Ecosystem
PyPI
7,110 known vulnerabilities.
Most affected packages
7,091 results · Feed
-
Low 3.2CVE-2026-25211 Public exploit
Llama Stack exposes secret in initialization log
Llama Stack (aka llama-stack) before 0.4.0rc3 does not censor the pgvector password in the initialization log.
-
High 8.6
geopandas SQL Injection Vulnerability in to_postgis() Allows Information Disclosure
SQL injection vulnerability in geopandas before v.1.1.2 allows an attacker to obtain sensitive information via the to_postgis()` function being used to write GeoDataFrames to a PostgreSQL database.
-
High 8.6
AutoGPT is Vulnerable to RCE via Disabled Block Execution
AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that automate complex workflows. Prior to autogpt-platform-beta-v0.6.44, AutoGPT Platform's block execution endpoints (both main web API and extern…
-
Unscored —
A single post-release of dydx-v4-client contained obfuscated multi-stage loader
A PyPI user account compromised by an attacker and was able to upload a malicious version (1.1.5.post1) of the `dydx-v4-client` package. This version contains a highly obfuscated multi-stage loader that ultimately executes malicious code on the host system. W…
-
Critical 9.8CVE-2020-36962 EPSS 12%
Tendenci 12.3.1 - CSV/ Formula Injection
Tendenci 12.3.1 contains a CSV formula injection vulnerability in the contact form message field that allows attackers to inject malicious formulas during export. Attackers can submit crafted payloads like '=10+20+cmd|' /C calc'!A0' in the message field to tr…
-
Medium 6.5
TaskWeaver has Protection Mechanism Failure and Server-Side Request Forgery (SSRF)
### Summary This vulnerability allows a user to escape the container network isolation and access the host’s local services (127.0.0.1 bound on the host). The vulnerability is applicable only on the MacOS and Windows environments while using Docker Desktop, C…
-
High 7.1
vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`
vLLM is an inference and serving engine for large language models (LLMs). Prior to version 0.14.1, a Server-Side Request Forgery (SSRF) vulnerability exists in the `MediaConnector` class within the vLLM project's multimodal feature set. The load_from_url and …
-
High 8.8
PyTorch Vulnerable to Remote Code Execution via Untrusted Checkpoint Files
PyTorch is a Python package that provides tensor computation. Prior to version 2.10.0, a vulnerability in PyTorch's `weights_only` unpickler allows an attacker to craft a malicious checkpoint file (`.pth`) that, when loaded with `torch.load(..., weights_only=…
-
Medium 5.1CVE-2026-24688 Public exploit
pypdf has possible Infinite Loop when processing outlines/bookmarks
pypdf is a free and open-source pure-python PDF library. An attacker who uses an infinite loop vulnerability that is present in versions prior to 6.6.2 can craft a PDF which leads to an infinite loop. This requires accessing the outlines/bookmarks. This has b…
-
Medium 6.0
OctoPrint has Timing Side-Channel Vulnerability in API Key Authentication
OctoPrint provides a web interface for controlling consumer 3D printers. OctoPrint versions up to and including 1.11.5 are affected by a (theoretical) timing attack vulnerability that allows API key extraction over the network. Due to using character based co…
-
Medium 5.3
Askbot 0.12.2 - Insecure Direct Object Reference (IDOR)
All versions of askbot before and including 0.12.2 allow an attacker authenticated with normal user permissions to modify the profile picture of other application users.This issue affects askbot: 0.12.2.
-
Medium 5.2
A heap-based buffer over-read or buffer overflow in davisking/dlib
Out-of-bounds Write, Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in davisking dlib (dlib/external/zlib modules). This vulnerability is associated with program files inflate.C. This issue affects dlib: before v19.24.9.
-
High 8.1
MobSF has Stored XSS via Manifest Analysis - Dialer Code Host Field
MobSF is a mobile application security testing tool used. Prior to version 4.4.5, a Stored Cross-site Scripting (XSS) vulnerability in MobSF's Android manifest analysis allows an attacker to execute arbitrary JavaScript in the context of a victim's browser se…
-
Medium 5.3
Gakido vulnerable to HTTP Header Injection (CRLF Injection)
Gakido is a Python HTTP client focused on browser impersonation and anti-bot evasion. A vulnerability was discovered in Gakido prior to version 0.1.1 that allowed HTTP header injection through CRLF (Carriage Return Line Feed) sequences in user-supplied header…
-
High 8.6CVE-2026-24486 Public exploit
Python-Multipart has Arbitrary File Write via Non-Default Configuration
Python-Multipart is a streaming multipart parser for Python. Prior to version 0.0.22, a Path Traversal vulnerability exists when using non-default configuration options `UPLOAD_DIR` and `UPLOAD_KEEP_FILENAME=True`. An attacker can write uploaded files to arbi…
-
None 0.0
sigstore has CSRF possibility in OIDC authentication during signing
sigstore-python is a Python tool for generating and verifying Sigstore signatures. Prior to version 4.2.0, the sigstore-python OAuth authentication flow is susceptible to Cross-Site Request Forgery. `_OAuthSession` creates a unique "state" and sends it as a p…
-
High 7.4
BentoML has a Path Traversal via Bentofile Configuration
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to version 1.4.34, BentoML's `bentofile.yaml` configuration allows path traversal attacks through multiple file path fields (`description`, `docke…
-
Critical 9.3
dcap-qvl has Missing Verification for QE Identity
dcap-qvl implements the quote verification logic for DCAP (Data Center Attestation Primitives). A vulnerability present in versions prior to 0.3.9 involves a critical gap in the cryptographic verification process within the dcap-qvl. The library fetches QE Id…
-
Medium 6.1
Gi-docgen: reflected dom xss in gi-docgen
A flaw was found in the gi-docgen. This vulnerability allows arbitrary JavaScript execution in the context of the page — enabling DOM access, session cookie theft and other client-side attacks — via a crafted URL that supplies a malicious value to the q GET p…
-
High 8.2CVE-2026-0994 Public exploit
Denial of Service in Python Protobuf
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…
-
Critical 9.8
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability
Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is not required to e…
KEV Jul 21, 2026 -
Low 2.7
Moonraker with LDAP Enabled Allows Malicious Search Filter Injection
Moonraker is a Python web server providing API access to Klipper 3D printing firmware. In versions 0.9.3 and below, instances configured with the "ldap" component enabled are vulnerable to LDAP search filter injection techniques via the login endpoint. The 40…
-
High 8.5
Invalid Memory Access in Sentencepiece,
Invalid memory access in Sentencepiece versions less than 0.2.1 when using a vulnerable model file, which is not created in the normal training procedure.
