PyPI
4,576 CVEs across 197 months on the top 200 list since Apr 2000. Peak rank #2 in May 2021. 7 of them are now in CISA KEV.
PyPI CVEs per month since Apr 2000
Dec 2021: 26 CVEs · 2 critical · 0 now in CISA KEV · rank #27 · mostly Numpy, Pyo, LxmlJan 2022: 40 CVEs · 3 critical · 0 now in CISA KEV · rank #26 · mostly Onionshare-cli, Calibreweb, PillowFeb 2022: 75 CVEs · 0 critical · 0 now in CISA KEV · rank #13 · mostly Tensorflow, Tensorflow-cpu, Tensorflow-gpuMar 2022: 54 CVEs · 7 critical · 0 now in CISA KEV · rank #16 · mostly Salt, Freetakserver-ui, AnsibleApr 2022: 14 CVEs · 5 critical · 0 now in CISA KEV · rank #57 · mostly Vyper, Django, HttpxMay 2022: 45 CVEs · 6 critical · 0 now in CISA KEV · rank #17 · mostly Tensorflow-gpu, Tensorflow, Tensorflow-cpuJun 2022: 37 CVEs · 16 critical · 0 now in CISA KEV · rank #23 · mostly Inventree, Oauthenticator, PerdidoJul 2022: 34 CVEs · 12 critical · 1 now in CISA KEV · rank #26 · mostly PyPI, Ujson, UntangleAug 2022: 26 CVEs · 2 critical · 0 now in CISA KEV · rank #34 · mostly Ansible-runner, Octoprint, AsyncuaSep 2022: 114 CVEs · 4 critical · 0 now in CISA KEV · rank #5 · mostly Tensorflow, Tensorflow-cpu, Tensorflow-gpuOct 2022: 31 CVEs · 9 critical · 0 now in CISA KEV · rank #36 · mostly Rdiffweb, Twisted, Powerline-gitstatusNov 2022: 59 CVEs · 6 critical · 0 now in CISA KEV · rank #13 · mostly Tensorflow, Tensorflow-gpu, Tensorflow-cpuDec 2022: 42 CVEs · 7 critical · 0 now in CISA KEV · rank #26 · mostly Rdiffweb, Graphite-web, Tensorflow-gpuJan 2023: 38 CVEs · 3 critical · 0 now in CISA KEV · rank #19 · mostly Pyload-ng, Apache-superset, ModoboaFeb 2023: 34 CVEs · 4 critical · 0 now in CISA KEV · rank #25 · mostly Modoboa, Markdown-it-py, Apache-airflow-providers-googleMar 2023: no snapshot, the run for this month failedApr 2023: 34 CVEs · 6 critical · 1 now in CISA KEV · rank #24 · mostly Apache-superset, Modoboa, WagtailMay 2023: 31 CVEs · 5 critical · 0 now in CISA KEV · rank #24 · mostly Vyper, Mlflow, Matrix-synapseJun 2023: 30 CVEs · 3 critical · 0 now in CISA KEV · rank #30 · mostly Pypdf2, Grpcio, LangchainJul 2023: 46 CVEs · 7 critical · 0 now in CISA KEV · rank #17 · mostly Paddlepaddle, Apache-airflow, Ethyca-fidesAug 2023: 47 CVEs · 12 critical · 0 now in CISA KEV · rank #17 · mostly Langchain, Apache-airflow, GitpythonSep 2023: 47 CVEs · 4 critical · 1 now in CISA KEV · rank #16 · mostly Apache-superset, Vyper, ZopeOct 2023: 53 CVEs · 2 critical · 0 now in CISA KEV · rank #17 · mostly Apache-airflow, Vantage6, Urllib3Nov 2023: 54 CVEs · 10 critical · 0 now in CISA KEV · rank #13 · mostly Apache-superset, Aiohttp, RayDec 2023: 52 CVEs · 5 critical · 0 now in CISA KEV · rank #13 · mostly Mlflow, Apache-airflow, Apache-supersetJan 2024: 77 CVEs · 14 critical · 0 now in CISA KEV · rank #11 · mostly Paddlepaddle, Pyload-ng, Whoogle-searchFeb 2024: 66 CVEs · 12 critical · 0 now in CISA KEV · rank #16 · mostly Vyper, Apache-superset, ClearmlMar 2024: 48 CVEs · 6 critical · 0 now in CISA KEV · rank #20 · mostly Gradio, Paddlepaddle, Apache-airflowApr 2024: 66 CVEs · 12 critical · 0 now in CISA KEV · rank #18 · mostly Mlflow, Vyper, ScrapyMay 2024: 65 CVEs · 6 critical · 0 now in CISA KEV · rank #22 · mostly Ryu, Ait-core, ScrapyJun 2024: 83 CVEs · 15 critical · 0 now in CISA KEV · rank #11 · mostly