PyPI package vulnerabilities, version by version

Packages we track

Versions with real downloads and at least one finding, as of Oct 14, 2026. Open a package or version for today’s data.

• django10.4M downloads a week
  • 5.1.158 known vulnerabilities, end of life
  • 5.0.1412 known vulnerabilities, end of life
  • 4.2.308 known vulnerabilities, end of life
• requests310.9M downloads a week
  • 2.32.51 known vulnerability
  • 2.31.03 known vulnerabilities
  • 2.30.04 known vulnerabilities
• flask42.5M downloads a week
  • 3.0.31 known vulnerability
  • 2.3.31 known vulnerability
  • 2.2.51 known vulnerability
• urllib3336.8M downloads a week
  • 2.7.03 known vulnerabilities
  • 2.6.35 known vulnerabilities
  • 2.5.06 known vulnerabilities
• jinja2145.8M downloads a week
  • 3.0.35 known vulnerabilities
  • 2.11.34 known vulnerabilities
  • 2.10.35 known vulnerabilities
• werkzeug56.7M downloads a week
  • 3.0.64 known vulnerabilities
  • 2.3.87 known vulnerabilities
  • 2.2.38 known vulnerabilities
• pillow149.8M downloads a week
  • 12.2.013 known vulnerabilities
  • 12.1.118 known vulnerabilities
  • 12.0.019 known vulnerabilities
• cryptography282.4M downloads a week
  • 49.0.01 known vulnerability
  • 48.0.13 known vulnerabilities
  • 47.0.04 known vulnerabilities
• starlette136.5M downloads a week
  • 1.2.12 known vulnerabilities
  • 1.1.02 known vulnerabilities
• aiohttp117.7M downloads a week
  • 3.13.514 known vulnerabilities
  • 3.12.1532 known vulnerabilities
  • 3.11.1833 known vulnerabilities
• pyyaml244.2M downloads a week
  • 5.3.11 known vulnerability
  • 5.2.02 known vulnerabilities
  • 5.1.23 known vulnerabilities
• sqlalchemy85.3M downloads a week
  • 1.2.191 known vulnerability
  • 1.1.182 known vulnerabilities
  • 1.0.192 known vulnerabilities
• setuptools225.9M downloads a week
  • 82.0.11 known vulnerability
  • 81.0.01 known vulnerability
  • 80.10.21 known vulnerability
• idna348.6M downloads a week
  • 3.14.01 known vulnerability
  • 3.13.01 known vulnerability
• tornado24.5M downloads a week
  • 6.4.215 known vulnerabilities
  • 6.3.318 known vulnerabilities
  • 6.2.020 known vulnerabilities
• paramiko24.6M downloads a week
  • 4.0.01 known vulnerability
  • 3.5.11 known vulnerability
  • 3.4.11 known vulnerability
• lxml90.9M downloads a week
  • 6.0.41 known vulnerability
  • 5.4.01 known vulnerability
  • 5.3.21 known vulnerability
• torch13M downloads a week
  • 2.12.11 known vulnerability
  • 2.11.01 known vulnerability
  • 2.10.02 known vulnerabilities
• langchain35.5M downloads a week
  • 1.2.181 known vulnerability
  • 1.1.31 known vulnerability
  • 1.0.81 known vulnerability

How these pages work

Each version page asks OSV.dev which advisories affect exactly that release, merges duplicates, ranks them by CISA’s Known Exploited Vulnerabilities list and FIRST EPSS, and checks which newer release actually has none. Nothing on them is written by AI. To check every dependency at once, check your whole repo.