CVE Tools
Track your stack

PyPI

4,514 CVEs across 196 months on the top 200 list since Apr 2000. Peak rank #2 in May 2021. 7 of them are now in CISA KEV.

PyPI CVEs per month since Apr 2000

Oct 2021 to Sep 2026 in the lens. Point at a month to read it, or drag the frame to move through the record.Tallest in the lens: 166, Mar 2025
Oct 2021: 29 CVEs · 8 critical · 0 now in CISA KEV · rank #27 · mostly Cobbler, Onionshare-cli, Apache-supersetNov 2021: 56 CVEs · 2 critical · 0 now in CISA KEV · rank #9 · mostly Tensorflow-cpu, Tensorflow-gpu, TensorflowDec 2021: 26 CVEs · 2 critical · 0 now in CISA KEV · rank #27 · mostly Numpy, Pyo, LxmlJan 2022: 40 CVEs · 3 critical · 0 now in CISA KEV · rank #26 · mostly Onionshare-cli, Calibreweb, PillowFeb 2022: 75 CVEs · 0 critical · 0 now in CISA KEV · rank #13 · mostly Tensorflow, Tensorflow-cpu, Tensorflow-gpuMar 2022: 54 CVEs · 7 critical · 0 now in CISA KEV · rank #16 · mostly Salt, Freetakserver-ui, AnsibleApr 2022: 14 CVEs · 5 critical · 0 now in CISA KEV · rank #57 · mostly Vyper, Django, HttpxMay 2022: 45 CVEs · 6 critical · 0 now in CISA KEV · rank #17 · mostly Tensorflow-gpu, Tensorflow, Tensorflow-cpuJun 2022: 37 CVEs · 16 critical · 0 now in CISA KEV · rank #23 · mostly Inventree, Oauthenticator, PerdidoJul 2022: 34 CVEs · 12 critical · 1 now in CISA KEV · rank #26 · mostly PyPI, Ujson, UntangleAug 2022: 26 CVEs · 2 critical · 0 now in CISA KEV · rank #34 · mostly Ansible-runner, Octoprint, AsyncuaSep 2022: 114 CVEs · 4 critical · 0 now in CISA KEV · rank #5 · mostly Tensorflow, Tensorflow-cpu, Tensorflow-gpuOct 2022: 31 CVEs · 9 critical · 0 now in CISA KEV · rank #36 · mostly Rdiffweb, Twisted, Powerline-gitstatusNov 2022: 59 CVEs · 6 critical · 0 now in CISA KEV · rank #13 · mostly Tensorflow, Tensorflow-gpu, Tensorflow-cpuDec 2022: 42 CVEs · 7 critical · 0 now in CISA KEV · rank #26 · mostly Rdiffweb, Graphite-web, Tensorflow-gpuJan 2023: 38 CVEs · 3 critical · 0 now in CISA KEV · rank #19 · mostly Pyload-ng, Apache-superset, ModoboaFeb 2023: 34 CVEs · 4 critical · 0 now in CISA KEV · rank #25 · mostly Modoboa, Markdown-it-py, Apache-airflow-providers-googleMar 2023: not on the top 200 that monthApr 2023: 34 CVEs · 6 critical · 1 now in CISA KEV · rank #24 · mostly Apache-superset, Modoboa, WagtailMay 2023: 31 CVEs · 5 critical · 0 now in CISA KEV · rank #24 · mostly Vyper, Mlflow, Matrix-synapseJun 2023: 30 CVEs · 3 critical · 0 now in CISA KEV · rank #30 · mostly Pypdf2, Grpcio, LangchainJul 2023: 46 CVEs · 7 critical · 0 now in CISA KEV · rank #17 · mostly Paddlepaddle, Apache-airflow, Ethyca-fidesAug 2023: 47 CVEs · 12 critical · 0 now in CISA KEV · rank #17 · mostly Langchain, Apache-airflow, GitpythonSep 2023: 47 CVEs · 4 critical · 1 now in CISA KEV · rank #16 · mostly Apache-superset, Vyper, ZopeOct 2023: 53 CVEs · 2 critical · 0 now in CISA KEV · rank #17 · mostly Apache-airflow, Vantage6, Urllib3Nov 2023: 54 CVEs · 10 critical · 0 now in CISA KEV · rank #13 · mostly Apache-superset, Aiohttp, RayDec 2023: 52 CVEs · 5 critical · 0 now in CISA KEV · rank #13 · mostly Mlflow, Apache-airflow, Apache-supersetJan 2024: 77 CVEs · 14 critical · 0 now in CISA KEV · rank #11 · mostly Paddlepaddle, Pyload-ng, Whoogle-searchFeb 2024: 66 CVEs · 12 critical · 0 now in CISA KEV · rank #16 · mostly Vyper, Apache-superset, ClearmlMar 2024: 48 CVEs · 6 critical · 0 now in CISA KEV · rank #20 · mostly Gradio, Paddlepaddle, Apache-airflowApr 2024: 66 CVEs · 12 critical · 0 now in CISA KEV · rank #18 · mostly Mlflow, Vyper, ScrapyMay 2024: 65 CVEs · 6 critical · 0 now in CISA