pypi
Security Advisories in pypi
High
about 4 hours ago
GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)
pypi
geolens
High
about 4 hours ago
Document Merge Service vulnerable to RCE via SSTI (xlsx tempaltes)
pypi
document-merge-service
High
about 4 hours ago
Copier has a trust-prefix bypass via path traversal that runs tasks unprompted
pypi
copier
Moderate
about 5 hours ago
langgraph-api: Incomplete assistant authorization in LangGraph Server run creation
pypi
langgraph-api
Moderate
about 5 hours ago
langgraph-api: Relative webhook targets in LangGraph Server can reach in-process routes without authentication
pypi
langgraph-api
Moderate
1 day ago
linuxfabrik-lib: Arbitrary root file read via live --test argument (lib.lftest) across sudoers-whitelisted plugins (LPE)
pypi
linuxfabrik-lib
Moderate
1 day ago
Lemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False
pypi
lemur
Moderate
1 day ago
Lemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority
pypi
lemur
High
1 day ago
Lemur: Server-Side Request Forgery via the ACME client following server-controlled URLs
pypi
lemur
High
1 day ago
MONAI: Unsafe deserialization in NumpyReader allows arbitrary code execution via malicious .npy files
pypi
monai
Critical
1 day ago
resdata has Classic Buffer Overflow, Improper Validation of Array Index, NULL Pointer Dereference and Out-of-bounds Read
pypi
resdata
Moderate
1 day ago
MobSF Vulnerable to Arbitrary File Read via Path Traversal in ZIP Uploads
pypi
mobsf
Moderate
1 day ago
MobSF Vulnerable to Zip Bomb Denial of Service via Per-File Size Limit Bypass in ZIP/APK Extraction
pypi
mobsf
High
1 day ago
GeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data
pypi, npm
geolens, geolens-cli, @geolens/sdk
High
2 days ago
atomic-agents-stack: Parallel helper/delegate batch reserves $0 for models absent from the pricing table, bypassing the cost-cap fan-out guard
pypi
atomic-agents-stack
High
2 days ago
atomic-agents-stack: HTTP MCP catalog accepts cleartext http and spawns catalog-supplied commands (MITM to RCE)
pypi
atomic-agents-stack
High
2 days ago
sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)
pypi
sqlparse
High
2 days ago
sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger
pypi
sqlparse
Moderate
2 days ago
Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config
pypi
glances
High
2 days ago
Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)
pypi
glances
Moderate
2 days ago
sqlparse: Generated Python and PHP snippets allow SQL string breakout through unescaped backslashes
pypi
sqlparse
High
2 days ago
Glances has a command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction
pypi
glances
Moderate
5 days ago
ContextForge: DNS TOCTOU race condition causes SSRF protection bypass (`/admin/gateways/test`)
pypi
mcp-contextforge-gateway
High
6 days ago
nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences
pypi
nltk
High
6 days ago
atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read
pypi
atomic-agents-stack
Moderate
6 days ago
Pydantic AI: Unvalidated UploadedFile references in UI adapters allow server-side file access using the application's credentials
pypi
pydantic-ai, pydantic-ai-slim
High
7 days ago
Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)
pypi
ansible-jailexec
High
7 days ago
MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`
pypi
stata-mcp
High
7 days ago
compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0
pypi
compliance-trestle
Moderate
12 days ago
pypdf: Possible long runtimes/large memory usage for large CID font width ranges
pypi
pypdf
High
12 days ago
pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors
pypi
pymdown-extensions
High
12 days ago
GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython
