pypi
Security Advisories in pypi
Moderate
about 18 hours ago
WebOb: Open redirect in Location header normalization via leading C0 control / space characters
pypi
webob
Critical
2 days ago
senaite.core Vulnerable to Eval Injection and Missing Authorization
pypi
senaite.core
Critical
2 days ago
Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)
pypi
pantheon-agents
Moderate
2 days ago
Starlette-Admin's unvalidated `order_by` parameter allows ordering by hidden columns (info-exposure oracle) and HTTP 500 DoS
pypi
starlette-admin
Moderate
3 days ago
JupyterHub has Unauthenticated Denial of Service via Unbounded Username Logging on Failed Login
pypi
jupyterhub
High
3 days ago
Chainlist has SSRF via MCP SSE and streamable-http transports that allows unauthenticated internal network access
pypi
chainlit
Critical
3 days ago
Chainlit has command injection via MCP stdio transport that allows unauthenticated remote code execution
pypi
chainlit
High
3 days ago
eml_parser vulnerable to DoS via deeply nested parens in Received headers
pypi
eml_parser
Moderate
3 days ago
eml_parser has parser DoS via deeply nested parentheses in e-mail headers
pypi
eml_parser
Moderate
3 days ago
eml_parser has a URL extraction bypass via HTML entities in URLs
pypi
eml_parser
High
3 days ago
mcp-contextforge-gateway has Server-Side Template Injection (SSTI) leading to Remote Code Execution in `PromptService._render_template` via unsandboxed Jinja2 Environment
pypi
mcp-contextforge-gateway
Moderate
3 days ago
reachy_mini Allows Unrestricted Upload of File with Dangerous Type
pypi
reachy-mini
High
3 days ago
qwed Vulnerable to Authenticated Remote Code Execution via Unsafe SymPy `parse_expr()`
pypi
qwed
Critical
3 days ago
nextcloud-mcp-server: Unauthenticated `POST /webhooks/nextcloud` allows arbitrary vector data deletion when `WEBHOOK_SECRET` is unset ( default )
pypi
nextcloud-mcp-server
High
3 days ago
utcp-http has an OAuth2 `tokenUrl` Trust Boundary Bypass in OpenAPI Conversion
pypi
utcp-http
Moderate
3 days ago
utcp-gql SSRF: CVE-2026-44661 fix not applied to the GraphQL and WebSocket plugins
pypi
utcp-websocket, utcp-gql
High
3 days ago
utcp-http SSRF: HTTP tool invocation follows redirects without re-validating the target
pypi
utcp-http
Critical
3 days ago
qwed-mcp has Unsafe SymPy `parse_expr()` Remote Code Execution via Unsanitized Math Expression Input
pypi
qwed-mcp
High
3 days ago
praisonaiagents vulnerable to arbitrary file write via unsanitized `user_id` in `FileMemory.__init__()` — path traversal to any writable location
pypi
praisonaiagents
High
3 days ago
PraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced
pypi
PraisonAI
Moderate
3 days ago
PraisonAI vulnerable to Server-Side Request Forgery via DNS rebinding bypass in webhook_url validation
pypi
PraisonAI
High
3 days ago
PraisonAI: Webhook SSRF via DNS fail-open in `JobSubmitRequest.validate_webhook_url()` — bypass of CVE-2026-40114
pypi
PraisonAI
High
3 days ago
PraisonAI: [Path Traversal] agent tools escape the configured workspace via symlinks
pypi
PraisonAI
Moderate
3 days ago
praisonaiagents: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool
pypi
praisonaiagents
High
3 days ago
praisonaiagents vulnerable to SSRF in web_crawl tool via redirect-following and DNS rebinding (validate-then-fetch gap)
pypi
praisonaiagents
High
3 days ago
PraisonAI serve agents --api-key is ignored, allowing unauthenticated remote agent execution
pypi
PraisonAI
High
3 days ago
praisonaiagents has an SSRF protection bypass in `spider_tools._host_is_blocked()` via DNS-resolved hostnames (`127.0.0.1.nip.io`)
pypi
praisonaiagents
Moderate
3 days ago
