Loading...
Skip to main content
GeekWala
Python

PyPI Vulnerability Scanner

The Python Package Index hosts hundreds of thousands of packages for data science, web development, automation, and more.

Scan Your PyPI ProjectCreate Free Account

Scan your requirements.txt, Pipfile.lock, poetry.lock online

Free dependency vulnerability scan for PyPI — no signup required

Scan now

Common PyPI Risk Types

Python packages frequently see supply chain attacks (malicious typosquats) and serialization vulnerabilities. GeekWala's EPSS scoring shows which PyPI CVEs have working exploits in the wild.

Supply Chain / Typosquatting
Serialization Exploits
Code Injection

PyPI Security Guide

Python Dependency Security: PyPI Vulnerabilities

Python's dependency ecosystem makes security uniquely challenging — fragmented advisory databases, multiple manifest formats, and transitive dependency chains. Learn how to check your PyPI packages for vulnerabilities and build a practical security workflow.

Related PyPI reading

How to Scan PyPI Projects

GeekWala supports the following Python dependency files

Supported Files

  • requirements.txt
  • Pipfile.lock
  • poetry.lock

Scan Methods

  • Upload your lockfile
  • Paste file contents
  • Import from GitHub

What You Get

  • Exploitation-ranked results (not just CVSS)
  • CISA KEV: flag CVEs actively attacked right now
  • EPSS: 30-day exploit probability per CVE
  • Cross-ecosystem: cover your full stack in one scan

Compare & learn more

PyPI vs pip-auditWhat Is Dependency Vulnerability Scanning?
931
Total Indexed
915
Critical
18
Actively Exploited (KEV)
requires immediate attention
40
New This Month

See how results are ranked by exploitation risk — KEV-flagged CVEs first, with EPSS scores.

See a live example

18 Known Exploited Vulnerabilities

These vulnerabilities are actively being exploited in the wild. Scan your project to check if you're affected.

Recent PyPI Vulnerabilities

Latest security issues affecting Python packages

CRITICAL
GHSA-9mp3-24cc-77mg
PraisonAI: AICoder Arbitrary File Write and Command Execution via LLM Tool Calls
CRITICAL
GHSA-2xv2-w8cq-5gxw
PraisonAI: CodeAgent Executes LLM-Generated Code Without Sandboxing and Leaks Al…
CRITICAL
GHSA-w794-rj3p-xv45
Langflow: OS command injection (RCE) via arbitrary command in MCP stdio server c…
CRITICAL
GHSA-8qpj-27x8-pwpq
Langflow: PythonREPLComponent executes unsandboxed Python code, enabling authent…
CRITICAL
GHSA-cf6m-vc3m-7cgm
Langflow: Unauthenticated Flow Execution via Webhook Authentication Bypass
View all vulnerabilities

Most Affected PyPI Packages

Packages with the most known vulnerabilities

1
django
59 vulns
2
praisonai
47 vulns
3
langflow
27 vulns
4
openssl-encrypt
26 vulns
5
picklescan
21 vulns
6
mlflow
19 vulns
7
praisonaiagents
19 vulns
8
langroid
15 vulns
9
pyload-ng
14 vulns
10
litellm
12 vulns
11
praisonai-platform
12 vulns
12
crawl4ai
11 vulns
13
fickling
11 vulns
14
executorch
10 vulns
15
h2o
10 vulns
Browse all PyPI packages

Secure Your Python Dependencies

Scan your requirements.txt against OSV. Results are ranked by exploitation probability — CVEs under active attack appear first, so you fix what's actually being exploited, not just what scores highest.

Start Free ScanRead the Docs

Also scan for

npmPackagistMavenGo Modulescrates.ioRubyGemsNuGet
Data from OSV Database931+ PyPI vulnerabilities indexedUpdated daily