Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-32359An RBAC authorization risk in Carina v0.13.0 and earlier allows local attackers to execute arbitrary code through designed commands to obtaiGo · github.com/carina-io/carina
- CVE-2024-33394An issue in kubevirt kubevirt v1.2.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token comGo · kubevirt.io/kubevirt
- CVE-2024-33396An issue in karmada-io karmada v1.9.0 and before allows a local attacker to execute arbitrary code via a crafted command to get the token…Go · github.com/karmada-io/karmada
- CVE-2024-32967Zitadel exposes internal database user name and host informationGo · github.com/zitadel/zitadel · fixed in 2.50.3, 2.49.5, 2.48.5 and more
- CVE-2024-32963Parameter Tampering vulnerability in NavidromeGo · github.com/navidrome/navidrome · fixed in 0.52.0
- CVE-2024-33522Privilege escalation in Calico CNI install binaryGo · github.com/projectcalico/calico, github.com/projectcalico/calico/v3 · fixed in 3.26.5, 3.27.3
- CVE-2023-46565Buffer Overflow vulnerability in osrg gobgp commit 419c50dfac578daa4d11256904d0dc182f1a9b22 allows a remote attacker to cause a denial of seGo · github.com/osrg/gobgp/v3 · fixed in 3.20.0
- CVE-2024-32883MCUboot Injection attack of unprotected TLV valuesGo · github.com/mcu-tools/mcuboot
- CVE-2024-32476Denial of Service via malicious jqPathExpressions in ignoreDifferencesGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.10.8, 2.9.13, 2.8.17
- CVE-2024-4198Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authentiGo · github.com/mattermost/mattermost-server · fixed in 8.1.12+incompatible, 9.5.3+incompatible, 9.6.1+incompatible and more
- CVE-2024-4195Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes, which allows an attacker authentGo · github.com/mattermost/mattermost-server · fixed in 9.5.3, 8.1.12, 8.1.12+incompatible and more
- CVE-2024-4183Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessiGo · github.com/mattermost/mattermost-server · fixed in 8.1.12+incompatible, 9.4.5+incompatible, 9.5.3+incompatible and more
- CVE-2024-4182Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom statGo · github.com/mattermost/mattermost-server · fixed in 8.1.12+incompatible, 9.4.5+incompatible, 9.5.3+incompatible and more
- CVE-2024-32046Detailed error discloses full file path with dev mode offGo · github.com/mattermost/mattermost-server · fixed in 8.1.12, 9.5.3, 9.6.1 and more
- CVE-2024-22091Excessive resource consumption due to lack to request path size limitsGo · github.com/mattermost/mattermost-server · fixed in 8.1.12+incompatible, 9.5.3+incompatible, 9.6.1+incompatible and more
- CVE-2024-3154Cri-o: arbitrary command injection via pod annotationGo · github.com/cri-o/cri-o · fixed in 1.29.4, 1.28.6, 1.27.6
- CVE-2024-32868ZITADEL's Improper Lockout Mechanism Leads to MFA BypassGo · github.com/zitadel/zitadel · fixed in 2.50.0
- CVE-2024-1139Cluster-monitoring-operator: credentials leakGo · github.com/openshift/cluster-monitoring-operator
- CVE-2024-0874Coredns: cd bit response is cached and served laterGo · github.com/coredns/coredns · fixed in 1.11.2
- CVE-2024-32875Hugo doesn't escape markdown title in internal render hooksGo · github.com/gohugoio/hugo · fixed in 0.125.3
- CVE-2024-3177Bypassing mountable secrets policy imposed by the ServiceAccount admission pluginGo · k8s.io/kubernetes · fixed in 1.27.13, 1.29.4, 1.28.9
- CVE-2024-29217Apache Answer: XSS vulnerability when changing personal websiteGo · github.com/apache/incubator-answer · fixed in 1.3.0
- CVE-2024-31450Owncast vulnerable to arbitrary file deletion in emoji.go (GHSL-2023-277)Go · github.com/owncast/owncast · fixed in 0.1.3
- CVE-2024-29029memos vulnerable to an SSRF in /o/get/imageGo · github.com/usememos/memos · fixed in 0.22.0
- CVE-2024-29028memos vulnerable to an SSRF in /o/get/httpmetaGo · github.com/usememos/memos · fixed in 0.16.1
- CVE-2024-29030memos vulnerable to an SSRF in /api/resourceGo · github.com/usememos/memos · fixed in 0.22.0
- CVE-2024-32644Evmos' transaction execution not accounting for all state transition after interaction with precompilesGo · github.com/evmos/evmos, github.com/evmos/evmos/v10 +20 · fixed in 17.0.0
- CVE-2024-32473Moby IPv6 enabled on IPv4-only network interfacesGo · github.com/docker/docker · fixed in 26.0.2, 26.0.2+incompatible
- CVE-2024-302571Panel's password verification is suspected to have a timing attack vulnerabilityGo · github.com/1panel-dev/1panel · fixed in 1.10.3
- CVE-2024-3817HashiCorp go-getter Vulnerable to Argument Injection When Fetching Remote Default Git BranchesGo · github.com/hashicorp/go-getter · fixed in 1.7.4