pypi
GitPython
Moderate
12 days ago
GitPython: Arbitrary file read via --pathspec-from-file in IndexFile.remove() and Head.checkout()
pypi
GitPython
High
12 days ago
GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks
pypi
GitPython
High
12 days ago
GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite
pypi
GitPython
Moderate
13 days ago
AWS CLI: Disabled SSH host key verification in Amazon AWS CLI EMR helper commands
pypi
awscli
Moderate
13 days ago
LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores
pypi
langgraph-checkpoint-sqlite, langgraph-checkpoint-postgres
High
15 days ago
Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder
pypi
open-webui
Moderate
15 days ago
Open WebUI: Any authenticated user can stall a worker via a knowledge-search pattern that backtracks catastrophically
pypi
open-webui
High
15 days ago
Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages
pypi
open-webui
Moderate
15 days ago
Open WebUI: Tool source code disclosed to read-only users via the tool list and get endpoints
pypi
open-webui
Moderate
15 days ago
Open WebUI: Unapproved accounts can open terminal sessions via a WebSocket auth path missing the role check
pypi
open-webui
Moderate
15 days ago
Open WebUI: Instance-wide stall via automation recurrence rules that force multi-second parsing
pypi
open-webui
Moderate
15 days ago
Open WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata
pypi
open-webui
Moderate
15 days ago
Open WebUI: Deletion of directories and file embeddings in other knowledge bases via sync cleanup
pypi
open-webui
High
15 days ago
Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin
pypi
open-webui
High
15 days ago
Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs
pypi
open-webui
Moderate
15 days ago
Open WebUI: Users denied the image-generation permission can still generate images via chat completions
pypi
open-webui
Moderate
15 days ago
Open WebUI: Client-side SSRF via unrestricted external resource loading in Vega/Vega-Lite chart rendering
pypi
open-webui
Low
15 days ago
Open WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint
pypi
open-webui
High
15 days ago
Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client
pypi
open-webui
Moderate
15 days ago
Open WebUI: Any member with write access to a standard channel can edit or delete other members' messages
pypi
open-webui
High
15 days ago
Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader
pypi
open-webui
Moderate
16 days ago
python-cryptography verifier accepts wildcard DNS names allowing escape from permittedSubtrees
pypi
cryptography
High
16 days ago
python-cryptography: Duplicate self-signed intermediates can cause exponential path-building
pypi
cryptography
High
16 days ago
cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing
pypi
cryptography
High
16 days ago
AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)
pypi
aiohttp
Moderate
16 days ago
AIOHTTP: WebSocket client accepts compressed frames without negotiated permessage-deflate
pypi
aiohttp
Moderate
16 days ago
GitPython: Arbitrary file truncation via git rev-list --output argument injection in unguarded Commit.count
pypi
GitPython
Moderate
16 days ago
GitPython: Incomplete unsafe_git_archive_options denylist omits --add-file / --add-virtual-file, enabling arbitrary file read via Repo.archive()
pypi
GitPython
Moderate
19 days ago
gemini-bridge vulnerable to arbitrary local file read via consult_gemini_with_files inline mode
pypi
gemini-bridge
High
19 days ago
Thumbor has path traversal via post-validation URL decoding bypass in file_loader
pypi
thumbor
High
19 days ago
Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS
pypi
thumbor
High
19 days ago
Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS
pypi
thumbor
High
19 days ago
Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature
pypi
thumbor
High
19 days ago
Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot
pypi
thumbor
High
19 days ago
Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex
pypi
nltk
Moderate
19 days ago
OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files
pypi
onionshare-cli
Moderate
19 days ago
OnionShare Receive mode writes uploaded files even when file uploads are disabled
pypi
onionshare-cli
High
20 days ago
Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
pypi
flyto-core
Filter by Severity
Filter by Package
tensorflow
433
tensorflow-cpu
411
tensorflow-gpu
395
open-webui
147
apache-airflow
128
Django
107
mlflow
80
salt
67
apache-superset
66
ansible
65
vllm
61
picklescan
59
django
56
Plone
54
nova
49
gradio
49
pyload-ng
48
aiohttp
47
matrix-synapse
45
vyper
44
rdiffweb
43
pillow
42
plone
41
pypdf
39
keystone
39
praisonai
39
PraisonAI
37
moin
35
Pillow
33
praisonaiagents
33
langflow
32
opencv-python
31
opencv-contrib-python
30
litellm
29
pgadmin4
26
GitPython
25
openbabel
24
cryptography
24
weblate
23
transformers
22
glance
22
ethyca-fides
22
neutron
21
langchain
21
praisonai-platform
21
mobsf
20
wagtail
20
aim
20
OctoPrint
20
lollms
20
mindsdb
19
notebook
19
vantage6
19
nltk
19
changedetection.io
19
mistune
19
urllib3
19
keras
19
mercurial
18
tornado
18
calibreweb
18
cobbler
18
lemur
18
nicegui
17
nautobot
17
paddlepaddle
16
PaddlePaddle
16
h2o
16
bentoml
16
modoboa
15
sentry
15
wger
15
ckan
15
jupyterlab
14
fickling
14
pyftpdlib
14
zenml
14
swift
13
OpenEXR
13
roundup
13
agentscope
13
trytond
13
horizon
13
copyparty
13
Glances
13
onnx
13
onionshare-cli
13
glances
13
kiwitcms
12
yt-dlp
12
authlib
12
torch
12
jupyter-server
12
indico
12
pip
12
twisted
12
datamodel-code-generator
12
label-studio
12
ai.h2o:h2o-core
11
motioneye
11
ray
11
pretix
11
Weblate
11
langroid
11
lief
10
sglang
10
bugsink
10
opencv-python-headless
10
Flask-AppBuilder
10
hermes-agent
10
waitress
10
openssl-encrypt
10
crawl4ai
10
homeassistant
10
metagpt
10
justhtml
10
llama-index-core
10
stigmem-node
9
python-multipart
9
starlette
9
zope
9
opencv-contrib-python-headless
9
ryu
9
llama-index
9
litestar
9
pywasm3
9
cinder
9
langchain-core
9
trac
8
fastmcp
8
prefect
8
dtale
8
keylime
8
bleach
8
dbgpt
8
bbot
8
ironic
8
codechecker
8
ipython
8
sagemaker
8
aubio
8
dulwich
8
sqlparse
8
flyto-core
8
web2py
8
python-keystoneclient
8
Zope
8
numpy
8
requests
8
docling
8
jupyterhub
7
mayan-edms
7
strawberry-graphql
7
scrapy
7
pysaml2
7
tuf
7
matrix-sydent
7
rucio-webui
7
inventree
7
fschat
7
monai
7
ansible-core
7
lxml
7
ujson
7
copier
7
pyspark
7
executorch
7
compliance-trestle
6
pytorch-lightning
6
apache-airflow-providers-apache-hive
6
mage-ai
6
mitmproxy
6
Flask-Security-Too
6
whoogle-search
6
Moin
6
mailman
6
oauthenticator
6
lmdeploy
6
thumbor
6
guarddog
6
Mezzanine
6
DIRAC
6
Jinja2
6
omero-web
6
pyjwt
6
snowflake-connector-python
6
werkzeug
6
ait-core
6
langchain-chatchat
6
mcp
6
esphome
6
Werkzeug
6
torchserve
6
AstrBot
6
open-webui
6
graphite-web
6
tendenci
5
mcp-atlassian
5
Pygments
5
lightrag-hku
5
Filter by Repository
https://github.com/tensorflow/tensorflow
433
https://github.com/django/django
121
https://github.com/apache/airflow
105
https://github.com/ansible/ansible
59
https://github.com/python-pillow/Pillow
52
https://github.com/vyperlang/vyper
44
https://github.com/saltstack/salt
42
https://github.com/ikus060/rdiffweb
42
https://github.com/mmaitre314/picklescan
39
https://github.com/gradio-app/gradio
38
https://github.com/openstack/nova
38
https://github.com/plone/Products.CMFPlone
37
https://github.com/mlflow/mlflow
36
https://github.com/opencv/opencv