PraisonAI MCP HTTP server has unauthenticated unbounded session accumulation (memory exhaustion; session TTL never enforced)
pypi
PraisonAI
High
3 days ago
praisonaiagents: AgentServer declares auth_token but never enforces it on any route
pypi
praisonaiagents
High
3 days ago
praisonaiagents has a `web_crawl` SSRF protection bypass via unchecked redirect targets
pypi
praisonaiagents
High
3 days ago
PraisonAI workflow include bypasses tools.py autoload opt-in and executes included recipe code
pypi
PraisonAI, praisonaiagents
High
3 days ago
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
pypi
praisonaiagents
Moderate
4 days ago
django CMS: Page cache ignores plugin-declared Vary headers (disclosure & poisoning)
pypi
django-cms
High
7 days ago
Hydra: hydra.utils.instantiate with untrusted config can lead to code execution
pypi
hydra-core
Critical
7 days ago
Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing
pypi
xinference
Moderate
8 days ago
Wagtail: Improper restriction handling on Page translation API endpoint
pypi
wagtail
Moderate
8 days ago
Wagtail: Improper restriction handling on descendant collections in Documents and Images API
pypi
wagtail
Moderate
8 days ago
django CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff
pypi
django-cms
Moderate
8 days ago
django CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)
pypi
django-cms
Moderate
8 days ago
django CMS: Clipboard copy IDOR discloses unauthorized plugin content
pypi
django-cms
Moderate
8 days ago
Wagtail: Pages translations can be created without page permissions when using simple_translation
pypi
wagtail
Moderate
8 days ago
Wagtail: Denial of service via unbounded filter specs in the image preview
pypi
wagtail
Moderate
8 days ago
Wagtail: Improper restriction handling on Documents and Images chosen endpoints
pypi
wagtail
Moderate
8 days ago
Zoo Design Studio: Memory-corruption in memory handling of lib-kcl
cargo, pypi
kcl-lib, zoo-kcl
Moderate
8 days ago
Zoo Design Studio: Recursive KCL parsing is vulnerable to denial-of-service
cargo, pypi
kcl-lib, zoo-kcl
Moderate
8 days ago
stigmem-node has blind SSRF via unvalidated webhook subscription delivery_address
pypi
stigmem-node
High
8 days ago
LangChain MongoDB has NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure
pypi
langgraph-store-mongodb, langgraph-checkpoint-mongodb
Moderate
8 days ago
asteval Sandbox Escape: arbitrary native memory read/write via numpy ctypes in default asteval Interpreter
pypi
asteval
High
9 days ago
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
pypi
document-merge-service
High
9 days ago
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
pypi
copier
Moderate
9 days ago
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
pypi
langgraph-api
Moderate
9 days ago
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
pypi
langgraph-api
Moderate
10 days ago
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
pypi
linuxfabrik-lib
High
10 days ago
Lemur: Any user can revoke arbitrary certificates at the CA by uploading a duplicate record and revoking it
pypi
lemur
Moderate
10 days ago
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
pypi
lemur
Moderate
10 days ago
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
pypi
lemur
High
10 days ago
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
pypi
lemur
High
10 days ago
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
pypi
monai
Critical
10 days ago
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
pypi
resdata
Moderate
10 days ago
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
pypi
mobsf
Moderate
10 days ago
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
