Package ecosystem
PyPI package vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 6,825 vulnerabilities in PyPI packages: 50 in the last 7 days and 2,636 in the last 90 days, 298 of them critical and 20 exploited in the wild. The most recent, CVE-2026-57443, was published on 25 September 2026. 207 packages have a page of their own.
- Last 7 days
- 50
- Last 90 days
- 2,636
- Critical, all time
- 298
- Exploited in the wild
- 20
About PyPI
The official software repository for the Python programming language.
PyPI packages
- open-webui (PyPI)156
- nltk (PyPI)74
- picklescan (PyPI)74
- openbabel (PyPI)48
- apache-superset (PyPI)44
- apache-airflow (PyPI)40
- tensorflow-gpu (PyPI)37
- tensorflow-cpu (PyPI)34
- weblate (PyPI)33
- mcp-atlassian (PyPI)30
- crawl4ai (PyPI)28
- moin (PyPI)28
- opencv-contrib-python (PyPI)24
- pypdf (PyPI)24
- opencv-python (PyPI)23
- paddlepaddle (PyPI)23
- pyload-ng (PyPI)23
- aiohttp (PyPI)21
- ansible (PyPI)21
- pillow (PyPI)21
- praisonai-platform (PyPI)21
- gradio (PyPI)20
- mlflow (PyPI)20
- tornado (PyPI)18
- mercurial (PyPI)17
- mistune (PyPI)17
- astrbot (PyPI)16
- djust (PyPI)16
- justhtml (PyPI)16
- lemur (PyPI)16
- cobbler (PyPI)15
- glances (PyPI)15
- Keras (PyPI)15
- pyftpdlib (PyPI)14
- flask-appbuilder (PyPI)13
- calibreweb (PyPI)12
- lmdeploy (PyPI)12
- wger (PyPI)12
- changedetection.io (PyPI)10
- jinja2 (PyPI)10
- langroid (PyPI)10
- motioneye (PyPI)10
- OpenEXR (PyPI)10
- roundup (PyPI)10
- stigmem-node (PyPI)10
- vantage6 (PyPI)10
- waitress (PyPI)10
- cryptography (PyPI)9
- nautobot (PyPI)9
- ryu (PyPI)9
- agentscope (PyPI)8
- django-cms (PyPI)8
- dtale (PyPI)8
- flyto-core (PyPI)8
- llama-index-core (PyPI)8
- pgadmin4 (PyPI)8
- prefect (PyPI)8
- bbot (PyPI)7
- compliance-trestle (PyPI)7
- dbgpt (PyPI)7
- dulwich (PyPI)7
- indico (PyPI)7
- label-studio (PyPI)7
- lightrag-hku (PyPI)7
- monai (PyPI)7
- onnx (PyPI)7
- opencv-python-headless (PyPI)7
- python-keystoneclient (PyPI)7
- python-multipart (PyPI)7
- requests (PyPI)7
- sqlparse (PyPI)7
- torch (PyPI)7
- vyper (PyPI)7
- atomic-agents-stack (PyPI)6
- aubio (PyPI)6
- bentoml (PyPI)6
- executorch (PyPI)6
- inventree (PyPI)6
- ipython (PyPI)6
- keylime (PyPI)6
- opencv-contrib-python-headless (PyPI)6
- openviking (PyPI)6
- pywasm3 (PyPI)6
- thumbor (PyPI)6
- urllib3 (PyPI)6
- web2py (PyPI)6
- yt-dlp (PyPI)6
- apache-airflow-core (PyPI)5
- apache-airflow-providers-apache-hive (PyPI)5
- bleach (PyPI)5
- Django (PyPI)5
- exiv2 (PyPI)5
- feedparser (PyPI)5
- httpx2 (PyPI)5
- keystone (PyPI)5
- linuxfabrik-lib (PyPI)5
- matrix-sydent (PyPI)5
- nicegui (PyPI)5
- OctoPrint (PyPI)5
- omero-web (PyPI)5
- pygments (PyPI)5
- ray (PyPI)5
- scrapy (PyPI)5
- social-auth-core (PyPI)5
- strawberry-graphql (PyPI)5
- trac (PyPI)5
- werkzeug (PyPI)5
- zeroconf (PyPI)5
- awsiotsdk (PyPI)4
- barbican (PyPI)4
- cbor2 (PyPI)4
- chromadb (PyPI)4
- composio-core (PyPI)4
- dbt-mcp (PyPI)4
- DIRAC (PyPI)4
- django-unicorn (PyPI)4
- fastmcp (PyPI)4
- flask (PyPI)4
- freetakserver-ui (PyPI)4
- GDAL (PyPI)4
- graphite-web (PyPI)4
- homeassistant (PyPI)4
- jwcrypto (PyPI)4
- kallithea (PyPI)4
- kedro (PyPI)4
- langchain (PyPI)4
- lief (PyPI)4
- lmdb (PyPI)4
