pypi
Security Advisories in pypi
High
about 19 hours ago
MLflow vulnerable to arbitrary file read on unauthenticated servers via prompt model version source
pypi
mlflow
Moderate
about 19 hours ago
MLflow CrewAI autologging records LLM provider API keys in logged trace spans
pypi
mlflow
Critical
about 19 hours ago
MLflow vulnerable to remote code execution on unauthenticated servers via third-party scorer deserialization importing caller-placed artifact modules
pypi
mlflow
Moderate
about 19 hours ago
Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server
pypi
mcp
Moderate
about 19 hours ago
OpenTelemetry Python: Unbounded memory allocation in Jaeger baggage propagation
pypi
opentelemetry-propagator-jaeger
Moderate
about 19 hours ago
Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies
pypi
mcp
Moderate
about 19 hours ago
Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas
pypi
mcp
High
1 day ago
Authlib accepts an empty HMAC key, allowing JWS/JWT signature forgery (HS256/HS384/HS512)
pypi
Authlib
Moderate
1 day ago
Authlib: Unvalidated request_uri fetch in JWT-secured authorization request (JAR) leading to SSRF
pypi
authlib
Moderate
1 day ago
Authlib: ID token can disable its own nonce validation via the nonce_supported claim
pypi
authlib
Moderate
1 day ago
Authlib: Default JWT bearer grant accepts assertions for the wrong audience
pypi
authlib
Moderate
1 day ago
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
pypi
authlib
High
1 day ago
Authlib incomplete algorithm-confusion fix permits HMAC forgery with prefixed public keys
pypi
authlib
High
1 day ago
MongoDB Python Driver: Out-of-bounds read in BSON decoding via a malformed Regex element
pypi
pymongo
High
1 day ago
vLLM: Request-controlled mm_processor_kwargs.code_revision allows remote code execution
pypi
vllm
High
1 day ago
Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage
pypi
strands-agents
Moderate
1 day ago
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
pypi
strands-agents
High
1 day ago
Flexible GraphRAG: Cypher/Graph Injection via broken string-escaping in FalkorDB adapter (_escape()) - full graph wipe from ingested-document content
pypi
flexible-graphrag
High
1 day ago
LiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`
pypi
litellm
Moderate
1 day ago
GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree
pypi
GitPython
High
1 day ago
GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution
pypi
GitPython
Moderate
1 day ago
GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name
pypi
GitPython
High
1 day ago
GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines
pypi
GitPython
High
1 day ago
LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key
pypi
litellm
High
1 day ago
MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
pypi
msgpack
Moderate
1 day ago
Pylint: Arbitrary code execution via pickle deserialization of the stats cache in PYLINT_HOME
pypi
pylint
High
1 day ago
Rembg: Unauthenticated SAM model injection permits local-file disclosure through malicious ONNX graphs
pypi
rembg
Low
1 day ago
Twisted: DNS Response Spoofing in twisted.names Due to Missing Source Address Validation
pypi
Twisted
Moderate
1 day ago
fpdf2: Exponential SVG '<use>' expansion causes CPU and memory exhaustion in 'FPDF.image()'
pypi
fpdf2
Moderate
1 day ago
fpdf2 implicitly loads external URLs and local image paths when rendering attacker-controlled content
pypi
fpdf2
Critical
1 day ago
Agno: Arbitrary code execution via `eval()` on `field_type` in `FunctionCall`
pypi
agno
High
1 day ago
OAuthLib: Bearer token can be retrieved as long as client knows a valid client ID for device workflow
pypi
oauthlib
Critical
1 day ago
