Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-12720Regular Expression Denial of Service (ReDoS) in huggingface/transformersPyPI · transformers · fixed in 4.48.0
- CVE-2024-12777Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-11043Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeaiPyPI · invokeai
- CVE-2024-8053Improper Authentication in open-webui/open-webuiPyPI · open-webui · fixed in 0.5.13
- CVE-2024-8021Open Redirect in gradio-app/gradioPyPI · gradio
- CVE-2024-10648Path Traversal in gradio-app/gradioPyPI · gradio
- CVE-2024-8183CORS Misconfiguration in prefecthq/prefectPyPI · prefect · fixed in 2.20.17, 3.0.3
- CVE-2024-8238Unrestricted Code Execution in aimhubio/aimPyPI · aim
- CVE-2024-12217Path Traversal in gradio-app/gradioPyPI · gradio
- CVE-2024-8062Denial of Service in h2oai/h2o-3PyPI · h2o
- CVE-2024-8966Denial of Service in gradio-app/gradioPyPI · gradio
- CVE-2025-0453Denial of Service through Batched Queries in GraphQL in mlflow/mlflowPyPI · mlflow
- CVE-2024-10955ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-8537Path Traversal in modelscope/agentscopePyPI · agentscope
- CVE-2024-10912Denial of Service in lm-sys/fastchatPyPI · fschat
- CVE-2024-6866Case-Insensitive Path Matching in corydolphin/flask-corsPyPI · flask-cors · fixed in 6.0.0
- CVE-2024-8952SSRF in composiohq/composioPyPI · composio-core
- CVE-2024-7776Arbitrary File Overwrite in onnx/onnxPyPI · onnx · fixed in 1.16.2, 1.17.0
- CVE-2024-10569Zip Bomb Vulnerability in gradio-app/gradioPyPI · gradio
- CVE-2024-8953Unsafe eval usage in composiohq/composioPyPI · composio-core · fixed in 0.5.43
- CVE-2025-0189Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-11602CORS Vulnerability in feast-dev/feastPyPI · feast
- CVE-2024-6844Inconsistent CORS Matching Due to Handling of '+' in URL Path in corydolphin/flask-corsPyPI · flask-cors · fixed in 6.0.0
- CVE-2024-6829Arbitrary File Overwrite through tarfile-extraction in aimhubio/aimPyPI · aim
- CVE-2024-7768Denial of Service in h2oai/h2o-3PyPI · h2o
- CVE-2024-10188Denial of Service in BerriAI/litellmPyPI · litellm · fixed in 1.53.1.dev1
- CVE-2024-11958SQL Injection in run-llama/llama_indexPyPI · llama-index-retrievers-duckdb-retriever · fixed in 0.4.0
- CVE-2025-0191Denial of Service in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2025-0628Improper Authorization in BerriAI/litellmPyPI · litellm · fixed in 1.61.15
- CVE-2024-10624Regular Expression Denial of Service (ReDoS) in gradio-app/gradioPyPI · gradio