P
Vendor security profile3 actively exploited CVEs
pypi
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs726
Critical75
CISA KEV3
Public exploit286
Patch rate%57
Avg. CVSS7.1
12-month vulnerability rate
1
1
2
1
4
2
16
66
133
220
187
67
CVE KEV
CVE severity distribution
726toplam CVE
Critical75 (10%)
High327 (45%)
Medium285 (39%)
Low27 (4%)
Uncertain12 (2%)
Patch and exploitation view
%57
Verified patch
%0
CISA KEV
%39
Public exploit
408Patch available
5Partial
8Workaround
0Vendor: no patch
305Unknown
Latest vulnerabilities
6.9
CVE-2026-108258
Shiny for Python - Path traversal in bookmark restore
P
Patch status unknownEPSS %0
5.7
CVE-2026-107841
pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents
J
Patch status unknownEPSS %0
5.3
CVE-2026-75597
pyLoad: Unauthenticated access to /web/<path:filename> bypasses authentication on sensitive templates and leaks internal error details via exception attribute typo
P
Patch status unknownEPSS %0
6.5
CVE-2026-48484
pyLoad: Lack of Input Size Validation Leads to Denial of Service (DoS) and Process Termination
P
Patch status unknownEPSS %0
7.5
CVE-2026-107728
Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy
S
Patch status unknownEPSS %0
3.7
CVE-2026-107727
Strawberry legacy graphql-ws retains naturally completed subscription slots
S
Patch status unknownEPSS %0
6.5
CVE-2026-107717
Banks: User-controlled prompt input can be parsed as privileged chat messages
M
Patch status unknownEPSS %0
7.3
CVE-2026-107716
Banks: Symlink traversal and arbitrary file disclosure/overwrite in DirectoryPromptRegistry
M
Patch status unknownEPSS %0
4.4
CVE-2026-107397
Indico: Cross-Site-Scripting in minutes editor
I
Patch status unknownEPSS %0
5.4
CVE-2026-107396
Indico: Cross-Site-Scripting in link fields
I
Patch status unknownEPSS %0