OSV - Open Source Vulnerabilities

GHSA-269j-37ww-cmh3

PyPI/mezzanine

Mezzanine CMS vulnerable to Cross-site Scripting

yesterday

No fix available
Severity - 4.8 (Medium)

GHSA-rrf6-pxg8-684g

PyPI/fastapi-guard

FastAPI Guard has a regex bypass

yesterday

Fix available
Severity - 7.8 (High)

GHSA-gmvv-rj92-9w35

PyPI/aim

Aim vulnerable to Cross-site Scripting

2 days ago

No fix available
Severity - 5.3 (Medium)

GHSA-h7x8-jv97-fvvm

PyPI/dagster

Dagster Local File Inclusion vulnerability

2 days ago

Fix available
Severity - 6.6 (Medium)

GHSA-xqpg-92fq-grfg

PyPI/pyload-ng

`pyLoad` has Path Traversal Vulnerability in `json/upload` Endpoint that allows Arbitrary File Write

3 days ago

Fix available
Severity - 7.5 (High)

PYSEC-2025-71

PyPI/cadwyn
github.com/zmievsa/cadwyn

See record for full details

3 days ago

Fix available

MAL-2025-6213

PyPI/donotinstallthisistest6

Malicious code in donotinstallthisistest6 (PyPI)

3 days ago

No fix available

GHSA-2c2j-9gv5-cj73

PyPI/starlette

Starlette has possible denial-of-service vector when parsing large files in multipart forms

3 days ago

Fix available
Severity - 5.3 (Medium)

GHSA-2gxp-6r36-m97r

PyPI/cadwyn

Cadwyn vulnerable to XSS on the docs page

3 days ago

Fix available
Severity - 7.6 (High)

MAL-2025-6010

PyPI/ruamel-poc

Malicious code in ruamel-poc (PyPI)

4 days ago

No fix available

MAL-2025-6007

PyPI/groq-mcp

Malicious code in groq-mcp (PyPI)

6 days ago

No fix available

GHSA-8w3f-4r8f-pf53

PyPI/pyload-ng

pyLoad vulnerable to XSS through insecure CAPTCHA

15 Jul

Fix available
Severity - 9.8 (Critical)

MAL-2025-5847

PyPI/vtk-osmesa

Malicious code in vtk-osmesa (PyPI)

14 Jul

No fix available

GHSA-9548-qrrj-x5pj

PyPI/aiohttp

AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

14 Jul

Fix available
Severity - 1.7 (Low)

GHSA-q28v-664f-q6wj

PyPI/indico

Indico vulnerability allows attackers to bulk dump user details

14 Jul

Fix available
Severity - 5.3 (Medium)

GHSA-x8c6-gj59-6rx8

PyPI/libp2p

py-libp2p is vulnerable to DoS attacks through use of large RSA keys

14 Jul

Fix available
Severity - 4.3 (Medium)