CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 20/10/2026 |
| GHSA-hq85-5cpj-mr62 | CRITICAL | uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised | 20/10/2026 |
| CVE-2026-104843 | MEDIUM5.9 | uv is a Python package and project manager written in Rust. From 0.12.7 until 0.12.18, uv wheel extraction on Windows can process a malicious wheel in a way that writes a file outside the installation prefix, including an executable in a directory already present on the user's PATH. Non-Windows hosts are not affected. | 02/10/2026 |
| CVE-2025-13327 | MEDIUM6.3 | A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package. | 27/02/2026 |
| GHSA-w476-p2h3-79g9 | LOW | uv has differential in tar extraction with PAX headers | 21/10/2025 |
| CVE-2025-54368 | MEDIUM6.8 | uv is a Python package and project manager written in Rust. In versions 0.8.5 and earlier, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. An attacker could contrive a ZIP archive that would extract with legitimate contents on some | 08/08/2025 |