Mlflow, Lollms, ZenmlJul 2024: 59 CVEs · 3 critical · 0 now in CISA KEV · rank #17 · mostly Django, Anki, RoundupAug 2024: 40 CVEs · 1 critical · 0 now in CISA KEV · rank #22 · mostly Mage-ai, Django, CkanSep 2024: 53 CVEs · 8 critical · 0 now in CISA KEV · rank #13 · mostly Mindsdb, Micropython-copy, Micropython-ioOct 2024: 45 CVEs · 8 critical · 0 now in CISA KEV · rank #20 · mostly Gradio, Lollms, Open-webuiNov 2024: 51 CVEs · 5 critical · 0 now in CISA KEV · rank #15 · mostly Calibreweb, Transformers, AiohttpDec 2024: 32 CVEs · 5 critical · 0 now in CISA KEV · rank #24 · mostly Matrix-synapse, Apache-superset, DjangoJan 2025: 23 CVEs · 2 critical · 0 now in CISA KEV · rank #34 · mostly Snowflake-connector-python, Asteval, VyperFeb 2025: 25 CVEs · 6 critical · 0 now in CISA KEV · rank #28 · mostly Mobsf, Vyper, Label-studioMar 2025: 166 CVEs · 33 critical · 0 now in CISA KEV · rank #5 · mostly Open-webui, Aim, H2OApr 2025: 36 CVEs · 11 critical · 1 now in CISA KEV · rank #23 · mostly Vllm, Picklescan, LangflowMay 2025: 47 CVEs · 5 critical · 0 now in CISA KEV · rank #21 · mostly Vllm, Langroid, VyperJun 2025: 47 CVEs · 6 critical · 0 now in CISA KEV · rank #22 · mostly Salt, Backend.ai, Langchain-chatchatJul 2025: 51 CVEs · 5 critical · 0 now in CISA KEV · rank #26 · mostly Transformers, Pyload-ng, OpenexrAug 2025: 75 CVEs · 9 critical · 0 now in CISA KEV · rank #12 · mostly Picklescan, Executorch, Apache-supersetSep 2025: 57 CVEs · 4 critical · 0 now in CISA KEV · rank #17 · mostly Picklescan, Ethyca-fides, Ml-loggerOct 2025: 70 CVEs · 10 critical · 0 now in CISA KEV · rank #14 · mostly Keras, Bbot, FastmcpNov 2025: 47 CVEs · 4 critical · 0 now in CISA KEV · rank #13 · mostly Pgadmin4, Trytond, VllmDec 2025: 74 CVEs · 8 critical · 1 now in CISA KEV · rank #13 · mostly Picklescan, Weblate, Mcp-server-gitJan 2026: 98 CVEs · 6 critical · 0 now in CISA KEV · rank #7 · mostly Aiohttp, Fickling, VllmFeb 2026: 126 CVEs · 20 critical · 0 now in CISA KEV · rank #4 · mostly Rucio-webui, Pypdf, DjangoMar 2026: 94 CVEs · 6 critical · 0 now in CISA KEV · rank #9 · mostly Glances, Openssl-encrypt, JusthtmlApr 2026: 59 CVEs · 0 critical · 0 now in CISA KEV · rank #14 · mostly Praisonai, Praisonaiagents, Openssl-encryptMay 2026: 37 CVEs · 0 critical · 0 now in CISA KEV · rank #31 · mostly Stigmem-node, Wger, EdumfaJun 2026: 98 CVEs · 0 critical · 0 now in CISA KEV · rank #9 · mostly Praisonai, Praisonaiagents, PicklescanJul 2026: 33 CVEs · 0 critical · 0 now in CISA KEV · rank #29 · mostly Gitpython, Jupyterlab, Mcp-atlassianAug 2026: 56 CVEs · 0 critical · 0 now in CISA KEV · rank #19 · mostly Nltk, Gitpython, WagtailSep 2026: 16 CVEs · 0 critical · 0 now in CISA KEV · rank #99 · mostly Tornado, Gitpython, DjustOct 2026: 52 CVEs · 0 critical · 0 now in CISA KEV · rank #30 · mostly Pyload-ng, Gitpython, DulwichNov 2026: none that month (the list had room for every one)
In the lens
The products that kept showing up in PyPI's monthly top three from Dec 2021 to Nov 2026. Move the lens and the list follows.
Year by year
Each year's months on the top 200 list. Pick a year to read it in the lens.
The record
- Peak rank
- #2 in May 2021
- Busiest month
- Mar 2025, 166 CVEs
- Months with a KEV entry
- 6 of 197 on the list
- On the top 200 list
- 197 of 301 monthly snapshots