- markdown2 (PyPI)4
- matrix-synapse (PyPI)4
- mindsdb (PyPI)4
- mobsf (PyPI)4
- nemo-toolkit (PyPI)4
- omnigent (PyPI)4
- pdm (PyPI)4
- psd-tools (PyPI)4
- red-discordbot (PyPI)4
- skops (PyPI)4
- smolagents (PyPI)4
- soupsieve (PyPI)4
- tendenci (PyPI)4
- torchserve (PyPI)4
- uefi-firmware (PyPI)4
- xml2rfc (PyPI)4
- aiosmtplib (PyPI)3
- anyio (PyPI)3
- apache-submarine (PyPI)3
- asyncua (PyPI)3
- boxlite (PyPI)3
- buildbot (PyPI)3
- ciguard (PyPI)3
- cinder (PyPI)3
- copyparty (PyPI)3
- crewai-tools (PyPI)3
- django-allauth (PyPI)3
- docassemble-webapp (PyPI)3
- ecdsa (PyPI)3
- edumfa (PyPI)3
- eventlet (PyPI)3
- fickling (PyPI)3
- flaskbb (PyPI)3
- httpie (PyPI)3
- jupyter_enterprise_gateway (PyPI)3
- jupyterhub (PyPI)3
- kas (PyPI)3
- keyring (PyPI)3
- kiwitcms (PyPI)3
- langchain-experimental (PyPI)3
- litestar (PyPI)3
- localstack (PyPI)3
- mailman (PyPI)3
- Markdown (PyPI)3
- mcp-server-git (PyPI)3
- mem0ai (PyPI)3
- meta-ads-mcp (PyPI)3
- Mezzanine (PyPI)3
- ml-logger (PyPI)3
- nono-py (PyPI)3
- openstack-heat (PyPI)3
- pip (PyPI)3
- pipecat-ai (PyPI)3
- pptagent (PyPI)3
- pretalx (PyPI)3
- products-pluggableauthservice (PyPI)3
- proot-distro (PyPI)3
- py7zr (PyPI)3
- pycti (PyPI)3
- pyinstaller (PyPI)3
- pymdown-extensions (PyPI)3
- pypdf2 (PyPI)3
- python-gnupg (PyPI)3
- pytorch-lightning (PyPI)3
- quokka (PyPI)3
- radicale (PyPI)3
- rdiffweb (PyPI)3
- reportlab (PyPI)3
- scikit-learn (PyPI)3
- sosreport (PyPI)3
- starlite (PyPI)3
- stata-mcp (PyPI)3
- streampipes (PyPI)3
- tripleo-heat-templates (PyPI)3
- wlc (PyPI)3
- xinference (PyPI)3
- ydata-profiling (PyPI)3
- zodb3 (PyPI)3
- Zope (PyPI)3
Latest PyPI package vulnerabilities
- CVE-2026-57443: SCBE-AETHERMOORE unauthenticated email metadata exposurehighCVSS 7.5
- LangChain NVIDIA local file disclosure through VLM image inputshighCVSS 7.5
- CVE-2026-61732: Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results , the output of…criticalCVSS 10EPSS 1.2%
- CVE-2026-57179: Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the partial-pipeline resume…mediumCVSS 4.2EPSS 0.2%
- CVE-2026-57178: Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the `vk-app` backend…highCVSS 7.4EPSS 0.2%
- CVE-2026-57177: Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the LoginRadius backend did…mediumCVSS 4.3EPSS 0.1%
- CVE-2026-57176: Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the Vend OAuth2 backend used…mediumCVSS 6.8EPSS 0.2%
- CVE-2026-57175: Python Social Auth is a social authentication/registration mechanism. Prior to version 5.0.0, the SAML backend accepted…mediumCVSS 6.4EPSS 0.2%
- CVE-2026-59980: hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause…mediumCVSS 4EPSS 0.3%
- MemoryOS credential-stealing binary in v2.0.34info
- CVE-2026-93421: Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.4, the unauthenticated…mediumCVSS 4EPSS 0.4%
- CVE-2026-62364: wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from…lowCVSS 3.1EPSS 0.1%
- CVE-2026-83805: Nautobot is a Network Source of Truth and Network Automation Platform. From 3.0.0 until 3.1.8, the generic…mediumCVSS 6.4EPSS 0.2%
- CVE-2026-59991: psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and…highCVSS 7.5EPSS 0.5%