-
High 8.1CVE-2026-24009 Public exploit
Docling Core vulnerable to Remote Code Execution via unsafe PyYAML usage
Docling Core (or docling-core) is a library that defines core data types and transformations in the document processing application Docling. A PyYAML-related Remote Code Execution (RCE) vulnerability, namely CVE-2020-14343, is exposed in docling-core starting…
-
Medium 6.8
pytest has vulnerable tmpdir handling
pytest through 9.0.2 on UNIX relies on directories with the /tmp/pytest-of-{user} name pattern, which allows local users to cause a denial of service or possibly gain privileges.
-
High 7.1CVE-2026-24049 Public exploit
wheel Allows Arbitrary File Permission Modification via Path Traversal
wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…
-
Medium 6.8
Tendenci has Authenticated Remote Code Execution via Pickle Deserialization
Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerab…
-
High 7.5CVE-2025-67221 Public exploit
orjson does not limit recursion for deeply nested JSON documents
The orjson.dumps function in orjson thru 3.11.4 does not limit recursion for deeply nested JSON documents.
-
Low 3.7
FastAPI Api Key has a timing side-channel in verify_key that allows statistical key validity detection
FastAPI Api Key provides a backend-agnostic library that provides an API key system. Version 1.1.0 has a timing side-channel vulnerability in verify_key(). The method applied a random delay only on verification failures, allowing an attacker to statistically …
-
Medium 6.9
Copier safe template has arbitrary filesystem write access via directory symlinks when _preserve_symlinks: true
Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require pas…
-
Medium 6.8
Copier safe template has arbitrary filesystem read access via symlinks when _preserve_symlinks: false
Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require pas…
-
High 8.8CVE-2026-22807 Public exploit
vLLM affected by RCE via auto_map dynamic module loading during model initialization
vLLM is an inference and serving engine for large language models (LLMs). Starting in version 0.10.1 and prior to version 0.14.0, vLLM loads Hugging Face `auto_map` dynamic modules during model resolution without gating on `trust_remote_code`, allowing attack…
-
High 8.6
jaraco.context Has a Path Traversal Vulnerability
jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnera…
-
High 8.3
Chainlit < 2.9.4 SQLAlchemy Data Layer SSRF via /project/element
Chainlit versions prior to 2.9.4 contain a server-side request forgery (SSRF) vulnerability in the /project/element update flow when configured with the SQLAlchemy data layer backend. An authenticated client can provide a user-controlled url value in an Eleme…
-
High 7.1
Chainlit < 2.9.4 Arbitrary File Read via /project/element
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value, causing the server to copy the referenced file into the att…
-
Medium 5.3
Directory Traversal & Filesystem can be accessed by a non-admin user
Swing Music is a self-hosted music player for local audio files. Prior to version 2.1.4, Swing Music's `list_folders()` function in the `/folder/dir-browser` endpoint is vulnerable to directory traversal attacks. Any authenticated user (including non-admin) c…
-
High 7.5CVE-2026-23842 Public exploit
ChatterBot has Denial of Service via Database Connection Pool Exhaustion
ChatterBot is a machine learning, conversational dialog engine for creating chat bots. ChatterBot versions up to 1.2.10 are vulnerable to a denial-of-service condition caused by improper database session and connection pool management. Concurrent invocations …
-
Low 1.7
ESPHome vulnerable to denial-of-service via out-of-bounds check bypass in the API component
ESPHome is a system to control microcontrollers remotely through Home Automation systems. In versions 2025.9.0 through 2025.12.6, an integer overflow in the API component's protobuf decoder allows denial-of-service attacks when API encryption is not used. The…
-
High 7.5CVE-2025-68616 Public exploit
WeasyPrint Vulnerable to Server-Side Request Forgery (SSRF) Protection Bypass via HTTP Redirect
WeasyPrint helps web developers to create PDF documents. Prior to version 68.0, a server-side request forgery (SSRF) protection bypass exists in WeasyPrint's `default_url_fetcher`. The vulnerability allows attackers to access internal network resources (such …
-
High 8.1
wlc Path traversal: Unsanitized API slugs in download command
wlc is a Weblate command-line client using Weblate's REST API. Prior to 1.17.2, the multi-translation download could write to an arbitrary location when instructed by a crafted server. This vulnerability is fixed in 1.17.2.