
https://github.com/aubio/aubio
7
https://github.com/py-pdf/pypdf
7
https://github.com/indico/indico
7
https://github.com/jupyter-server/jupyter_server
7
https://github.com/openstack/swift
7
https://github.com/graphite-project/graphite-web
6
https://github.com/jupyterlab/jupyterlab
6
https://github.com/benbusby/whoogle-search
6
https://github.com/modelscope/agentscope
6
https://github.com/matrix-org/sydent
6
https://github.com/man-group/dtale
6
https://github.com/yt-dlp/yt-dlp
6
https://github.com/corydolphin/flask-cors
6
https://github.com/psf/requests
6
https://github.com/lxml/lxml
6
https://github.com/keylime/keylime
6
https://github.com/snowflakedb/snowflake-connector-python
6
https://github.com/roundup-tracker/roundup
6
https://github.com/TeamSeri0us/pocs
5
https://github.com/inventree/InvenTree
5
https://github.com/jupyterhub/oauthenticator
5
https://github.com/pytorch/serve
5
https://github.com/gitpython-developers/GitPython
5
https://github.com/mitmproxy/mitmproxy
5
https://github.com/ComposioHQ/composio
5
https://github.com/mozilla/bleach
5
https://github.com/ome/omero-web
5
https://github.com/home-assistant/core
5
https://github.com/esphome/esphome
5
https://github.com/Exiv2/exiv2
5
https://github.com/encode/starlette
5
https://github.com/tryton/trytond
5
https://github.com/ray-project/ray
5
https://github.com/bentoml/BentoML
5
https://github.com/hwchase17/langchain
5
https://github.com/onnx/onnx
5
https://github.com/jhpyle/docassemble
4
https://github.com/pallets/flask
4
https://github.com/rohe/pysaml2
4
https://github.com/nltk/nltk
4
https://github.com/mlc-ai/xgrammar
4
https://github.com/zopefoundation/RestrictedPython
4
https://github.com/ietf-tools/xml2rfc
4
https://github.com/bottlepy/bottle
4
https://github.com/pretix/pretix
4
https://github.com/ronf/asyncssh
4
https://github.com/FreeTAKTeam/UI
4
https://github.com/eosphoros-ai/DB-GPT
4
https://github.com/Cog-Creators/Red-DiscordBot
4
https://github.com/aws/aws-iot-device-sdk-java-v2
4
https://github.com/streamlit/streamlit
4
https://github.com/blacklanternsecurity/bbot
4
https://github.com/simonw/datasette
4
https://github.com/hyperledger/indy-node
4
https://github.com/latchset/jwcrypto
4
https://github.com/NVIDIA/NVFlare
4
https://github.com/frappe/frappe
4
https://github.com/hiyouga/LLaMA-Factory
4
https://github.com/saleor/saleor
4
https://github.com/web2py/web2py
4
https://github.com/dbt-labs/dbt-core
4
https://github.com/jupyterhub/jupyterhub
4
https://github.com/langflow-ai/langflow
4
https://github.com/berriai/litellm
4
https://github.com/wasm3/wasm3
4
https://github.com/AcademySoftwareFoundation/openexr
4
https://github.com/pypa/setuptools
4
https://github.com/Kozea/Radicale
4
https://github.com/python-ldap/python-ldap
4
https://github.com/django-helpdesk/django-helpdesk
4
https://github.com/litestar-org/litestar
4
https://github.com/AcademySoftwareFoundation/MaterialX
4
https://github.com/qutebrowser/qutebrowser
4
https://github.com/skops-dev/skops
3
https://github.com/paramiko/paramiko
3
https://github.com/jpadilla/pyjwt
3
https://github.com/chatchat-space/Langchain-Chatchat
3
https://github.com/python/cpython
3
https://github.com/gventuri/pandas-ai
3
https://github.com/certifi/python-certifi
3
https://github.com/ansible/ansible-runner
3
https://github.com/Gerapy/Gerapy
3
https://github.com/stephenmcd/mezzanine
3
https://github.com/bytecodealliance/wasmtime
3
https://github.com/Kludex/python-multipart
3
https://github.com/ankitects/anki
3
https://github.com/pyinstaller/pyinstaller
3
https://github.com/NASA-AMMOS/AIT-Core
3
https://github.com/openstack/ironic
3
https://github.com/pyca/pyopenssl
3
https://github.com/theupdateframework/python-tuf
3
https://github.com/openstack/octavia
3
https://github.com/aws/aws-sam-cli
3
https://github.com/beancount/fava
3
https://github.com/impredicative/bitlyshortener
3
https://github.com/rochacbruno/quokka
3
https://github.com/Project-MONAI/MONAI
3
https://github.com/modelscope/ms-swift
3
https://github.com/theupdateframework/tuf
3
https://github.com/khoj-ai/khoj
3
https://github.com/sosreport/sos
3
https://github.com/andialbrecht/sqlparse
3
https://github.com/benoitc/gunicorn
3
https://github.com/grpc/grpc
3
https://github.com/pypa/advisory-db
3
https://github.com/invoke-ai/InvokeAI
3
https://github.com/openstack/python-keystoneclient
3
https://github.com/eventlet/eventlet
3
https://github.com/micropython/micropython
3
https://github.com/github/securitylab
3
https://gitlab.com/mayan-edms/mayan-edms
3
https://github.com/lepture/mistune
3
https://github.com/astral-sh/uv
3
https://github.com/langchain-ai/langgraph
3
https://github.com/djblets/djblets
3
https://github.com/poezio/slixmpp
3
https://sourceforge.net/projects/roject
3
https://github.com/IdentityPython/pysaml2
3
https://github.com/mpdavis/python-jose
3
https://github.com/jupyterhub/jupyter-server-proxy
3
https://github.com/jlowin/fastmcp
3
https://github.com/furlongm/openvpn-monitor
3