Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-47003DoS via non-string message using permalink embedGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.0.0-20240806094731-69a8b3df0f9f
- CVE-2024-0133NVIDIA Container Toolkit 1.16.1 or earlier contains a vulnerability in the default mode of operation allowing a specially crafted container Go · github.com/nvidia/nvidia-container-toolkit · fixed in 1.16.2
- CVE-2024-0132NVIDIA Container Toolkit 1.16.1 or earlier contains a Time-of-check Time-of-Use (TOCTOU) vulnerability when used with default configuration Go · github.com/nvidia/nvidia-container-toolkit · fixed in 1.16.2
- CVE-2024-8996Grafana Agent Flow on Windows Unquoted service pathGo · github.com/grafana/agent · fixed in 0.43.3
- CVE-2024-8975Grafana Alloy on Windows Unquoted service pathGo · github.com/grafana/alloy · fixed in 1.3.4, 1.4.1
- CVE-2024-40761Apache Answer: Avatar URL leaked user email addressesGo · github.com/apache/incubator-answer · fixed in 1.4.0
- CVE-2024-46957Mellium mellium.im/xmpp 0.0.1 through 0.21.4 allows response spoofing if the implementation uses predictable IDs because the stanza type is Go · mellium.im/xmpp · fixed in 0.22.0
- CVE-2024-47218An issue was discovered in vesoft NebulaGraph through 3.8.0.Go · github.com/vesoft-inc/nebula
- CVE-2024-47219An issue was discovered in vesoft NebulaGraph through 3.8.0.Go · github.com/vesoft-inc/nebula
- CVE-2024-47062Multiple SQL Injections and ORM Leak in navidromeGo · github.com/navidrome/navidrome · fixed in 0.53.0
- CVE-2024-46999User Grant Deactivation not Working in ZitadelGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 2.62.1, 2.61.1, 2.60.2 and more
- CVE-2024-47000Service Users Deactivation not Working in ZitadelGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 2.62.1, 2.61.1, 2.60.2 and more
- CVE-2024-47060Unauthorized Access After Organization or Project Deactivation in ZitadelGo · github.com/zitadel/zitadel, github.com/zitadel/zitadel/v2 · fixed in 2.62.1, 2.61.1, 2.60.2 and more
- CVE-2023-27584Dragonfly2 vulnerable to hard coded cyptographic keyGo · d7y.io/dragonfly/v2 · fixed in 2.1.0-beta.1, 2.0.9-rc.2
- CVE-2024-45410HTTP client can remove the X-Forwarded headers in TraefikGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.9, 3.1.3
- CVE-2024-8986Information Leakage in grafana-plugin-sdk-goGo · github.com/grafana/grafana-plugin-sdk-go · fixed in 0.250.0
- CVE-2024-46989Multiple caveats on resources of the same type can result in no permission when permission is expectedGo · github.com/authzed/spicedb · fixed in 1.35.3
- CVE-2023-28452An issue was discovered in CoreDNS through 1.10.1.Go · github.com/coredns/coredns · fixed in 1.11.0
- CVE-2023-30464CoreDNS through 1.10.1 enables attackers to achieve DNS cache poisoning and inject fake responses via a birthday attack.Go · github.com/coredns/coredns · fixed in 1.11.0
- CVE-2023-47105exec.CommandContext in Chaosblade 0.3 through 1.7.3, when server mode is used, allows OS command execution via the cmd parameter without autGo · github.com/chaosblade-io/chaosblade · fixed in 1.7.4
- CVE-2024-45496Openshift-controller-manager: elevated build pods can lead to node compromise in openshiftGo · github.com/openshift/openshift-controller-manager · fixed in 0.0.0-alpha.0.0.20240911
- CVE-2024-7387Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategyGo · github.com/openshift/builder
- CVE-2024-45041External Secrets Operator vulnerable to privilege escalationGo · github.com/external-secrets/external-secrets · fixed in 0.10.2
- CVE-2024-8572Gouniverse GoLang CMS FrontendHandler.go PageRenderHtmlByAlias cross site scriptingGo · github.com/gouniverse/cms · fixed in 1.4.1
- CVE-2024-34158Stack exhaustion in Parse in go/build/constraintGo · stdlib · fixed in 1.22.7, 1.23.1
- CVE-2024-34156Stack exhaustion in Decoder.Decode in encoding/gobGo · stdlib · fixed in 1.22.7, 1.23.1
- CVE-2024-34155Stack exhaustion in all Parse functions in go/parserGo · stdlib · fixed in 1.22.7, 1.23.1
- CVE-2024-45039gnark's Groth16 commitment extension unsound for more than one commitmentGo · github.com/consensys/gnark · fixed in 0.11.0
- CVE-2024-45040gnark's commitments to private witnesses in Groth16 as implemented break zero-knowledge propertyGo · github.com/consensys/gnark · fixed in 0.11.0
- CVE-2024-45401stripe-cli Path Traversal vulnerabilityGo · github.com/stripe/stripe-cli · fixed in 1.21.3