Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-31452OpenFGA Authorization BypassGo · github.com/openfga/openfga · fixed in 1.5.3
- CVE-2024-31990Argo CD' API server does not enforce project sourceNamespacesGo · github.com/argoproj/argo-cd, github.com/argoproj/argo-cd/v2 · fixed in 2.8.16, 2.9.12, 2.10.7
- CVE-2024-28869Possible denial of service vulnerability with Content-length header in TraefikGo · github.com/traefik/traefik, github.com/traefik/traefik/v2 +1 · fixed in 2.11.2, 3.0.0-rc5
- CVE-2024-31391Apache Solr Operator: Solr-Operator liveness and readiness probes may leak basic auth credentialsGo · github.com/apache/solr-operator · fixed in 0.8.1
- CVE-2024-31839Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandlerGo · github.com/tiagorlampert/chaos
- CVE-2024-29903Cosign vulnerable to machine-wide denial of service via malicious artifactsGo · github.com/sigstore/cosign, github.com/sigstore/cosign/v2 · fixed in 2.2.4
- CVE-2024-29902Cosign vulnerable to system-wide denial of service via malicious attachmentsGo · github.com/sigstore/cosign, github.com/sigstore/cosign/v2 · fixed in 2.2.4
- CVE-2024-32001SpiceDB: LookupSubjects may return partial results if a specific kind of relation is usedGo · github.com/authzed/spicedb · fixed in 1.30.1
- CVE-2024-2029Command Injection in mudler/localaiGo · github.com/go-skynet/localai · fixed in 2.10.0
- CVE-2024-29296A user enumeration vulnerability was found in Portainer CE 2.19.4.Go · github.com/portainer/portainer · fixed in 0.6.1-0.20240417040827-48bc7d0d92f0
- CVE-2024-31457gin-vue-admin background arbitrary code coverage vulnerabilityGo · github.com/flipped-aurora/gin-vue-admin/server · fixed in 0.0.0-20240409100909-b1b7427c6ea6
- CVE-2024-31455Minder GetRepositoryByName data leakGo · github.com/stacklok/minder · fixed in 0.0.40
- CVE-2024-28224Ollama before 0.1.29 has a DNS rebinding vulnerability that can inadvertently allow remote access to the full API, thereby letting an unauthGo · github.com/jmorganca/ollama, github.com/ollama/ollama · fixed in 0.1.29
- CVE-2024-0406Mholt/archiver: path traversal vulnerabilityGo · github.com/mholt/archiver, github.com/mholt/archiver/v3
- CVE-2024-2447Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of cGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.3.3+incompatible, 9.4.4+incompatible, 9.5.2+incompatible and more
- CVE-2024-29221Invite ID available to team admins even without the "Add Members" permissionGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.3.3+incompatible, 9.4.4+incompatible, 9.5.2+incompatible and more
- CVE-2024-28949DoS via a large number of User PreferencesGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 9.3.3+incompatible, 9.4.4+incompatible, 9.5.2+incompatible and more
- CVE-2024-21848Users maintain access to active call after being removed from a channelGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.1.11
- CVE-2023-45288HTTP/2 CONTINUATION flood in net/httpGo · golang.org/x/net, golang.org/x/net/http2 +2 · fixed in 0.23.0, 1.21.9, 1.22.2
- CVE-2024-29193GHSL-2023-207 gotortc DOM-based Cross-site Scripting vulnerabilityGo · github.com/alexxit/go2rtc · fixed in 1.9.0
- CVE-2024-29192GHSL-2023-206 gotortc Cross-Site Request Forgery vulnerabilityGo · github.com/alexxit/go2rtc · fixed in 1.9.0
- CVE-2024-2660Vault TLS Cert Auth Method Did Not Correctly Validate OCSP ResponsesGo · github.com/hashicorp/vault · fixed in 1.16.0
- CVE-2024-29191GHSL-2023-205 gotortc DOM-based Cross-site Scripting vulnerabilityGo · github.com/alexxit/go2rtc · fixed in 1.9.0
- CVE-2024-3250It was discovered that Canonical's Pebble service manager read-file API and the associated pebble pull command, before v1.10.2, allowed unprGo · github.com/canonical/pebble · fixed in 1.4.2, 1.7.3, 1.10.2 and more
- CVE-2024-22189QUIC's Connection ID Mechanism vulnerable to Memory Exhaustion AttackGo · github.com/quic-go/quic-go · fixed in 0.42.0
- CVE-2024-2689Denial of Service if invalid UTF-8 sentGo · github.com/temporalio/temporal, go.temporal.io/server · fixed in 1.22.7, 1.21.6, 1.20.5
- CVE-2024-31420Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashesGo · kubevirt.io/kubevirt
- CVE-2024-2435Stored XSS in Timeline ViewGo · github.com/temporalio/ui-server, github.com/temporalio/ui-server/v2 · fixed in 2.25.0
- CVE-2024-22780Cross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the eGo · github.com/ca17/teamsacs
- CVE-2024-3135Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localaiGo · github.com/go-skynet/localai