Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-53863Synapse can be forced to thumbnail unexpected file formats, invoking external, potentially untrustworthy decodersPyPI · matrix-synapse · fixed in 1.120.1
- CVE-2024-53999Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" FunctionalityPyPI · mobsf · fixed in 4.2.9
- CVE-2024-54000Mobile Security Framework (MobSF) bypass of SSRF fixPyPI · mobsf · fixed in 3.9.7
- CVE-2024-53981python-multipart has a Denial of service (DoS) via deformation `multipart/form-data` boundaryPyPI · python-multipart · fixed in 0.0.18
- CVE-2024-53865Python package "zhmcclient" has passwords in clear text in its HMC and API logsPyPI · zhmcclient · fixed in 1.18.1
- CVE-2024-53861Issuer field partial matches allowed in pyjwtPyPI · pyjwt · fixed in 2.10.1
- CVE-2024-53848check-jsonschema default caching for remote schemas allows for cache confusionPyPI · check-jsonschema · fixed in 0.30.0
- CVE-2024-39162pyspider through 0.3.10 allows /update XSS.PyPI · pyspider
- CVE-2024-52338Apache Arrow R package: Arbitrary code execution when loading a malicious data filePyPI · pyarrow · fixed in 17.0.0
- CVE-2024-52008Password Policy Bypass Vulnerability in Fides WebserverPyPI · ethyca-fides · fixed in 2.50.0
- CVE-2024-27134Excessive directory permissions in MLflow leads to local privilege escalation when using spark_udfPyPI · mlflow · fixed in 2.16.0
- CVE-2024-52787An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename iPyPI · libre-chat
- CVE-2024-53899virtualenv before 20.26.6 allows command injection through the activation scripts for a virtual environment.PyPI · virtualenv · fixed in 20.26.6
- CVE-2024-53916In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement.PyPI · neutron · fixed in 23.2.1, 24.0.2, 25.0.1
- CVE-2024-11394Hugging Face Transformers Trax Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers · fixed in 4.48.0
- CVE-2024-11393Hugging Face Transformers MaskFormer Model Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers · fixed in 4.48.0
- CVE-2024-11392Hugging Face Transformers MobileViTV2 Deserialization of Untrusted Data Remote Code Execution VulnerabilityPyPI · transformers · fixed in 4.48.0
- CVE-2024-53253Sentry's improper error handling leaks Application Integration Client SecretPyPI · sentry · fixed in 24.11.1
- CVE-2024-52804Tornado has HTTP cookie parsing DoS vulnerabilityPyPI · tornado · fixed in 6.4.2
- CVE-2024-52803LLama Factory Remote OS Command Injection VulnerabilityPyPI · llamafactory · fixed in 0.9.1
- CVE-2024-53425A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3.PyPI · pyassimp
- CVE-2024-52581Litestar allows unbounded resource consumption (DoS vulnerability)PyPI · litestar, starlite · fixed in 2.13.0
- CVE-2024-11406Stored XSS in django CMS Attributes FieldsPyPI · djangocms-attributes-field · fixed in 4.0.0
- CVE-2024-11404File Upload Bypass in django FilerPyPI · django-filer · fixed in 3.3.0
- CVE-2024-52595HTML Cleaner allows crafted scripts in special contexts like svg or math to pass throughPyPI · lxml-html-clean · fixed in 0.4.0
- CVE-2024-52304aiohttp vulnerable to request smuggling due to incorrect parsing of chunk extensionsPyPI · aiohttp · fixed in 3.10.11
- CVE-2024-52303aiohttp memory leak when middleware is enabled when requesting a resource with a non-allowed methodPyPI · aiohttp · fixed in 3.10.11
- CVE-2024-47533Cobbler allows anyone to connect to cobbler XML-RPC server with a known password and make changesPyPI · cobbler · fixed in 3.3.7, 3.2.3
- CVE-2024-37155OpenCTI May Bypass Introspection RestrictionPyPI · pycti · fixed in 6.1.9
- CVE-2024-11319Stored XSS in Open Source Project "django-cms"PyPI · django-cms · fixed in 3.11.9, 4.1.4