Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-48057localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS).Go · github.com/mudler/localai
- CVE-2024-50354Out-of-memory during deserialization with crafted inputsGo · github.com/consensys/gnark · fixed in 0.12.0, 0.11.1
- CVE-2024-8185Vault Vulnerable to Denial of Service When Processing Raft Join RequestsGo · github.com/hashicorp/vault, github.com/openbao/openbao · fixed in 1.18.1, 2.0.3
- CVE-2024-39720An issue was discovered in Ollama before 0.1.46.Go · github.com/ollama/ollama · fixed in 0.1.46
- CVE-2024-10086Consul Vulnerable To Reflected XSS On Content-Type Error ManipulationGo · github.com/hashicorp/consul · fixed in 1.20.0
- CVE-2024-10006Consul L7 Intentions Vulnerable To Headers BypassGo · github.com/hashicorp/consul · fixed in 1.20.1
- CVE-2024-10005Consul L7 Intentions Vulnerable To URL Path BypassGo · github.com/hashicorp/consul · fixed in 1.20.1
- CVE-2024-10452Organization admins can delete pending invites created in an organization they are not part of.Go · github.com/grafana/grafana
- CVE-2024-48921Kyverno's PolicyException objects can be created in any namespace by defaultGo · github.com/kyverno/kyverno · fixed in 1.13.0
- CVE-2024-46872Client-Side Path Traversal Leading to CSRF in PlaybooksGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.0.0-20240926115259-20ed58906adc
- CVE-2024-47401DoS via Amplified GraphQL Response in PlaybooksGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.0.0-20240926115259-20ed58906adc
- CVE-2024-50052Arbitrary post deletion via Playbooks /ignore-thread endpointGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.0.0-20240926115259-20ed58906adc
- CVE-2024-10241Private channel names leaked with Ctrl+K when ElasticSearch is enabledGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.0.0-20240813135334-8f3a13122f55
- CVE-2024-47827Argo Workflows Controller: Denial of Service via malicious daemon WorkflowsGo · github.com/argoproj/argo-workflows, github.com/argoproj/argo-workflows/v2 +1 · fixed in 3.6.0-rc2
- CVE-2024-10214Incorrect Session Creation with Desktop SSOGo · github.com/mattermost/mattermost-server, github.com/mattermost/mattermost-server/v5 +2 · fixed in 8.0.0-20240821220019-0d6b1070a26f
- CVE-2024-49757Zitadel User Registration Bypass VulnerabilityGo · github.com/zitadel/zitadel · fixed in 2.63.5, 2.62.7, 2.61.4 and more
- CVE-2024-49753Denied Host Validation Bypass in Zitadel ActionsGo · github.com/zitadel/zitadel · fixed in 2.64.1, 2.63.6, 2.62.8 and more
- CVE-2024-49381Plenti arbitrary file deletion vulnerabilityGo · github.com/plentico/plenti · fixed in 0.7.2
- CVE-2024-49380Plenti arbitrary file write vulnerabilityGo · github.com/plentico/plenti · fixed in 0.7.2
- CVE-2023-26248The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., infGo · github.com/libp2p/go-libp2p-kad-dht
- CVE-2024-50312Graphql: information disclosure via graphql introspection in openshiftGo · github.com/openshift/console
- CVE-2024-8901Lack of JWT issuer and signer validationGo · github.com/awslabs/aws-alb-route-directive-adapter-for-istio
- CVE-2024-47825CIDR deny policies may not take effect when a more narrow CIDR allow is presentGo · github.com/cilium/cilium · fixed in 1.14.16, 1.15.10
- CVE-2024-9264Grafana SQL Expressions allow for remote code executionGo · github.com/grafana/grafana · fixed in 11.0.6+security-01, 11.1.7+security-01, 11.2.2+security-01
- CVE-2024-22032Rancher's RKE1 Encryption Config kept in plain-text within cluster AppliedSpecGo · github.com/rancher/rancher · fixed in 2.7.14, 2.8.5
- CVE-2024-22030Rancher agents can be hijacked by taking over the Rancher Server URLGo · github.com/rancher/rancher · fixed in 2.7.15, 2.8.8, 2.9.2
- CVE-2023-32196Rancher's External RoleTemplates can lead to privilege escalationGo · github.com/rancher/rancher · fixed in 2.7.14, 2.8.5, 2.8.9 and more
- CVE-2023-32194Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'Go · github.com/rancher/rancher · fixed in 2.6.14, 2.7.10, 2.8.2
- CVE-2023-32193Norman API Cross-site Scripting VulnerabilityGo · github.com/rancher/norman · fixed in 0.0.0-20240207153100-3bb70b772b52
- CVE-2023-32192Rancher API Server Cross-site Scripting VulnerabilityGo · github.com/rancher/apiserver · fixed in 0.0.0-20240207153957-4fd7d821d952