Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-9229Denial of Service (DoS) via Multipart Boundary in stangirard/quivrPyPI · quivr-core
- CVE-2024-7043Improper Access Control in open-webui/open-webuiPyPI · open-webui · fixed in 0.3.16
- CVE-2024-11041Remote Code Execution in vllm-project/vllmPyPI · vllm
- CVE-2024-6577Unclaimed S3 Bucket Usage in pytorch/servePyPI · torchserve
- CVE-2024-7983Denial of Service in open-webui/open-webuiPyPI · open-webui · fixed in 0.5.13
- CVE-2024-6982Remote Code Execution in Calculate Function in parisneo/lollmsPyPI · lollms · fixed in 11.0.0
- CVE-2024-6863Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3PyPI · h2o
- CVE-2024-12376Server Side Request Forgery in lm-sys/fastchatPyPI · fschat
- CVE-2024-7044Stored XSS in open-webui/open-webuiPyPI · open-webui · fixed in 0.3.33
- CVE-2024-8551Path Traversal in modelscope/agentscopePyPI · agentscope
- CVE-2025-1474Weak Password Requirements in mlflow/mlflowPyPI · mlflow · fixed in 2.19.0
- CVE-2025-1473CSRF in mlflow/mlflowPyPI · mlflow · fixed in 2.20.3
- CVE-2024-8616Arbitrary File Overwrite in h2oai/h2o-3PyPI · h2o
- CVE-2024-10833Arbitrary File Write in eosphoros-ai/db-gptPyPI · dbgpt · fixed in 0.6.2
- CVE-2024-9070Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentomlPyPI · bentoml
- CVE-2024-10907Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchatPyPI · fschat
- CVE-2024-9159Incorrect Authorization in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-9107Stored XSS in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-9056Denial of Service in bentoml/bentomlPyPI · bentoml
- CVE-2024-10550Denial of Service by ReDOS in h2oai/h2o-3PyPI · h2o
- CVE-2024-12778Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-8061Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-9701Remote Code Execution in kedro-org/kedroPyPI · kedro · fixed in 0.19.9
- CVE-2024-10906Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-7035Cross-Site Request Forgery (CSRF) in open-webui/open-webuiPyPI · open-webui · fixed in 0.3.16
- CVE-2024-11603Server-Side Request Forgery in lm-sys/fastchatPyPI · fschat
- CVE-2024-10908Open Redirect in lm-sys/fastchatPyPI · fschat
- CVE-2024-6854Arbitrary File Overwrite in h2oai/h2o-3PyPI · h2o
- CVE-2024-10707Local File Inclusion in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6827HTTP Request Smuggling in benoitc/gunicornPyPI · gunicorn · fixed in 22.0.0