32
https://github.com/matrix-org/synapse
32
https://github.com/PaddlePaddle/Paddle
31
https://github.com/openstack/keystone
28
https://github.com/langchain-ai/langchain
25
https://github.com/vllm-project/vllm
25
https://github.com/pyload/pyload
24
https://github.com/run-llama/llama_index
24
https://github.com/ethyca/fides
20
https://github.com/huggingface/transformers
19
https://github.com/mindsdb/mindsdb
17
https://github.com/vantage6/vantage6
17
https://github.com/pyca/cryptography
16
https://github.com/aio-libs/aiohttp
15
https://github.com/cobbler/cobbler
15
https://github.com/MobSF/Mobile-Security-Framework-MobSF
15
https://github.com/janeczku/calibre-web
14
https://github.com/pgadmin-org/pgadmin4
14
https://github.com/dpgaspar/Flask-AppBuilder
14
https://github.com/apache/superset
14
https://github.com/twisted/twisted
14
https://github.com/urllib3/urllib3
14
https://github.com/h2oai/h2o-3
13
https://github.com/OctoPrint/OctoPrint
13
https://github.com/modoboa/modoboa
13
https://github.com/zenml-io/zenml
13
https://github.com/wagtail/wagtail
12
https://github.com/getsentry/sentry
12
https://github.com/openstack/glance
12
https://github.com/nautobot/nautobot
12
https://github.com/scrapy/scrapy
11
https://github.com/open-webui/open-webui
11
https://github.com/onionshare/onionshare
11
https://github.com/parisneo/lollms
11
https://github.com/Pylons/waitress
10
https://github.com/HumanSignal/label-studio
10
https://github.com/ckan/ckan
10
https://github.com/jupyter/notebook
10
https://github.com/aimhubio/aim
9
https://github.com/openstack/horizon
9
https://github.com/giampaolo/pyftpdlib
9
https://github.com/WeblateOrg/weblate
9
https://github.com/faucetsdn/ryu
9
https://github.com/BerriAI/litellm
9
https://github.com/zopefoundation/Zope
9
https://github.com/lief-project/LIEF
9
https://github.com/element-hq/synapse
9
https://github.com/openstack/neutron
8
https://github.com/keras-team/keras
8
https://github.com/numpy/numpy
8
https://github.com/octoprint/octoprint
8
https://github.com/tornadoweb/tornado
8
https://github.com/9001/copyparty
8
https://github.com/kiwitcms/Kiwi
8
https://github.com/ipython/ipython
8
https://github.com/dgtlmoon/changedetection.io
8
https://github.com/pallets/werkzeug
8
https://github.com/openstack/cinder
7
https://github.com/pytorch/executorch
7
https://github.com/Ericsson/codechecker
7
https://github.com/pypa/pip
7
https://github.com/openstack/swift
7
https://github.com/indico/indico
7
https://github.com/jupyter-server/jupyter_server
7
https://sourceforge.net/projects/sourceforge.net
7
https://github.com/pallets/jinja
7
https://github.com/pytorch/pytorch
7
https://github.com/py-pdf/pypdf
7
https://github.com/aubio/aubio
7
https://github.com/roundup-tracker/roundup
6
https://github.com/modelscope/agentscope
6
https://github.com/jupyterlab/jupyterlab
6
https://github.com/matrix-org/sydent
6
https://github.com/man-group/dtale
6
https://github.com/corydolphin/flask-cors
6
https://github.com/yt-dlp/yt-dlp
6
https://github.com/lxml/lxml
6
https://github.com/snowflakedb/snowflake-connector-python
6
https://github.com/graphite-project/graphite-web
6
https://github.com/keylime/keylime
6
https://github.com/benbusby/whoogle-search
6
https://github.com/psf/requests
6
https://github.com/mitmproxy/mitmproxy
5
https://github.com/onnx/onnx
5
https://github.com/Exiv2/exiv2
5
https://github.com/esphome/esphome
5
https://github.com/mozilla/bleach
5
https://github.com/tryton/trytond
5
https://github.com/bentoml/BentoML
5
https://github.com/hwchase17/langchain
5
https://github.com/ome/omero-web
5
https://github.com/ComposioHQ/composio
5
https://github.com/jupyterhub/oauthenticator
5
https://github.com/ray-project/ray
5
https://github.com/gitpython-developers/GitPython
