PyPI packages — vulnerability index
These pages aggregate every CVE that affects a given PyPI package, sourced from NVD's CPE matching.
About these pages
Each entry below links to the full CVE history for that PyPI package: severity, CVSS, KEV flag, summary, and the original NVD record. Counts update as new advisories land — typically within hours of publication. The catalog is curated and bounded to high-impact Python libraries with verified CPE mappings; expansion to Maven / crates / Go-modules follows the same shape as the existing npm and PyPI wedges.
All packages (49)
| Package | CVEs | KEV | Highest CVSS | Latest disclosed |
|---|---|---|---|---|
| TensorFlow | 434 | — | 9.8 | 2026-02-20 |
| Django | 159 | — | 9.8 | 2026-07-07 |
| Apache Airflow | 144 | 2 | 9.8 | 2026-07-07 |
| MLflow | 79 | — | 10.0 | 2026-07-02 |
| Pillow | 73 | — | 9.8 | 2026-07-14 |
| Salt | 66 | 3 | 9.8 | 2026-01-30 |
| Ansible | 64 | — | 9.8 | 2024-02-06 |
| aiohttp | 43 | — | 9.1 | 2026-06-22 |
| PyTorch | 32 | — | 9.8 | 2026-03-22 |
| Transformers | 30 | — | 9.6 | 2026-06-03 |
| urllib3 | 19 | — | 9.8 | 2026-05-13 |
| jupyter-server | 15 | — | 8.8 | 2026-06-22 |
| Twisted | 14 | — | 9.8 | 2026-05-13 |
| Werkzeug | 14 | — | 9.8 | 2026-02-21 |
| Tornado | 13 | — | 7.7 | 2026-07-14 |
| pip | 13 | — | 7.8 | 2026-06-01 |
| Starlette | 11 | — | 7.5 | 2026-06-22 |
| cryptography | 11 | — | 9.8 | 2026-04-08 |
| PyJWT | 10 | — | 7.5 | 2026-05-28 |
| JupyterLab | 8 | — | 9.6 | 2026-05-13 |
| NumPy | 8 | — | 9.8 | 2021-12-17 |
| Requests | 8 | — | 7.5 | 2026-03-25 |
| JupyterHub | 7 | — | 8.1 | 2026-05-22 |
| Ray | 7 | — | 9.8 | 2026-07-01 |
| lxml | 7 | — | 8.2 | 2026-04-24 |
| Paramiko | 6 | — | 9.8 | 2026-05-06 |
| Poetry | 5 | — | 9.8 | 2026-04-24 |
| Bottle | 4 | — | 9.8 | 2022-06-02 |
| Flask | 4 | — | 7.5 | 2026-02-21 |
| Jinja2 | 4 | — | 9.8 | 2021-02-01 |
| PyCrypto | 4 | — | 9.8 | 2018-02-03 |
| setuptools | 4 | — | 8.8 | 2026-07-08 |
| Dulwich | 3 | — | 9.8 | 2017-10-29 |
| Pydantic | 3 | — | 5.9 | 2026-07-06 |
| SQLAlchemy | 3 | — | 9.8 | 2019-02-20 |
| SciPy | 3 | — | 9.8 | 2023-07-06 |
| Celery | 2 | — | 7.5 | 2021-12-29 |
| CherryPy | 2 | — | — | 2008-01-12 |
| FastAPI | 2 | — | 8.2 | 2024-02-05 |
| PyYAML | 2 | — | 9.8 | 2021-02-09 |
| Sanic | 2 | — | 8.3 | 2022-08-01 |
| virtualenv | 2 | — | 4.5 | 2026-01-10 |
| Matplotlib | 1 | — | 5.6 | 2025-06-26 |
| OAuthLib | 1 | — | 5.7 | 2022-09-09 |
| PyMongo | 1 | — | 4.7 | 2024-06-05 |
| Pyramid | 1 | — | 4.3 | 2023-08-25 |
| marshmallow | 1 | — | 5.3 | 2025-12-22 |
| pytest | 1 | — | 6.8 | 2026-01-22 |
| wheel | 1 | — | 7.1 | 2026-01-22 |