MONAILabel Server Crash and Silent Inference Corruption via Crafted DICOM (pydicom DS/IS Validation Bypass)
pypi
monai
Moderate
5 days ago
filelock: ReadWriteLock on the hard-link route deletes any directory another user renames onto its .filelock-* link directory name
pypi
filelock
Low
5 days ago
filelock: ReadWriteLock on Windows acts on SQLite side files another local user places beside its database
pypi
filelock
Moderate
5 days ago
virtualenv: Temporary app-data can leave dangling seed package links
pypi
virtualenv
Low
5 days ago
virtualenv: Pip seeding with download omits wheel digest verification
pypi
virtualenv
Low
5 days ago
virtualenv: Downloaded wheel selection and caching precede verification
pypi
virtualenv
High
5 days ago
virtualenv: Xonsh activation literals depend on the script decoding codec
pypi
virtualenv
High
5 days ago
virtualenv: Bash prompt values can change meaning under older compatibility modes
pypi
virtualenv
Low
5 days ago
virtualenv: Venv configuration readback can reinterpret path boundaries
pypi
virtualenv
Moderate
5 days ago
virtualenv: Seed replacement does not contain metadata deletion paths
pypi
virtualenv
Moderate
5 days ago
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
pypi
langgraph-checkpoint-sqlite, langgraph-checkpoint-postgres
Moderate
5 days ago
filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse
pypi
filelock
Critical
5 days ago
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
pypi
pillow
Moderate
5 days ago
Pillow: Arrow export leaks stale heap memory when PILLOW_ALIGNMENT > 1
pypi
Pillow
Low
5 days ago
setuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description
pypi
setuptools
Moderate
5 days ago
FastMCP: Post-transform component authorization is skipped on direct calls
pypi
fastmcp-slim, fastmcp
Moderate
5 days ago
FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server
pypi
fastmcp-slim, fastmcp
High
5 days ago
pypdf: Possible long runtimes for repeated references to the same missing object
pypi
pypdf
High
5 days ago
pypdf: Possible long runtimes for repeated malformed cross-reference entries (Follow-up)
pypi
pypdf
High
5 days ago
Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
npm, pypi
@strands-agents/sdk, strands-agents
Moderate
5 days ago
Twisted: Denial of Service in the Twisted IMAP4 Server via a Negative Literal Size in SEARCH
pypi
Twisted
High
5 days ago
Twisted: Unauthenticated Remote Denial of Service in the Twisted IRC Server via an Unbounded Line Buffer
pypi
Twisted
Moderate
5 days ago
Twisted: HTTP Request Smuggling in twisted.web via a Bare CR or LF in a Header Value
pypi
Twisted
Moderate
6 days ago
virtualenv: Generated files can follow existing destination links
pypi
virtualenv
Moderate
6 days ago
pypdf: Possible long runtimes/large memory usage when retrieving form fields
pypi
pypdf
Moderate
6 days ago
pypdf: Possible large memory usage when parsing arrays and dictionaries
pypi
pypdf
High
6 days ago
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
pypi
Gitpython
High
6 days ago
GraphQL-core: Denial of service via comment tokens bypassing the parser's max_tokens limit
pypi
graphql-core
High
6 days ago
GraphQL-core: Denial of service via quadratic complexity in the OverlappingFieldsCanBeMerged validation rule
pypi
graphql-core
Moderate
6 days ago
OpenTelemetry Python: Unbounded tracestate parsing in opentelemetry-api
pypi
opentelemetry-api
High
6 days ago
Black: GitHub Action installs unvalidated required-version from pyproject.toml
pypi
black
High
6 days ago
Django REST framework: TokenProxy.delete() reports success and revokes nothing
pypi
djangorestframework
High
6 days ago
Django REST framework: Accept header with many large quoted parameters burns ~19s of CPU per request in content negotiation
