Junglewise

Package ecosystem

PyPI package vulnerabilities

Updated . Rebuilt every hour.

Junglewise Threat Intelligence has tracked 7,561 vulnerabilities in PyPI packages: 24 in the last 7 days and 946 in the last 90 days, 456 of them critical and 22 exploited in the wild. The most recent, CVE-2026-100397, was published on 13 November 2026. 277 vulnerabilities in the last four weeks, down 15% on the four before (325). 23 critical against 38, 2 exploited in the wild against 0. 489 packages have a page of their own.

Last 7 days
24
Last 90 days
946
Critical, all time
456
Exploited in the wild
22

About PyPI

Python package index providing access to Python software packages and libraries.

Homepage

PyPI packages

Latest PyPI package vulnerabilities

Most severe PyPI package vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

Vulnerabilities per week

277 vulnerabilities in the last four weeks, down 15% on the four before (325). 23 critical against 38, 2 exploited in the wild against 0. The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week ofBarVulnsCritical
17 Aug 2026
13814
24 Aug 2026
12219
31 Aug 2026
261
7 Sep 2026
390
14 Sep 2026
10722
21 Sep 2026
817
28 Sep 2026
585
5 Oct 2026
794
12 Oct 2026
233
19 Oct 2026
16912
26 Oct 2026
572
2 Nov 2026
286
9 Nov 2026
191

Embed a badge

PyPI package vulnerabilities this week

A live badge for a README, a status page or an internal wiki: how many PyPI package vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.

[![PyPI package vulnerabilities](https://junglewise.ai/threats/vendors/pypi/badge.svg)](https://junglewise.ai/threats/vendors/pypi)
<a href="https://junglewise.ai/threats/vendors/pypi"><img src="https://junglewise.ai/threats/vendors/pypi/badge.svg" alt="PyPI package vulnerabilities" /></a>

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/vendors/pypi.json, and this page as text at https://junglewise.ai/threats/vendors/pypi.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "PyPI package vulnerabilities", https://junglewise.ai/threats/vendors/pypi, 13 November 2026.