pypi
mobsf
High
10 days ago
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
pypi, npm
geolens, geolens-cli, @geolens/sdk
High
11 days ago
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
pypi
atomic-agents-stack
High
11 days ago
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
pypi
atomic-agents-stack
High
11 days ago
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
pypi
sqlparse
Filter by Severity
Filter by Package
tensorflow
433
tensorflow-cpu
411
tensorflow-gpu
395
open-webui
147
apache-airflow
128
Django
107
mlflow
80
salt
67
apache-superset
66
ansible
65
vllm
61
picklescan
59
django
56
Plone
54
PraisonAI
50
gradio
49
nova
49
pyload-ng
48
aiohttp
47
matrix-synapse
45
vyper
44
rdiffweb
43
pillow
42
praisonaiagents
41
plone
41
keystone
39
praisonai
39
pypdf
39
moin
35
Pillow
33
langflow
32
opencv-python
31
wagtail
30
opencv-contrib-python
30
litellm
29
pgadmin4
26
GitPython
25
openbabel
24
cryptography
24
weblate
23
transformers
22
ethyca-fides
22
glance
22
praisonai-platform
21
langchain
21
neutron
21
aim
20
OctoPrint
20
lollms
20
mobsf
20
changedetection.io
19
vantage6
19
mindsdb
19
keras
19
nltk
19
notebook
19
mistune
19
urllib3
19
tornado
18
lemur
18
mercurial
18
cobbler
18
calibreweb
18
nautobot
17
nicegui
17
h2o
16
paddlepaddle
16
PaddlePaddle
16
bentoml
16
wger
15
ckan
15
sentry
15
modoboa
15
zenml
14
jupyterlab
14
pyftpdlib
14
fickling
14
onionshare-cli
13
Glances
13
glances
13
trytond
13
horizon
13
OpenEXR
13
onnx
13
roundup
13
swift
13
copyparty
13
agentscope
13
ai.h2o:h2o-core
12
datamodel-code-generator
12
torch
12
pip
12
label-studio
12
jupyter-server
12
twisted
12
kiwitcms
12
yt-dlp
12
authlib
12
indico
12
langroid
11
pretix
11
motioneye
11
Weblate
11
ray
11
waitress
10
opencv-python-headless
10
lief
10
bugsink
10
hermes-agent
10
justhtml
10
metagpt
10
homeassistant
10
llama-index-core
10
stigmem-node
10
sglang
10
Flask-AppBuilder
10
openssl-encrypt
10
django-cms
10
crawl4ai
10
cinder
9
zope
9
llama-index
9
starlette
9
opencv-contrib-python-headless
9
ryu
9
langchain-core
9
pywasm3
9
litestar
9
python-multipart
9
ironic
9
jupyterhub
8
docling
8
prefect
8
trac
8
Zope2
8
sagemaker
8
aubio
8
sqlparse
8
python-keystoneclient
8
keylime
8
dbgpt
8
flyto-core
8
fastmcp
8
bleach
8
dtale
8
web2py
8
requests
8
Zope
8
numpy
8
codechecker
8
dulwich
8
ipython
8
bbot
8
inventree
7
executorch
7
scrapy
7
pysaml2
7
lxml
7
strawberry-graphql
7
mayan-edms
7
copier
7
tuf
7
ujson
7
matrix-sydent
7
monai
7
ansible-core
7
rucio-webui
7
fschat
7
omero-web
6
oauthenticator
6
AstrBot
6
ait-core
6
mitmproxy
6
graphite-web
6
snowflake-connector-python
6
mcp
6
torchserve
6
Werkzeug
6
werkzeug
6
compliance-trestle
6
mage-ai
6
pyjwt
6
lmdeploy
6
apache-airflow-providers-apache-hive
6
Jinja2
6
langchain-chatchat
6
asyncssh
6
mailman
6
pytorch-lightning
6
thumbor
6
guarddog
6
DIRAC
6
Mezzanine
6
Flask-Security-Too
6
Moin
6
open-webui
6
whoogle-search
6
esphome
6
Nova
5
saleor
5
Filter by Repository
https://github.com/tensorflow/tensorflow
433
https://github.com/django/django
121
https://github.com/apache/airflow
105
https://github.com/ansible/ansible
59
https://github.com/python-pillow/Pillow
52
https://github.com/vyperlang/vyper
44
https://github.com/saltstack/salt
42
https://github.com/ikus060/rdiffweb
42
https://github.com/mmaitre314/picklescan
39
https://github.com/openstack/nova
38
https://github.com/gradio-app/gradio
38
https://github.com/plone/Products.CMFPlone
37
https://github.com/mlflow/mlflow
36
https://github.com/matrix-org/synapse
32
https://github.com/opencv/opencv
32
https://github.com/PaddlePaddle/Paddle
31
https://github.com/openstack/keystone
28
