Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-6851Arbitrary File Deletion in aimhubio/aimPyPI · aim
- CVE-2024-8859Path Traversal in mlflow/mlflowPyPI · mlflow · fixed in 2.17.0rc0
- CVE-2024-10190Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovodPyPI · horovod
- CVE-2024-10829Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-8438Path Traversal in modelscope/agentscopePyPI · agentscope
- CVE-2024-12911SQL Injection in run-llama/llama_indexPyPI · llama-index · fixed in 0.12.3
- CVE-2024-6839Improper Regex Path Matching in corydolphin/flask-corsPyPI · flask-cors · fixed in 6.0.0
- CVE-2024-10901Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-8502Remote Code Execution via Deserialization in modelscope/agentscopePyPI · agentscope
- CVE-2024-6483Arbitrary File/Directory Deletion in aimhubio/aimPyPI · aim
- CVE-2025-0330Exposure of Sensitive Information in berriai/litellmPyPI · litellm
- CVE-2024-9053Remote Code Execution in vllm-project/vllmPyPI · vllm
- CVE-2024-10835Arbitrary File Write via SQL Injection in eosphoros-ai/db-gptPyPI · dbgpt · fixed in 0.7.1
- CVE-2024-12216Arbitrary File Write via TarSlip in dmlc/gluon-cvPyPI · gluoncv
- CVE-2024-10572Denial of Service and Arbitrary File Write in h2oai/h2o-3PyPI · h2o
- CVE-2024-8955SSRF in composiohq/composioPyPI · composio-core
- CVE-2024-8020Denial of Service in lightning-ai/pytorch-lightningPyPI · lightning, pytorch-lightning
- CVE-2024-9606Improper Output Neutralization for Logs in berriai/litellmPyPI · litellm · fixed in 1.44.12
- CVE-2024-10110Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-12909SQL Injection to RCE in run-llama/llama_indexPyPI · llama-index-packs-finchat
- CVE-2024-8984Denial of Service (DoS) in berriai/litellmPyPI · litellm · fixed in 1.56.2
- CVE-2024-10902Arbitrary File Upload with Path Traversal in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-10821Denial of Service (DoS) in invoke-ai/invokeaiPyPI · invokeai
- CVE-2024-12910Denial of Service in run-llama/llama_indexPyPI · llama-index · fixed in 0.12.9
- CVE-2024-6838Uncontrolled Resource Consumption in mlflow/mlflowPyPI · mlflow
- CVE-2025-0188SSRF in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-10831Arbitrary File Write through Absolute Path Traversal in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-12704Denial of Service (DoS) in run-llama/llama_indexPyPI · llama-index, llama-index-core · fixed in 0.12.6
- CVE-2024-10553Jdbc Deserialization in h2oai/h2o-3PyPI · h2o · fixed in 3.46.0.6
- CVE-2024-7760CSRF in aimhubio/aimPyPI · aim