Skip to content
OpenAdvisories

Ecosystem

PyPI

7,110 known vulnerabilities.

Most affected packages

tensorflow 434 tensorflow-cpu 430 tensorflow-gpu 427 django 162 open-webui 161 apache-airflow 158 pillow 121 vllm 113 praisonai 105 plone 101 mlflow 87 pypdf 69 salt 69 ansible 68 apache-superset 66 nltk 62 openssl-encrypt 60 pyload-ng 58 picklescan 58 aiohttp 55 nova 54 gradio 52 praisonaiagents 50 vyper 47 matrix-synapse 45 litellm 45 keystone 44 gitpython 44 rdiffweb 43 langflow 43 moin 41 weblate 37 pyassimp 33 opencv-python 32 opencv-contrib-python 32 paddlepaddle 32 transformers 32 wagtail 31 torch 31 mcp-atlassian 30
All Critical High Medium Low Exploited only Public exploit

137 results · Clear filters · Feed

  • Critical 9.8
    CVE-2020-16846 Exploited Public exploit Scanner template EPSS 100%

    SaltStack Salt Command Injection in netapi ssh client

    An issue was discovered in SaltStack Salt through 3002. Sending crafted web requests to the Salt API, with the SSH client enabled, can result in shell injection.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2020-11981 Public exploit Scanner template EPSS 37%

    Command injection via Celery broker in Apache Airflow

    An issue was found in Apache Airflow versions 1.10.10 and below. When using CeleryExecutor, if an attacker can connect to the broker (Redis, RabbitMQ) directly, it is possible to inject commands, resulting in the celery worker running arbitrary commands.

    Apache Software Foundation Apache Airflow apache-airflow PyPI
  • Critical 9.8
    CVE-2020-9480 Public exploit Scanner template EPSS 30%

    Improper Authentication in Apache Spark

    In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application…

    Apache Software Foundation Apache Spark pyspark org.apache.spark:spark-parent_2.11 Maven PyPI
  • Critical 9.8
    CVE-2020-11651 Exploited Public exploit EPSS 97%

    SaltStack Salt Unauthenticated Remote Code Execution

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class does not properly validate method calls. This allows a remote user to access some methods without authentication. These methods can be u…

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021
  • Critical 9.8
    CVE-2014-9390 Public exploit EPSS 76%

    JGit Improper Input Validation vulnerability

    Git before 1.8.5.6, 1.9.x before 1.9.5, 2.0.x before 2.0.5, 2.1.x before 2.1.4, and 2.2.x before 2.2.1 on Windows and OS X; Mercurial before 3.2.3 on Windows and OS X; Apple Xcode before 6.2 beta 3; mine all versions before 08-12-2014; libgit2 all versions up…

    git git libgit2 libgit2 Debian Ubuntu Maven PyPI
  • Critical 9.8
    CVE-2020-7471 Public exploit EPSS 66%

    SQL injection in Django

    Django 1.11 before 1.11.28, 2.2 before 2.2.10, and 3.0 before 3.0.3 allows SQL Injection if untrusted data is used as a StringAgg delimiter (e.g., in Django applications that offer downloads of data as a series of rows with a user-specified column delimiter).…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2019-19844 Public exploit EPSS 54%

    Django Potential account hijack via password reset form

    Django before 1.11.27, 2.x before 2.2.9, and 3.x before 3.0.1 allows account takeover. A suitably crafted email address (that is equal to an existing user's email address after case transformation of Unicode characters) would allow an attacker to be sent a pa…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2019-14234 Public exploit EPSS 48%

    SQL Injection in Django

    An issue was discovered in Django 1.11.x before 1.11.23, 2.1.x before 2.1.11, and 2.2.x before 2.2.4. Due to an error in shallow key transformation, key and index lookups for django.contrib.postgres.fields.JSONField, and key lookups for django.contrib.postgre…

    python-django django python-django py3-django Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2019-1010268 Public exploit

    Improper Restriction of XML External Entity Reference in ladon

    Ladon since 0.6.1 (since ebef0aae48af78c159b6fce81bc6f5e7e0ddb059) is affected by: XML External Entity (XXE). The impact is: Information Disclosure, reading files and reaching internal network endpoints. The component is: SOAP request handlers. For instance: …

    Ladon Ladon ladon PyPI
  • Critical 9.8
    CVE-2019-6446 Public exploit EPSS 27%

    Numpy Deserialization of Untrusted Data

    An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call. NOTE: third parties dispute this issue be…

    numpy PyPI
  • Critical 9.8
    CVE-2018-8021 Public exploit EPSS 53%

    Deserialization of Untrusted Data in superset

    Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

    superset PyPI
  • Critical 9.8
    CVE-2018-9160 Public exploit EPSS 76%

    SiCKRAGE Discloses Plaintext Credentials

    SickRage before v2018.03.09-1 includes cleartext credentials in HTTP responses.

    sickrage PyPI
  • Critical 9.8
    CVE-2018-8097 Public exploit

    Eve allows execution of arbitrary code

    io/mongo/parser.py in Eve (aka pyeve) before 0.7.5 allows remote attackers to execute arbitrary code via Code Injection in the where parameter.

    eve PyPI
  • Critical 9.8
    CVE-2018-7750 Public exploit EPSS 27%

    Paramiko not properly checking authentication before processing other requests

    transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed b…

    paramiko paramiko paramiko py3-paramiko Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2015-5285 Public exploit

    Kallithea CRLF injection vulnerability

    CRLF injection vulnerability in Kallithea before 0.3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the came_from parameter to _admin/login.

    kallithea PyPI
  • Critical 9.8
    CVE-2014-0472 Public exploit

    Code Injection in Django

    The django.core.urlresolvers.reverse function in Django before 1.4.11, 1.5.x before 1.5.6, 1.6.x before 1.6.3, and 1.7.x before 1.7 beta 2 allows remote attackers to import and execute arbitrary Python modules by leveraging a view that constructs URLs using u…

    python-django django python-django Debian Ubuntu PyPI
  • Critical 9.0
    CVE-2013-5093 Public exploit EPSS 39%

    graphite-web is vulnerable to Remote Code Execution via renderLocalView function

    The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object.

    graphite-web graphite-web Debian PyPI