pypi
djangorestframework
High
6 days ago
Django REST framework: JSONParser applies an attacker-named codec to the request stream
pypi
djangorestframework
High
6 days ago
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
pypi
Pillow
High
6 days ago
Pillow: Heap over-read in WMF/EMF rendering via 16-bit dimension truncation (Windows builds)
pypi
Pillow
High
6 days ago
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
pypi
Pillow
Critical
6 days ago
Pillow multi-frame loaders can reuse stale native image storage after mode transitions
pypi
Pillow
Filter by Severity
Filter by Package
tensorflow
430
tensorflow-gpu
427
tensorflow-cpu
423
open-webui
160
apache-airflow
146
Django
127
mlflow
87
vllm
81
Plone
72
salt
67
apache-superset
66
ansible
65
Pillow
62
pypdf
62
picklescan
59
pyload-ng
57
aiohttp
55
pillow
53
PraisonAI
52
praisonai
52
nltk
52
praisonaiagents
50
gradio
50
nova
49
vyper
47
matrix-synapse
45
django
44
litellm
44
langflow
43
rdiffweb
43
GitPython
39
keystone
39
moin
35
opencv-contrib-python
31
opencv-python
31
mcp-atlassian
30
wagtail
30
plone
28
pgadmin4
26
praisonai-platform
24
tornado
24
openbabel
24
cryptography
24
weblate
24
transformers
24
virtualenv
24
urllib3
22
glance
22
ethyca-fides
22
notebook
21
mistune
21
neutron
21
langchain
21
OctoPrint
20
mobsf
20
aim
20
wger
20
lollms
20
keras
20
nautobot
19
authlib
19
changedetection.io
19
mindsdb
19
vantage6
19
lemur
18
jupyterlab
18
cobbler
18
calibreweb
18
mercurial
18
nicegui
17
docling
17
indico
16
djust
16
bentoml
16
h2o
16
PaddlePaddle
16
paddlepaddle
16
modoboa
15
sentry
15
ckan
15
copyparty
14
pyftpdlib
14
fickling
14
pydantic-ai-slim
14
zenml
14
pydantic-ai
14
trytond
14
swift
14
onionshare-cli
13
jupyter-server
13
roundup
13
dulwich
13
Glances
13
onnx
13
agentscope
13
OpenEXR
13
PyJWT
13
glances
13
pip
13
horizon
13
datamodel-code-generator
13
kiwitcms
12
label-studio
12
pyspark
12
homeassistant
12
Weblate
12
torch
12
ai.h2o:h2o-core
12
yt-dlp
12
twisted
12
motioneye
11
crawl4ai
11
ray
11
langroid
11
Twisted
11
pretix
11
justhtml
10
waitress
10
opencv-python-headless
10
hermes-agent
10
openssl-encrypt
10
pyjwt
10
sglang
10
bugsink
10
Flask-AppBuilder
10
lightrag-hku
10
lief
10
fastmcp
10
django-cms
10
metagpt
10
opencv-contrib-python-headless
10
mcp
10
lmdeploy
10
llama-index-core
10
zope
10
stigmem-node
10
llama-index
9
langchain-core
9
python-keystoneclient
9
sqlparse
9
strawberry-graphql
9
bbot
9
litestar
9
cinder
9
ryu
9
pywasm3
9
python-multipart
9
ironic
9
starlette
9
compliance-trestle
9
bleach
8
snowflake-connector-python
8
monai
8
filelock
8
aubio
8
Zope2
8
dbgpt
8
numpy
8
web2py
8
Zope
8
keylime
8
trac
8
ipython
8
scrapy
8
sagemaker
8
requests
8
docling-slim
8
jupyterhub
8
dtale
8
prefect
8
flyto-core
8
langflow-base
8
Werkzeug
8
codechecker
8
uv
7
pymongo
7
executorch
7
lxml
7
asyncssh
7
ujson
7
fschat
7
ansible-core
7
matrix-sydent
7
tuf
7
pysaml2
7
omero-web
7
djangorestframework
7
inventree
7
apache-iotdb
7
mayan-edms
7
copier
7
rucio-webui
7
Scrapy
6
graphite-web
6
org.pytorch:executorch-android
6
setuptools
6
RestrictedPython
6
langchain-chatchat
6
whoogle-search
6
Moin
6
Filter by Repository
https://github.com/tensorflow/tensorflow
433
https://github.com/django/django
121
https://github.com/apache/airflow
105
https://github.com/ansible/ansible
59
https://github.com/python-pillow/Pillow
52
https://github.com/vyperlang/vyper
44
https://github.com/saltstack/salt
42
https://github.com/ikus060/rdiffweb
42
https://github.com/mmaitre314/picklescan
39
https://github.com/gradio-app/gradio
38
https://github.com/openstack/nova
38
https://github.com/plone/Products.CMFPlone
37
https://github.com/mlflow/mlflow
36
https://github.com/matrix-org/synapse
