pip-audit resolves the dependency tree and checks every package against PyPI's advisory database, reporting the CVE and the version that fixes it. Maintained by the Python Packaging Authority, which is what makes it the default choice over the alternatives.

It addresses OWASP A06: Vulnerable and Outdated Components — the category that needs no exploit skill at all, because the vulnerability arrives through a requirements.txt line nobody re-read.

• CI gate that fails on a known-vulnerable dependency
• Auditing a requirements.txt inherited with a project
• Producing the evidence trail for a dependency upgrade