12 Total advisories
12 Vulnerabilities
0 Malware
Dependency scanning
Check whether uv is in your codebase
Corgea flags malicious and compromised dependencies with reachability analysis, so you fix the packages that actually run in your application instead of working through the whole lockfile.
Vulnerabilities
UNKNOWN
CVE-2026-114110
uv vulnerable to arbitrary file deletion through RECORD entries
MEDIUM 5.3
GHSA-m3wx-qqmx-qxvf
Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
UNKNOWN
CVE-2026-114109
uv is vulnerable to arbitrary file write through entry point names
UNKNOWN
PYSEC-2026-4321
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
UNKNOWN
GHSA-hq85-5cpj-mr62
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
UNKNOWN
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction
UNKNOWN
CVE-2026-104843
uv: Path traversal on Windows through wheel extraction
MEDIUM 6.3
CVE-2025-13327
CVE-2025-13327
UNKNOWN
CVE-2025-13327
uv allows ZIP payload obfuscation through parsing differentials
UNKNOWN
CVE-2025-54368
uv allows ZIP payload obfuscation through parsing differentials
UNKNOWN
CVE-2025-54368
uv allows ZIP payload obfuscation through parsing differentials
UNKNOWN
GHSA-w476-p2h3-79g9
uv has differential in tar extraction with PAX headers
Browse more PyPI advisories
Learn What is SAST?
Static Application Security Testing finds vulnerabilities like this one in source code before it ships. Read the guide →
Ready to move
Start Securing
Free, no credit card | First findings in minutes