32
https://github.com/opencv/opencv
32
https://github.com/PaddlePaddle/Paddle
31
https://github.com/openstack/keystone
28
https://github.com/vllm-project/vllm
25
https://github.com/langchain-ai/langchain
25
https://github.com/pyload/pyload
24
https://github.com/run-llama/llama_index
24
https://github.com/ethyca/fides
20
https://github.com/huggingface/transformers
19
https://github.com/vantage6/vantage6
17
https://github.com/mindsdb/mindsdb
17
https://github.com/pyca/cryptography
16
https://github.com/MobSF/Mobile-Security-Framework-MobSF
15
https://github.com/cobbler/cobbler
15
https://github.com/aio-libs/aiohttp
15
https://github.com/pgadmin-org/pgadmin4
14
https://github.com/janeczku/calibre-web
14
https://github.com/twisted/twisted
14
https://github.com/urllib3/urllib3
14
https://github.com/dpgaspar/Flask-AppBuilder
14
https://github.com/apache/superset
14
https://github.com/zenml-io/zenml
13
https://github.com/modoboa/modoboa
13
https://github.com/OctoPrint/OctoPrint
13
https://github.com/h2oai/h2o-3
13
https://github.com/openstack/glance
12
https://github.com/getsentry/sentry
12
https://github.com/wagtail/wagtail
12
https://github.com/nautobot/nautobot
12
https://github.com/parisneo/lollms
11
https://github.com/onionshare/onionshare
11
https://github.com/scrapy/scrapy
11
https://github.com/HumanSignal/label-studio
10
https://github.com/open-webui/open-webui
10
https://github.com/ckan/ckan
10
https://github.com/Pylons/waitress
10
https://github.com/jupyter/notebook
10
https://github.com/giampaolo/pyftpdlib
9
https://github.com/element-hq/synapse
9
https://github.com/lief-project/LIEF
9
https://github.com/BerriAI/litellm
9
https://github.com/openstack/horizon
9
https://github.com/aimhubio/aim
9
https://github.com/WeblateOrg/weblate
9
https://github.com/zopefoundation/Zope
9
https://github.com/faucetsdn/ryu
9
https://github.com/pallets/werkzeug
8
https://github.com/openstack/neutron
8
https://github.com/tornadoweb/tornado
8
https://github.com/dgtlmoon/changedetection.io
8
https://github.com/ipython/ipython
8
https://github.com/keras-team/keras
8
https://github.com/kiwitcms/Kiwi
8
https://github.com/octoprint/octoprint
8
https://github.com/9001/copyparty
8
https://github.com/numpy/numpy
8
https://github.com/pallets/jinja
7
https://github.com/pytorch/executorch
7
https://github.com/Ericsson/codechecker
7
https://github.com/py-pdf/pypdf
7
https://github.com/pytorch/pytorch
7
https://github.com/openstack/swift
7
https://github.com/openstack/cinder
7
https://sourceforge.net/projects/sourceforge.net
7
https://github.com/indico/indico
7
https://github.com/pypa/pip
7
https://github.com/aubio/aubio
7
https://github.com/jupyter-server/jupyter_server
7
https://github.com/matrix-org/sydent
6
https://github.com/lxml/lxml
6
https://github.com/man-group/dtale
6
https://github.com/graphite-project/graphite-web
6
https://github.com/modelscope/agentscope
6
https://github.com/jupyterlab/jupyterlab
6
https://github.com/yt-dlp/yt-dlp
6
https://github.com/psf/requests
6
https://github.com/corydolphin/flask-cors
6
https://github.com/benbusby/whoogle-search
6
https://github.com/roundup-tracker/roundup
6
https://github.com/snowflakedb/snowflake-connector-python
6
https://github.com/keylime/keylime
6
https://github.com/Exiv2/exiv2
5
https://github.com/pytorch/serve
5
https://github.com/onnx/onnx
5
https://github.com/encode/starlette
5
https://github.com/jupyterhub/oauthenticator
5
https://github.com/bentoml/BentoML
5
https://github.com/home-assistant/core
5
https://github.com/tryton/trytond
5
https://github.com/ome/omero-web
5
https://github.com/inventree/InvenTree
5
https://github.com/gitpython-developers/GitPython
5
https://github.com/TeamSeri0us/pocs
5
