Skip to content
OpenAdvisories

Ecosystem

PyPI

7,088 known vulnerabilities.

Most affected packages

tensorflow 434 tensorflow-cpu 430 tensorflow-gpu 427 django 162 open-webui 161 apache-airflow 158 pillow 119 vllm 113 praisonai 105 plone 101 mlflow 87 pypdf 69 salt 69 ansible 68 apache-superset 66 openssl-encrypt 60 pyload-ng 58 picklescan 58 aiohttp 55 nova 54 nltk 53 gradio 52 praisonaiagents 50 vyper 47 matrix-synapse 45 litellm 45 keystone 44 gitpython 44 rdiffweb 43 langflow 43 moin 41 weblate 37 pyassimp 33 opencv-python 32 opencv-contrib-python 32 paddlepaddle 32 transformers 32 wagtail 31 torch 31 mcp-atlassian 30
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.5
    CVE-2026-48710 Exploited Public exploit EPSS 70%

    Starlette has missing Host header validation that poisons request.url.path, bypassing path-based security checks

    Starlette is a lightweight ASGI framework/toolkit. Prior to version 1.0.1, the HTTP `Host` request header was not validated before being used to reconstruct `request.url`. Because the routing algorithm relies on the raw HTTP path while `request.url` is rebuil…

    Kludex starlette starlette starlette Debian Ubuntu Alpine PyPI
    KEV Sep 2, 2026
  • Medium 6.5
    CVE-2020-11652 Exploited Public exploit EPSS 86%

    SaltStack Salt is vulnerable Arbitrary Directory Access

    An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some methods that improperly sanitize paths. These methods allow arbitrary directory access to authenticated users.

    salt salt salt Ubuntu Alpine PyPI
    KEV Nov 3, 2021