- CVE-2026-91130: Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.7.0, the…criticalCVSS 4EPSS 0.4%
- CVE-2026-91129: Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.2.3, the IPP…mediumCVSS 5.4EPSS 0.2%
- CVE-2026-77272: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the…mediumCVSS 5.4EPSS 0.2%
- CVE-2026-77269: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the…mediumCVSS 6.5EPSS 0.4%
- CVE-2026-77268: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the…mediumCVSS 5.5EPSS 0.1%
- CVE-2026-77266: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0…mediumCVSS 6.5EPSS 0.5%
- CVE-2026-77262: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0…highCVSS 8.6EPSS 0.5%
- CVE-2026-77259: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0…highCVSS 7.7EPSS 0.4%
- CVE-2026-77257: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0…highCVSS 4EPSS 0.4%
- CVE-2026-77255: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the…highCVSS 8.6EPSS 0.4%
- CVE-2026-77253: MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, Jira…highCVSS 7.1EPSS 0.4%
Most severe PyPI package vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-55255: Langflow IDOR in responses endpoint allows cross-user flow executioncriticalexploited in the wildCVSS 9.9EPSS 0.9%
- CVE-2026-0770: Langflow remote code execution in validate endpointcriticalexploited in the wildCVSS 9.8EPSS 63.8%
- CVE-2026-39987: Marimo: Pre-Auth Remote Code Execution via Terminal WebSocket Authentication Bypasscriticalexploited in the wildCVSS 9.8EPSS 37.9%
- CVE-2026-33017: Langflow unauthenticated remote code execution in build_public_tmp endpointcriticalexploited in the wildCVSS 9.8EPSS 24.8%
- CVE-2026-42208: BerriAI LiteLLM SQL injection in Proxy API key verificationcriticalexploited in the wildCVSS 9.8EPSS 5.8%
- CVE-2026-64849: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to…criticalexploited in the wildCVSS 9.3EPSS 9.8%
- CVE-2022-33891: Apache Spark OS command injection in Spark UI via impersonationcriticalexploited in the wildCVSS 8.8EPSS 93.1%
- CVE-2025-34291: Langflow CORS misconfiguration enables Account Takeover and RCEcriticalexploited in the wildCVSS 8.8EPSS 92.8%
- CVE-2025-62593: Ray is an AI compute engine. Prior to version 2.52.0, developers working with Ray as a development tool can be exploited…criticalexploited in the wildCVSS 8.8EPSS 62.5%
- CVE-2026-42271: BerriAI LiteLLM OS command injection in MCP test endpointscriticalexploited in the wildCVSS 8.8EPSS 12.8%
Vulnerabilities per week
The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 29 Jun 2026 | 403 | 2 | |
| 6 Jul 2026 | 1,334 | 13 | |
| 13 Jul 2026 | 264 | 7 | |
| 20 Jul 2026 | 62 | 11 | |
| 27 Jul 2026 | 53 | 3 | |
| 3 Aug 2026 | 42 | 0 | |
| 10 Aug 2026 | 35 | 1 | |
| 17 Aug 2026 | 131 | 5 | |
| 24 Aug 2026 | 117 | 19 | |
| 31 Aug 2026 | 25 | 0 | |
| 7 Sep 2026 | 38 | 0 | |
| 14 Sep 2026 | 82 | 21 | |
| 21 Sep 2026 | 50 | 5 |
How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/vendors/pypi.json, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "PyPI package vulnerabilities", https://junglewise.ai/threats/vendors/pypi, 26 September 2026.