uv has 7 CVEs on record between 2025 and 2026. 3 were published in the last 90 days. The busiest recent month was October 2026 with 3. The median CVSS is 5.3 (medium), with 1 rated critical. None have a confirmed exploitation report.
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 0
Worst active — by depth score
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised52GHSA-m3wx-qqmx-qxvfHigh· 5.3Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries29CVE-2026-114110Low· 5.3uv vulnerable to arbitrary file deletion through RECORD entries29CVE-2025-13327Mediumuv allows ZIP payload obfuscation through parsing differentials28CVE-2025-54368Mediumuv allows ZIP payload obfuscation through parsing differentials28
uv vulnerabilities
CVEs affecting uv, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
GHSA-m3wx-qqmx-qxvfHigh· 5.3Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
Duplicate Advisory: uv vulnerable to arbitrary file deletion through RECORD entries
PYSEC-2026-4321Noneuv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
GHSA-hq85-5cpj-mr62Criticaluv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
CVE-2026-114110Low· 5.3uv vulnerable to arbitrary file deletion through RECORD entries
uv vulnerable to arbitrary file deletion through RECORD entries
GHSA-pjjw-68hj-v9mwLowuv vulnerable to arbitrary file deletion through RECORD entries
uv vulnerable to arbitrary file deletion through RECORD entries
CVE-2025-13327Mediumuv allows ZIP payload obfuscation through parsing differentials
uv allows ZIP payload obfuscation through parsing differentials
CVE-2025-54368Mediumuv allows ZIP payload obfuscation through parsing differentials
uv allows ZIP payload obfuscation through parsing differentials