Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-6110Openstack: deleting a non existing access rule deletes another existing access rule in it's scopePyPI · python-openstackclient · fixed in 6.3.0
- CVE-2024-1240Open Redirection in pyload/pyloadPyPI · pyload-ng
- CVE-2021-3988Cross-site Scripting (XSS) in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.15
- CVE-2021-3987Improper Access Control in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.15
- CVE-2021-3986Information Disclosure in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.15
- CVE-2024-45784Apache Airflow: Sensitive configuration values are not masked in the logs by defaultPyPI · airflow, apache-airflow · fixed in 2.10.3
- CVE-2024-4311Lack of login attempt rate-limiting in zenml-io/zenmlPyPI · zenml · fixed in 0.57.0rc2
- CVE-2024-52524ReDoS in Giskard Scan text perturbationPyPI · giskard · fixed in 2.15.5
- CVE-2023-34049Salt security advisory release - 2023-OCT-27PyPI · salt · fixed in 3005.4, 3006.4
- CVE-2024-49048TorchGeo Remote Code Execution VulnerabilityPyPI · torchgeo · fixed in 0.6.1
- CVE-2024-43598LightGBM Remote Code Execution VulnerabilityPyPI · lightgbm · fixed in 4.6.0
- CVE-2024-52296libosdp has a null pointer deref in osdp_reply_namePyPI · libosdp · fixed in 2.4.0
- CVE-2024-11079Ansible-core: unsafe tagging bypass via hostvars object in ansible-corePyPI · ansible-core · fixed in 2.18.1rc1, 2.17.7rc1, 2.16.14rc1
- CVE-2024-52288RMAC revert to the beginning of the session in libosdpPyPI · libosdp · fixed in 3.0.0
- CVE-2024-50378Apache Airflow: Secrets not masked in UI when sensitive variables are set via Airflow cliPyPI · apache-airflow · fixed in 2.10.3
- CVE-2024-27527wasm3 139076a is vulnerable to Denial of Service (DoS).PyPI · pywasm3
- CVE-2024-27528wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution.PyPI · pywasm3
- CVE-2024-27529wasm3 139076a contains memory leaks in Read_utf8.PyPI · pywasm3
- CVE-2024-27530wasm3 139076a contains a Use-After-Free in ForEachModule.PyPI · pywasm3
- CVE-2024-51998Path traversal using file URI scheme without supplying hostname in changedetection.ioPyPI · changedetection-io · fixed in 0.47.6
- CVE-2024-51751Arbitrary file read with File and UploadButton components in GradioPyPI · gradio · fixed in 5.5.0
- CVE-2024-10082CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.PyPI · codechecker · fixed in 6.24.2
- CVE-2024-10081CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy.PyPI · codechecker · fixed in 6.24.2
- CVE-2024-9902Ansible-core: ansible-core user may read/write unauthorized contentPyPI · ansible-core · fixed in 2.14.18rc1, 2.15.13rc1, 2.16.13rc1 and more
- CVE-2024-49377Jinja2 Templates are vulnerable to XSS attacks due to their configuration in OctoPrintPyPI · octoprint · fixed in 1.10.3
- CVE-2024-51493API key access in settings without reauthentication in OctoPrintPyPI · octoprint · fixed in 1.10.3
- CVE-2024-51734User data deletion by anoynmous users in ZopePyPI · accesscontrol, zope · fixed in 7.2, 5.11.1
- CVE-2024-48050In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression.PyPI · agentscope · fixed in 0.0.5a1
- CVE-2024-48052In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability.PyPI · gradio
- CVE-2024-48061langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on thPyPI · langflow