Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-56509changedetection.io has Improper Input Validation Leading to LFR/Path TraversalPyPI · changedetection-io · fixed in 0.48.05
- CVE-2024-9774Python-sql: python-sql unary operators does not escape non-expressionPyPI · python-sql · fixed in 1.5.2
- CVE-2024-39025Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data.PyPI · letta
- CVE-2024-45805OpenCTI leaks support information due to inadequate access controlPyPI · pycti · fixed in 6.3.0
- CVE-2024-12745SQL Injection in the Amazon Redshift Python Connector affecting v2.1.4PyPI · redshift-connector · fixed in 2.1.5
- CVE-2024-9427Koji: escape html tag characters in the query stringPyPI · koji · fixed in 1.33.2, 1.34.3, 1.35.1
- CVE-2024-56326Jinja has a sandbox breakout through indirect reference to format methodPyPI · jinja2 · fixed in 3.1.5
- CVE-2024-56201Jinja has a sandbox breakout through malicious filenamesPyPI · jinja2 · fixed in 3.1.5
- CVE-2024-56327Malicious plugin names, recipients, or identities can cause arbitrary binary execution in pyragePyPI · pyrage · fixed in 1.2.3
- CVE-2024-56142Path Traversal in pghoardPyPI · pghoard · fixed in 2.6.1-rc
- CVE-2024-55890D-Tale allows Remote Code Execution through the Custom Filter InputPyPI · dtale · fixed in 3.16.1
- CVE-2024-21543Versions of the package djoser before 2.3.0 are vulnerable to Authentication Bypass when the authenticate() function fails.PyPI · djoser · fixed in 2.3.0
- CVE-2024-55633Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessPyPI · apache-superset · fixed in 4.1.0
- CVE-2024-45404OpenCTI's lack of Rate Limit lead to OTP brute forcingPyPI · pycti · fixed in 6.2.18
- CVE-2024-55587python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extractPyPI · python-libarchive
- CVE-2024-55655sigstore-python has insufficient validation of integration timestamp during verificationPyPI · sigstore · fixed in 3.6.0
- CVE-2024-21542Versions of the package luigi before 3.6.0 are vulnerable to Arbitrary File Write via Archive Extraction (Zip Slip) due to improper destinatPyPI · luigi · fixed in 3.6.0
- CVE-2024-53949Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledPyPI · apache-superset · fixed in 4.1.0
- CVE-2024-53948Apache Superset: Error verbosity exposes metadata in analytics databasesPyPI · apache-superset · fixed in 4.1.0
- CVE-2024-53947Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsPyPI · apache-superset · fixed in 4.1.0
- CVE-2024-46455unstructured v.0.14.2 and before is vulnerable to XML External Entity (XXE) via the XMLParser.PyPI · unstructured · fixed in 0.14.3
- CVE-2024-53907An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.PyPI · django · fixed in 5.1.4, 5.0.10, 4.2.17
- CVE-2024-53908An issue was discovered in Django 5.1 before 5.1.4, 5.0 before 5.0.10, and 4.2 before 4.2.17.PyPI · django · fixed in 5.0.10, 5.1.4, 4.2.17
- CVE-2024-12107Double Free in µD3TNPyPI · pyd3tn
- CVE-2024-39163binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints.PyPI · pyspider
- CVE-2024-37303Synapse unauthenticated writes to the media repository allow planting of problematic contentPyPI · matrix-synapse · fixed in 1.106.0, 1.106
- CVE-2024-37302Synapse denial of service through media disk space consumptionPyPI · matrix-synapse · fixed in 1.106.0, 1.106
- CVE-2024-52805Synapse allows unsupported content types to lead to memory exhaustionPyPI · matrix-synapse · fixed in 1.120.1
- CVE-2024-52815Synapse allows a a malformed invite to break the invitee's `/sync`PyPI · matrix-synapse · fixed in 1.120.1
- CVE-2024-53867Synapse Matrix has a partial room state leak via Sliding SyncPyPI · matrix-synapse · fixed in 1.120.1