Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-38351Password auth and OAuth2 unverified email linkingGo · github.com/pocketbase/pocketbase · fixed in 0.22.14
- CVE-2024-5899Improper trust check in Bazel Build intellij pluginGo · github.com/bazelbuild/intellij
- CVE-2024-37896SQL injection vulnerability in Gin-vue-adminGo · github.com/flipped-aurora/gin-vue-admin · fixed in 2.6.6+incompatible
- CVE-2024-37159Evmos is missing create validator checkGo · github.com/evmos/evmos, github.com/evmos/evmos/v10 +16 · fixed in 18.0.0
- CVE-2024-37158Evmos is missing precompile checksGo · github.com/evmos/evmos, github.com/evmos/evmos/v10 +16 · fixed in 18.0.0
- CVE-2024-37307Cilium leaks sensitive information in cilium-bugtoolGo · github.com/cilium/cilium · fixed in 1.13.17, 1.14.12, 1.15.6
- CVE-2024-36586An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary.Go · github.com/adguardteam/adguardhome
- CVE-2024-5798Vault Incorrectly Validated JSON Web Tokens (JWT) Audience ClaimsGo · github.com/hashicorp/vault · fixed in 1.17.0, 1.16.3, 1.15.9
- CVE-2024-5154Cri-o: malicious container can create symlink on hostGo · github.com/cri-o/cri-o · fixed in 1.28.7, 1.29.5, 1.30.1
- CVE-2023-49559An issue in vektah gqlparser open-source-library v.2.5.10 allows a remote attacker to cause a denial of service via a crafted script to the Go · github.com/vektah/gqlparser, github.com/vektah/gqlparser/v2 · fixed in 2.5.14
- CVE-2024-35255Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityGo · github.com/azure/azure-sdk-for-go/sdk/azidentity · fixed in 1.6.0-beta.4.0.20240610221955-50774cd97099, 1.6.0
- CVE-2024-22261SQL Injection in Harbor scan log APIGo · github.com/goharbor/harbor · fixed in 2.8.6, 2.9.4, 2.10.2 and more
- CVE-2024-22244Harbor Open Redirect URLGo · github.com/goharbor/harbor · fixed in 2.8.5+incompatible, 2.9.3+incompatible, 2.10.1+incompatible and more
- CVE-2024-37154Evmos allows unvested token delegationsGo · github.com/evmos/evmos, github.com/evmos/evmos/v10 +16
- CVE-2024-37153Evmos's contract balance not updating correctly after interchain transactionGo · github.com/evmos/evmos, github.com/evmos/evmos/v10 +16 · fixed in 18.1.0
- CVE-2024-32873evmos allows transferring unvested tokens after delegationsGo · github.com/evmos/evmos, github.com/evmos/evmos/v10 +16 · fixed in 18.0.0
- CVE-2024-37152Unauthenticated Access to sensitive settings in Argo CDGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 +1 · fixed in 2.9.17, 2.10.12, 2.11.3
- CVE-2024-36106Argo CD allows authenticated users to enumerate clusters by nameGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.9.17, 2.10.12, 2.11.3
- CVE-2024-5037Openshift/telemeter: iss check during jwt authentication can be bypassedGo · github.com/openshift/telemeter
- CVE-2024-36129OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPCGo · go.opentelemetry.io/collector/config/configgrpc, go.opentelemetry.io/collector/config/confighttp · fixed in 0.102.1, 0.102.0
- CVE-2024-24789Mishandling of corrupt central directory record in archive/zipGo · stdlib · fixed in 1.21.11, 1.22.4
- CVE-2024-24790Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses in net/netipGo · stdlib · fixed in 1.21.11, 1.22.4
- CVE-2024-5262ProjectDiscovery Interactsh - Files or Directories Accessible to External PartiesGo · github.com/projectdiscovery/interactsh · fixed in 1.2.0
- CVE-2024-36127apko Exposure of HTTP basic auth credentials in log outputGo · chainguard.dev/apko · fixed in 0.14.5
- CVE-2024-5138The snapctl component within snapd allows a confined snap to interact with the snapd daemon to take certain privileged actions on behalf of Go · github.com/snapcore/snapd · fixed in 2.63.1, 0.0.0-20240524114846-68ee9c6aa916
- CVE-2024-37032Ollama before 0.1.34 does not validate the format of the digest (sha256 with 64 hex digits) when getting the model path, and thus mishandlesGo · github.com/ollama/ollama · fixed in 0.1.34
- CVE-2024-36107Information disclosure in minioGo · github.com/minio/minio · fixed in 0.0.0-20240527191746-e0fe7cc39172
- CVE-2024-35182GHSL-2024-014 Meshery SQL Injection vulnerabilityGo · github.com/layer5io/meshery · fixed in 0.7.22
- CVE-2024-35181GHSL-2024-013 Meshery SQL Injection vulnerabilityGo · github.com/layer5io/meshery · fixed in 0.7.22
- CVE-2024-35238Denial of service of Minder Server from maliciously crafted GitHub attestationsGo · github.com/stacklok/minder · fixed in 0.0.51