https://github.com/vllm-project/vllm
25
https://github.com/langchain-ai/langchain
25
https://github.com/run-llama/llama_index
24
https://github.com/pyload/pyload
24
https://github.com/ethyca/fides
20
https://github.com/huggingface/transformers
19
https://github.com/vantage6/vantage6
17
https://github.com/mindsdb/mindsdb
17
https://github.com/pyca/cryptography
16
https://github.com/MobSF/Mobile-Security-Framework-MobSF
15
https://github.com/cobbler/cobbler
15
https://github.com/aio-libs/aiohttp
15
https://github.com/twisted/twisted
14
https://github.com/dpgaspar/Flask-AppBuilder
14
https://github.com/urllib3/urllib3
14
https://github.com/apache/superset
14
https://github.com/janeczku/calibre-web
14
https://github.com/pgadmin-org/pgadmin4
14
https://github.com/OctoPrint/OctoPrint
13
https://github.com/h2oai/h2o-3
13
https://github.com/zenml-io/zenml
13
https://github.com/modoboa/modoboa
13
https://github.com/wagtail/wagtail
12
https://github.com/openstack/glance
12
https://github.com/getsentry/sentry
12
https://github.com/nautobot/nautobot
12
https://github.com/onionshare/onionshare
11
https://github.com/open-webui/open-webui
11
https://github.com/parisneo/lollms
11
https://github.com/scrapy/scrapy
11
https://github.com/jupyter/notebook
10
https://github.com/HumanSignal/label-studio
10
https://github.com/Pylons/waitress
10
https://github.com/ckan/ckan
10
https://github.com/openstack/horizon
9
https://github.com/aimhubio/aim
9
https://github.com/lief-project/LIEF
9
https://github.com/WeblateOrg/weblate
9
https://github.com/faucetsdn/ryu
9
https://github.com/element-hq/synapse
9
https://github.com/zopefoundation/Zope
9
https://github.com/giampaolo/pyftpdlib
9
https://github.com/BerriAI/litellm
9
https://github.com/openstack/neutron
8
https://github.com/kiwitcms/Kiwi
8
https://github.com/octoprint/octoprint
8
https://github.com/pallets/werkzeug
8
https://github.com/keras-team/keras
8
https://github.com/ipython/ipython
8
https://github.com/tornadoweb/tornado
8
https://github.com/dgtlmoon/changedetection.io
8
https://github.com/9001/copyparty
8
https://github.com/numpy/numpy
8
https://github.com/pytorch/executorch
7
https://github.com/py-pdf/pypdf
7
https://github.com/indico/indico
7
https://github.com/jupyter-server/jupyter_server
7
https://github.com/Ericsson/codechecker
7
https://github.com/aubio/aubio
7
https://github.com/openstack/cinder
7
https://github.com/openstack/swift
7
https://github.com/pallets/jinja
7
https://sourceforge.net/projects/sourceforge.net
7
https://github.com/pytorch/pytorch
7
https://github.com/pypa/pip
7
https://github.com/matrix-org/sydent
6
https://github.com/psf/requests
6
https://github.com/modelscope/agentscope
6
https://github.com/keylime/keylime
6
https://github.com/lxml/lxml
6
https://github.com/roundup-tracker/roundup
6
https://github.com/man-group/dtale
6
https://github.com/jupyterlab/jupyterlab
6
https://github.com/yt-dlp/yt-dlp
6
https://github.com/graphite-project/graphite-web
6
https://github.com/benbusby/whoogle-search
6
https://github.com/snowflakedb/snowflake-connector-python
6
https://github.com/corydolphin/flask-cors
6
https://github.com/tryton/trytond
5
https://github.com/esphome/esphome
5
https://github.com/encode/starlette
5
https://github.com/onnx/onnx
5
https://github.com/mitmproxy/mitmproxy
5
https://github.com/TeamSeri0us/pocs
5
https://github.com/bentoml/BentoML
5
https://github.com/pytorch/serve
5
https://github.com/ComposioHQ/composio
5
https://github.com/gitpython-developers/GitPython
5
https://github.com/Exiv2/exiv2
5
https://github.com/jupyterhub/oauthenticator
5
https://github.com/ray-project/ray
5
https://github.com/mozilla/bleach
5
