Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-51483changedetection.io Path Traversal vulnerabilityPyPI · changedetection-io · fixed in 0.47.5
- CVE-2024-42835langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.PyPI · langflow
- CVE-2024-49768Waitress has request processing race condition in HTTP pipelining with invalid first requestPyPI · waitress · fixed in 3.0.1
- CVE-2024-49769Waitress has a denial of service leading to high CPU usage/resource exhaustionPyPI · waitress · fixed in 3.0.1
- CVE-2024-8309SQL Injection in langchain-ai/langchainPyPI · langchain, langchain-community · fixed in 0.2.0, 0.2.19
- CVE-2024-8143Unauthorized Access to User Chat History in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6581Remote Code Execution due to Stored XSS in parisneo/lollmsPyPI · lollms
- CVE-2024-7807Denial of Service (DOS) in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-7962Arbitrary File Read via Insufficient Validation in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-48063In PyTorch <=2.4.1, the RemoteModule has Deserialization RCE.PyPI · torch · fixed in 2.5.0
- CVE-2024-49771MPXJ has a Potential Path Traversal VulnerabilityPyPI · mpxj · fixed in 13.5.1
- CVE-2024-10455Reachable Assertion in µD3TNPyPI · pyd3tn
- CVE-2024-39205An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP…PyPI · pyload-ng
- CVE-2024-47821pyLoad vulnerable to remote code execution by download to /.pyload/scripts using /flashgot APIPyPI · pyload-ng · fixed in 0.5.0b3.dev87
- CVE-2024-49767Werkzeug possible resource exhaustion when parsing file data in formsPyPI · quart, werkzeug · fixed in 0.20.0, 3.0.6
- CVE-2024-49766Werkzeug safe_join not safe on WindowsPyPI · werkzeug · fixed in 3.0.6
- CVE-2024-49750Snowflake Connector for Python has sensitive data in logsPyPI · snowflake-connector-python · fixed in 3.12.3
- CVE-2024-48423An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp librPyPI · pyassimp
- CVE-2024-48424A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specificalPyPI · pyassimp
- CVE-2024-48425A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library duriPyPI · pyassimp
- CVE-2024-48426A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSPyPI · pyassimp
- CVE-2024-10073flairNLP flair Mode File Loader clustering.py ClusteringModel code injectionPyPI · flair · fixed in 0.15.0
- CVE-2024-21272Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/Python).PyPI · mysql-connector-python · fixed in 9.1.0
- CVE-2024-47874Starlette Denial of service (DoS) via multipart/form-dataPyPI · starlette · fixed in 0.40.0
- CVE-2024-48911OpenCanary Executes Commands From Potentially Writable Config FilePyPI · opencanary · fixed in 0.9.5, 0.9.4
- CVE-2024-6985Path Traversal in api open_personality_folder in parisneo/lollms-webuiPyPI · lollms · fixed in 5.9.0
- CVE-2024-6971Path Traversal in parisneo/lollms-webuiPyPI · lollms
- CVE-2024-47867Lack of integrity check on the downloaded FRP client in GradioPyPI · gradio · fixed in 5.0.0
- CVE-2024-47868Several components’ post-process steps may allow arbitrary file leaks in GradioPyPI · gradio · fixed in 5.0.0
- CVE-2024-47869Non-constant-time comparison when comparing hashes in GradioPyPI · gradio · fixed in 4.44.0