Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-47870Race condition in update_root_in_config may redirect user traffic in GradioPyPI · gradio · fixed in 5.0.0
- CVE-2024-47871Insecure communication between the FRP client and server in GradioPyPI · gradio · fixed in 5.0.0
- CVE-2024-47872Cross-site Scripting on Gradio server via upload of HTML files, JS files, or SVG filesPyPI · gradio · fixed in 5.0.0
- CVE-2024-47084CORS origin validation is not performed when the request has a cookie in GradioPyPI · gradio · fixed in 4.44.0
- CVE-2024-47164The `is_in_or_equal` function may be bypassed in GradioPyPI · gradio · fixed in 5.0.0
- CVE-2024-47165CORS origin validation accepts the null origin in GradioPyPI · gradio · fixed in 5.0.0
- CVE-2024-47166One-level read path traversal in `/custom_component` in GradioPyPI · gradio · fixed in 4.44.0
- CVE-2024-47167SSRF in the path parameter of /queue/join in GradioPyPI · gradio · fixed in 5.0.0
- CVE-2024-47168The `enable_monitoring` flag set to `False` does not disable monitoring in GradioPyPI · gradio · fixed in 4.44.0
- CVE-2024-7041IDOR in open-webui/open-webuiPyPI · open-webui · fixed in 0.6.3
- CVE-2024-47833Session Cookie without Secure and HTTPOnly flags in taipyPyPI · taipy · fixed in 4.0.0
- CVE-2024-47813Wasmtime race condition could lead to WebAssembly control-flow integrity and type safety violationsPyPI · wasmtime
- CVE-2024-47763Wasmtime runtime crash when combining tail calls with trapping importsPyPI · wasmtime-bin
- CVE-2024-43497DeepSpeed Remote Code Execution VulnerabilityPyPI · deepspeed · fixed in 0.15.1
- CVE-2024-25885An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) PyPI · xhtml2pdf
- CVE-2024-45230An issue was discovered in Django 5.1 before 5.1.1, 5.0 before 5.0.9, and 4.2 before 4.2.16.PyPI · django · fixed in 5.1.1, 5.0.9, 4.2.16
- CVE-2024-45231An issue was discovered in Django v5.1.1, v5.0.9, and v4.2.16.PyPI · django · fixed in 4.2.16, 5.0.9, 5.1.1
- CVE-2024-47211In OpenStack Ironic before 21.4.4, 22.x and 23.x before 23.0.3, 23.x and 24.x before 24.1.3, and 25.x and 26.x before 26.1.0, there is a lacPyPI · ironic · fixed in 26.1.1, 24.1.3, 23.0.3
- CVE-2024-47529OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)PyPI · openc3 · fixed in 5.19.0
- CVE-2024-46977OpenC3 COSMOS allows a path traversal via screen controller (`GHSL-2024-127`)PyPI · openc3 · fixed in 5.19.0
- CVE-2024-43795OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)PyPI · openc3 · fixed in 5.19.0
- CVE-2024-47532RestrictedPython information leakage via `AttributeError.obj` and the `string` modulePyPI · restrictedpython · fixed in 7.3
- CVE-2024-9277Langflow HTTP POST Request utils.py redosPyPI · langflow
- CVE-2024-46632Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function.PyPI · pyassimp
- CVE-2024-47082Strawberry GraphQL Cross-Site Request Forgery (CSRF) vulnerabilityPyPI · strawberry-graphql · fixed in 0.243.0
- CVE-2024-22892OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.PyPI · openslides
- CVE-2024-22893OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime.PyPI · openslides
- CVE-2024-46488sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function.PyPI · sqlite-vec · fixed in 0.1.3
- CVE-2024-9014OAuth2 client id and secret exposed through the web browser in pgAdmin 4PyPI · pgadmin4 · fixed in 8.12
- CVE-2024-47226A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel viaPyPI · pynetbox