https://github.com/mozilla/bleach
5
https://github.com/ComposioHQ/composio
5
https://github.com/esphome/esphome
5
https://github.com/ray-project/ray
5
https://github.com/mitmproxy/mitmproxy
5
https://github.com/hwchase17/langchain
5
https://github.com/latchset/jwcrypto
4
https://github.com/jupyterhub/jupyterhub
4
https://github.com/web2py/web2py
4
https://github.com/bottlepy/bottle
4
https://github.com/ietf-tools/xml2rfc
4
https://github.com/dbt-labs/dbt-core
4
https://github.com/zopefoundation/RestrictedPython
4
https://github.com/django-helpdesk/django-helpdesk
4
https://github.com/python-ldap/python-ldap
4
https://github.com/rohe/pysaml2
4
https://github.com/wasm3/wasm3
4
https://github.com/blacklanternsecurity/bbot
4
https://github.com/nltk/nltk
4
https://github.com/pretix/pretix
4
https://github.com/litestar-org/litestar
4
https://github.com/AcademySoftwareFoundation/MaterialX
4
https://github.com/langflow-ai/langflow
4
https://github.com/pypa/setuptools
4
https://github.com/bytecodealliance/wasmtime
4
https://github.com/AcademySoftwareFoundation/openexr
4
https://github.com/Kozea/Radicale
4
https://github.com/pallets/flask
4
https://github.com/frappe/frappe
4
https://github.com/hiyouga/LLaMA-Factory
4
https://github.com/NVIDIA/NVFlare
4
https://github.com/ronf/asyncssh
4
https://github.com/simonw/datasette
4
https://github.com/mlc-ai/xgrammar
4
https://github.com/grpc/grpc
4
https://github.com/FreeTAKTeam/UI
4
https://github.com/streamlit/streamlit
4
https://github.com/qutebrowser/qutebrowser
4
https://github.com/jhpyle/docassemble
4
https://github.com/saleor/saleor
4
https://github.com/berriai/litellm
4
https://github.com/hyperledger/indy-node
4
https://github.com/eosphoros-ai/DB-GPT
4
https://github.com/aws/aws-iot-device-sdk-java-v2
4
https://github.com/Cog-Creators/Red-DiscordBot
4
https://github.com/apache/iotdb
3
https://github.com/OpenC3/cosmos
3
https://github.com/andialbrecht/sqlparse
3
https://github.com/benoitc/gunicorn
3
https://github.com/jlowin/fastmcp
3
https://github.com/python/cpython
3
https://github.com/tinymce/tinymce
3
https://github.com/chatchat-space/Langchain-Chatchat
3
https://github.com/paramiko/paramiko
3
https://github.com/theupdateframework/python-tuf
3
https://github.com/Flask-Middleware/flask-security
3
https://github.com/micropython/micropython
3
https://github.com/zauberzeug/nicegui
3
https://github.com/aws/sagemaker-python-sdk
3
https://github.com/skops-dev/skops
3
https://github.com/Gerapy/Gerapy
3
https://github.com/stephenmcd/mezzanine
3
https://github.com/apache/submarine
3
https://github.com/openstack/octavia
3
https://github.com/NASA-AMMOS/AIT-Core
3
https://github.com/rochacbruno/quokka
3
https://github.com/pyca/pyopenssl
3
https://github.com/aws/aws-sam-cli
3
https://github.com/beancount/fava
3
https://github.com/langchain-ai/langgraph
3
https://github.com/geyang/ml-logger
3
https://github.com/openstack/ironic
3
https://github.com/Project-MONAI/MONAI
3
https://github.com/ankitects/anki
3
https://github.com/modelscope/ms-swift
3
https://github.com/GeoNode/geonode
3
https://github.com/khoj-ai/khoj
3
https://github.com/theupdateframework/tuf
3
https://github.com/sosreport/sos
3
https://github.com/ansible/ansible-runner
3
https://sourceforge.net/projects/roject
3
https://github.com/furlongm/openvpn-monitor
3
https://github.com/impredicative/bitlyshortener
3
https://github.com/langroid/langroid
3
https://github.com/Kludex/python-multipart
3
https://github.com/authlib/authlib
3
https://github.com/dlitz/pycrypto
3
https://github.com/trentm/python-markdown2
3
https://github.com/eventlet/eventlet
3
https://gitlab.com/mayan-edms/mayan-edms
3
https://github.com/djblets/djblets
3
https://github.com/zopefoundation/AccessControl
3