https://github.com/home-assistant/core
5
https://github.com/ome/omero-web
5
https://github.com/inventree/InvenTree
5
https://github.com/hwchase17/langchain
5
https://github.com/NVIDIA/NVFlare
4
https://github.com/FreeTAKTeam/UI
4
https://github.com/zopefoundation/RestrictedPython
4
https://github.com/eosphoros-ai/DB-GPT
4
https://github.com/jhpyle/docassemble
4
https://github.com/blacklanternsecurity/bbot
4
https://github.com/hiyouga/LLaMA-Factory
4
https://github.com/grpc/grpc
4
https://github.com/berriai/litellm
4
https://github.com/django-helpdesk/django-helpdesk
4
https://github.com/ietf-tools/xml2rfc
4
https://github.com/Kozea/Radicale
4
https://github.com/dbt-labs/dbt-core
4
https://github.com/web2py/web2py
4
https://github.com/frappe/frappe
4
https://github.com/bottlepy/bottle
4
https://github.com/latchset/jwcrypto
4
https://github.com/hyperledger/indy-node
4
https://github.com/Cog-Creators/Red-DiscordBot
4
https://github.com/AcademySoftwareFoundation/openexr
4
https://github.com/aws/aws-iot-device-sdk-java-v2
4
https://github.com/qutebrowser/qutebrowser
4
https://github.com/saleor/saleor
4
https://github.com/langflow-ai/langflow
4
https://github.com/AcademySoftwareFoundation/MaterialX
4
https://github.com/pretix/pretix
4
https://github.com/litestar-org/litestar
4
https://github.com/wasm3/wasm3
4
https://github.com/mlc-ai/xgrammar
4
https://github.com/rohe/pysaml2
4
https://github.com/simonw/datasette
4
https://github.com/pallets/flask
4
https://github.com/jupyterhub/jupyterhub
4
https://github.com/ronf/asyncssh
4
https://github.com/streamlit/streamlit
4
https://github.com/nltk/nltk
4
https://github.com/python-ldap/python-ldap
4
https://github.com/pypa/setuptools
4
https://github.com/impredicative/bitlyshortener
3
https://github.com/pyinstaller/pyinstaller
3
https://github.com/zauberzeug/nicegui
3
https://github.com/IdentityPython/pysaml2
3
https://github.com/Flask-Middleware/flask-security
3
https://github.com/theupdateframework/tuf
3
https://github.com/adamghill/django-unicorn
3
https://github.com/NASA-AMMOS/AIT-Core
3
https://github.com/sqlalchemy/sqlalchemy
3
https://github.com/certifi/python-certifi
3
https://github.com/micropython/micropython
3
https://github.com/pygments/pygments
3
https://github.com/bytecodealliance/wasmtime
3
https://github.com/moinwiki/moin-1.9
3
https://github.com/stephenmcd/mezzanine
3
https://github.com/skops-dev/skops
3
https://github.com/aws/sagemaker-python-sdk
3
https://github.com/Gerapy/Gerapy
3
https://github.com/paramiko/paramiko
3
https://github.com/aws/aws-sam-cli
3
https://github.com/dlitz/pycrypto
3
https://github.com/pyca/pyopenssl
3
https://github.com/openstack/octavia
3
https://github.com/rochacbruno/quokka
3
https://github.com/poezio/slixmpp
3
https://github.com/openstack/ironic
3
https://github.com/chatchat-space/Langchain-Chatchat
3
https://github.com/modelscope/ms-swift
3
https://github.com/astral-sh/uv
3
https://github.com/beancount/fava
3
https://github.com/ankitects/anki
3
https://github.com/sosreport/sos
3
https://github.com/geyang/ml-logger
3
https://github.com/langroid/langroid
3
https://github.com/benoitc/gunicorn
3
https://github.com/andialbrecht/sqlparse
3
https://github.com/eventlet/eventlet
3
https://github.com/lepture/mistune
3
https://github.com/python/cpython
3
https://github.com/khoj-ai/khoj
3
https://github.com/Project-MONAI/MONAI
3
https://github.com/ansible/ansible-runner
3
https://github.com/gventuri/pandas-ai
3
https://github.com/invoke-ai/InvokeAI
3
https://github.com/trentm/python-markdown2
3
https://gitlab.com/mayan-edms/mayan-edms
3
https://github.com/httplib2/httplib2
3
https://github.com/authlib/authlib
3