PyPI
4,576 CVEs tracked since 2000. Since Oct 2021, 5 of them reached CISA KEV.
PyPI CVEs per month
| Month | CVEs | In CISA KEV |
|---|---|---|
| 2021-10 | 29 | 0 |
| 2021-11 | 56 | 0 |
| 2021-12 | 26 | 0 |
| 2022-01 | 40 | 0 |
| 2022-02 | 75 | 0 |
| 2022-03 | 54 | 0 |
| 2022-04 | 14 | 0 |
| 2022-05 | 45 | 0 |
| 2022-06 | 37 | 0 |
| 2022-07 | 34 | 1 |
| 2022-08 | 26 | 0 |
| 2022-09 | 114 | 0 |
| 2022-10 | 31 | 0 |
| 2022-11 | 59 | 0 |
| 2022-12 | 42 | 0 |
| 2023-01 | 38 | 0 |
| 2023-02 | 34 | 0 |
| 2023-03 | no snapshot | |
| 2023-04 | 34 | 1 |
| 2023-05 | 31 | 0 |
| 2023-06 | 30 | 0 |
| 2023-07 | 46 | 0 |
| 2023-08 | 47 | 0 |
| 2023-09 | 47 | 1 |
| 2023-10 | 53 | 0 |
| 2023-11 | 54 | 0 |
| 2023-12 | 52 | 0 |
| 2024-01 | 77 | 0 |
| 2024-02 | 66 | 0 |
| 2024-03 | 48 | 0 |
| 2024-04 | 66 | 0 |
| 2024-05 | 65 | 0 |
| 2024-06 | 83 | 0 |
| 2024-07 | 59 | 0 |
| 2024-08 | 40 | 0 |
| 2024-09 | 53 | 0 |
| 2024-10 | 45 | 0 |
| 2024-11 | 51 | 0 |
| 2024-12 | 32 | 0 |
| 2025-01 | 23 | 0 |
| 2025-02 | 25 | 0 |
| 2025-03 | 166 | 0 |
| 2025-04 | 36 | 1 |
| 2025-05 | 47 | 0 |
| 2025-06 | 47 | 0 |
| 2025-07 | 51 | 0 |
| 2025-08 | 75 | 0 |
| 2025-09 | 57 | 0 |
| 2025-10 | 70 | 0 |
| 2025-11 | 47 | 0 |
| 2025-12 | 74 | 1 |
| 2026-01 | 98 | 0 |
| 2026-02 | 126 | 0 |
| 2026-03 | 94 | 0 |
| 2026-04 | 59 | 0 |
| 2026-05 | 37 | 0 |
| 2026-06 | 98 | 0 |
| 2026-07 | 33 | 0 |
| 2026-08 | 56 | 0 |
| 2026-09 | 16 | 0 |
| 2026-10 | 52 | 0 |
| 2026-11 | 0 |
Products
The products that kept showing up in PyPI's monthly top three, with their CVEs summed over those months.
Latest CVEs
The 15 most recently published vulnerabilities affecting PyPI.
- GHSA-vpp8-g58w-m8mpTwisted: Unauthenticated Remote Denial of Service in the Twisted HTTP/2 Server via Rapid Stream Reset—
- GHSA-wf6j-7hvr-gr93Hydra legacy target blacklist permits unsafe PyYAML loading—
- GHSA-3w55-933p-8pv5Strands Agents: Local Privilege Escalation via Symlink Attack in Default Session File Storage—
- GHSA-763v-5pjm-fx36Strands Agents: Default FileSessionManager storage is world-readable on shared systems—
- GHSA-g5ff-637f-6q2mLiteLLM: internal_user_viewer arbitrary local file read via `vertex_ai_credentials`—
- GHSA-hhww-mrg2-969hLiteLLM vulnerable to reflected XSS in /sso/debug/callback—
- GHSA-23mf-xhv8-69c2GitPython: arbitrary file read via attacker-controlled branch name in `Head.checkout()` (incomplete fix of CVE-2026-78679)—
- GHSA-gq48-pqfc-9p58GitPython: Submodule.move() follows an attacker-committed intermediate symlink outside the worktree—
- GHSA-f9j4-qggq-h239GitPython Remote.pull() refspec bypasses the --upload-pack unsafe-option guard, enabling arbitrary command execution—
- GHSA-w8jc-g24h-crhwGitPython command wrappers omit unsafe protocol and option checks—
- GHSA-fx3j-rwgx-fr94GitPython: separate_git_dir leaks env vars via crafted .gitmodules submodule name—
- GHSA-m64x-33q8-m5h7GitPython parse_actor_and_date() is vulnerable to quadratic backtracking on malformed identity lines—
- GHSA-j456-xh4h-cpf2NLTK: WekaClassifier passes an unvalidated caller-controlled model path to the weka JVM, bypassing nltk.pathsec containment—
- GHSA-xmj3-9gf7-h52wsetuptools: Windows path escape via namespace_packages.txt during legacy wheel installation Description—
- GHSA-7xgj-8392-5q4rFastMCP: Post-transform component authorization is skipped on direct calls—
The record
- Peak rank
- #2 in May 2021
- Busiest month shown
- Mar 2025, 166 CVEs
- Months with a KEV entry
- 5 since Oct 2021
- Monthly snapshots
- 197 since 2000