5
https://github.com/pytorch/serve
5
https://github.com/encode/starlette
5
https://github.com/inventree/InvenTree
5
https://github.com/TeamSeri0us/pocs
5
https://github.com/home-assistant/core
5
https://github.com/pallets/flask
4
https://github.com/rohe/pysaml2
4
https://github.com/nltk/nltk
4
https://github.com/FreeTAKTeam/UI
4
https://github.com/zopefoundation/RestrictedPython
4
https://github.com/ietf-tools/xml2rfc
4
https://github.com/eosphoros-ai/DB-GPT
4
https://github.com/bottlepy/bottle
4
https://github.com/grpc/grpc
4
https://github.com/jhpyle/docassemble
4
https://github.com/pretix/pretix
4
https://github.com/mlc-ai/xgrammar
4
https://github.com/ronf/asyncssh
4
https://github.com/Cog-Creators/Red-DiscordBot
4
https://github.com/aws/aws-iot-device-sdk-java-v2
4
https://github.com/streamlit/streamlit
4
https://github.com/blacklanternsecurity/bbot
4
https://github.com/simonw/datasette
4
https://github.com/hyperledger/indy-node
4
https://github.com/latchset/jwcrypto
4
https://github.com/NVIDIA/NVFlare
4
https://github.com/frappe/frappe
4
https://github.com/hiyouga/LLaMA-Factory
4
https://github.com/saleor/saleor
4
https://github.com/web2py/web2py
4
https://github.com/dbt-labs/dbt-core
4
https://github.com/jupyterhub/jupyterhub
4
https://github.com/langflow-ai/langflow
4
https://github.com/berriai/litellm
4
https://github.com/wasm3/wasm3
4
https://github.com/AcademySoftwareFoundation/openexr
4
https://github.com/pypa/setuptools
4
https://github.com/Kozea/Radicale
4
https://github.com/python-ldap/python-ldap
4
https://github.com/django-helpdesk/django-helpdesk
4
https://github.com/litestar-org/litestar
4
https://github.com/AcademySoftwareFoundation/MaterialX
4
https://github.com/qutebrowser/qutebrowser
4
https://github.com/skops-dev/skops
3
https://github.com/paramiko/paramiko
3
https://github.com/jpadilla/pyjwt
3
https://github.com/chatchat-space/Langchain-Chatchat
3
https://github.com/python/cpython
3
https://github.com/gventuri/pandas-ai
3
https://github.com/certifi/python-certifi
3
https://github.com/ansible/ansible-runner
3
https://github.com/Gerapy/Gerapy
3
https://github.com/stephenmcd/mezzanine
3
https://github.com/bytecodealliance/wasmtime
3
https://github.com/Kludex/python-multipart
3
https://github.com/ankitects/anki
3
https://github.com/pyinstaller/pyinstaller
3
https://github.com/NASA-AMMOS/AIT-Core
3
https://github.com/openstack/ironic
3
https://github.com/pyca/pyopenssl
3
https://github.com/theupdateframework/python-tuf
3
https://github.com/openstack/octavia
3
https://github.com/aws/aws-sam-cli
3
https://github.com/beancount/fava
3
https://github.com/impredicative/bitlyshortener
3
https://github.com/rochacbruno/quokka
3
https://github.com/Project-MONAI/MONAI
3
https://github.com/modelscope/ms-swift
3
https://github.com/theupdateframework/tuf
3
https://github.com/khoj-ai/khoj
3
https://github.com/sosreport/sos
3
https://github.com/andialbrecht/sqlparse
3
https://github.com/benoitc/gunicorn
3
https://github.com/pypa/advisory-db
3
https://github.com/invoke-ai/InvokeAI
3
https://github.com/openstack/python-keystoneclient
3
https://github.com/eventlet/eventlet
3
https://github.com/micropython/micropython
3
https://github.com/github/securitylab
3
https://gitlab.com/mayan-edms/mayan-edms
3
https://github.com/lepture/mistune
3
https://github.com/astral-sh/uv
3
https://github.com/langchain-ai/langgraph
3
https://github.com/djblets/djblets
3
https://github.com/poezio/slixmpp
3
https://sourceforge.net/projects/roject
3
https://github.com/IdentityPython/pysaml2
3
https://github.com/mpdavis/python-jose
3
https://github.com/jupyterhub/jupyter-server-proxy
3
https://github.com/jlowin/fastmcp
3
https://github.com/furlongm/openvpn-monitor
3