KEV · rank #22 · mostly Ryu, Ait-core, ScrapyJun 2024: 83 CVEs · 15 critical · 0 now in CISA KEV · rank #11 · mostly Mlflow, Lollms, ZenmlJul 2024: 59 CVEs · 3 critical · 0 now in CISA KEV · rank #17 · mostly Django, Anki, RoundupAug 2024: 40 CVEs · 1 critical · 0 now in CISA KEV · rank #22 · mostly Mage-ai, Django, CkanSep 2024: 53 CVEs · 8 critical · 0 now in CISA KEV · rank #13 · mostly Mindsdb, Micropython-copy, Micropython-ioOct 2024: 45 CVEs · 8 critical · 0 now in CISA KEV · rank #20 · mostly Gradio, Lollms, Open-webuiNov 2024: 51 CVEs · 5 critical · 0 now in CISA KEV · rank #15 · mostly Calibreweb, Transformers, AiohttpDec 2024: 32 CVEs · 5 critical · 0 now in CISA KEV · rank #24 · mostly Matrix-synapse, Apache-superset, DjangoJan 2025: 23 CVEs · 2 critical · 0 now in CISA KEV · rank #34 · mostly Snowflake-connector-python, Asteval, VyperFeb 2025: 25 CVEs · 6 critical · 0 now in CISA KEV · rank #28 · mostly Mobsf, Vyper, Label-studioMar 2025: 166 CVEs · 33 critical · 0 now in CISA KEV · rank #5 · mostly Open-webui, Aim, H2OApr 2025: 36 CVEs · 11 critical · 1 now in CISA KEV · rank #23 · mostly Vllm, Picklescan, LangflowMay 2025: 47 CVEs · 5 critical · 0 now in CISA KEV · rank #21 · mostly Vllm, Langroid, VyperJun 2025: 47 CVEs · 6 critical · 0 now in CISA KEV · rank #22 · mostly Salt, Backend.ai, Langchain-chatchatJul 2025: 51 CVEs · 5 critical · 0 now in CISA KEV · rank #26 · mostly Transformers, Pyload-ng, OpenexrAug 2025: 75 CVEs · 9 critical · 0 now in CISA KEV · rank #12 · mostly Picklescan, Executorch, Apache-supersetSep 2025: 57 CVEs · 4 critical · 0 now in CISA KEV · rank #17 · mostly Picklescan, Ethyca-fides, Ml-loggerOct 2025: 70 CVEs · 10 critical · 0 now in CISA KEV · rank #14 · mostly Keras, Bbot, FastmcpNov 2025: 47 CVEs · 4 critical · 0 now in CISA KEV · rank #13 · mostly Pgadmin4, Trytond, VllmDec 2025: 74 CVEs · 8 critical · 1 now in CISA KEV · rank #13 · mostly Picklescan, Weblate, Mcp-server-gitJan 2026: 98 CVEs · 6 critical · 0 now in CISA KEV · rank #7 · mostly Aiohttp, Fickling, VllmFeb 2026: 126 CVEs · 20 critical · 0 now in CISA KEV · rank #4 · mostly Rucio-webui, Pypdf, DjangoMar 2026: 94 CVEs · 6 critical · 0 now in CISA KEV · rank #9 · mostly Glances, Openssl-encrypt, JusthtmlApr 2026: 59 CVEs · 0 critical · 0 now in CISA KEV · rank #14 · mostly Praisonai, Praisonaiagents, Openssl-encryptMay 2026: 37 CVEs · 0 critical · 0 now in CISA KEV · rank #31 · mostly Stigmem-node, Wger, EdumfaJun 2026: 98 CVEs · 0 critical · 0 now in CISA KEV · rank #9 · mostly Praisonai, Praisonaiagents, PicklescanJul 2026: 33 CVEs · 0 critical · 0 now in CISA KEV · rank #29 · mostly Gitpython, Jupyterlab, Mcp-atlassianAug 2026: 56 CVEs · 0 critical · 0 now in CISA KEV · rank #19 · mostly Nltk, Gitpython, WagtailSep 2026 so far: 6 CVEs · 0 critical · 0 now in CISA KEV · rank #193 · mostly Djust, Tornado, Mlflow

In the lens

The products that kept showing up in PyPI's monthly top three from Oct 2021 to Sep 2026. Move the lens and the list follows.

  1. Tensorflow2015 months
  2. Tensorflow-gpu2006 months
  3. Tensorflow-cpu1985 months
  4. Picklescan625 months
  5. Apache-superset459 months
  6. Praisonai352 months
  7. Mlflow345 months
  8. Vyper318 months
  9. Paddlepaddle293 months
  10. Nltk241 month

Year by year

Each year's months on the top 200 list. Pick a year to read it in the lens.

The record

Peak rank
#2 in May 2021
Busiest month
Mar 2025, 166 CVEs
Months with a KEV entry
6 of 196 on the list
On the top 200 list
196 of 318 monthly snapshots

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store