numpy (PyPI)
The fundamental package for scientific computing with Python.
Advisories
17
Latest version
2.5.4
Released Oct 10, 2026
License
0BSD AND BSD-3-Clause AND CC0-1.0 AND MIT AND Zlib
OpenSSF Scorecard
7.6 / 10
How to fix
Upgrading to 1.22 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "numpy>=2.5.4"poetry
poetry add "numpy>=2.5.4"uv
uv add "numpy>=2.5.4"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-f7c7-j99h-c22f Buffer Copy without Checking Size of Input in NumPy |
Medium EPSS 0.40% |
< 1.19.0 | 1.19.0 |
| GHSA-5545-2q6w-2gh6 NumPy NULL Pointer Dereference |
High EPSS 1.24% |
< 1.19 | 1.19 |
| GHSA-5545-2q6w-2gh6 NumPy NULL Pointer Dereference |
High EPSS 1.24% |
< 1.19.1 | 1.19.1 |
| GHSA-f7c7-j99h-c22f Buffer Copy without Checking Size of Input in NumPy |
Medium EPSS 0.40% |
< 1.19 | 1.19 |
| GHSA-fpfv-jqm9-f5jm Incorrect Comparison in NumPy |
Medium EPSS 1.68% |
< 1.22 | 1.22 |
| GHSA-fpfv-jqm9-f5jm Incorrect Comparison in NumPy |
Medium EPSS 1.68% |
>= 1.9.0, < 1.10.0 | 1.10.0 |
| GHSA-6p56-wp2h-9hxr NumPy Buffer Overflow (Disputed) |
Medium EPSS 1.16% |
>= 1.9.0, < 1.10.0 | 1.10.0 |
| GHSA-6p56-wp2h-9hxr NumPy Buffer Overflow (Disputed) |
Medium EPSS 1.16% |
>= 1.9.0, < 1.21 | 1.21 |
| GHSA-9fq2-x9r6-wfmf Numpy Deserialization of Untrusted Data |
Critical EPSS 17.53% |
< 1.16.1 | 1.16.1 |
| GHSA-9fq2-x9r6-wfmf Numpy Deserialization of Untrusted Data |
Critical EPSS 17.53% |
< 1.16.3 | 1.16.3 |
| PYSEC-2019-38 ** DISPUTED ** An issue was discovered in NumPy 1.16.0 and earlier. Withdrawn |
Not rated yet | < 1.16.1 | 1.16.1 |
| GHSA-cw6w-4rcx-xphc Arbitrary file write in NumPy |
Medium EPSS 0.45% |
< 1.8.1 | 1.8.1 |
| GHSA-2fc2-6r4j-p65h Numpy arbitrary file write via symlink attack |
Medium EPSS 0.47% |
< 1.8.1 | 1.8.1 |
| GHSA-2fc2-6r4j-p65h Numpy arbitrary file write via symlink attack |
Medium EPSS 0.47% |
< 1.8.1 | 1.8.1 |
| GHSA-cw6w-4rcx-xphc Arbitrary file write in NumPy |
Medium EPSS 0.45% |
< 1.8.1 | 1.8.1 |
| GHSA-frgw-fgh6-9g52 Numpy missing input validation |
High EPSS 2.74% |
< 1.13.3 | 1.13.3 |
| GHSA-frgw-fgh6-9g52 Numpy missing input validation |
High EPSS 2.74% |
< 1.13.3 | 1.13.3 |
Source: https://github.com/numpy/numpy
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor