Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-45793Cross-site Scripting from in Confidant API callPyPI · confidant · fixed in 6.6.2
- CVE-2024-42346Stored Cross Site Scripting (Stored XSS) in GalaxyPyPI · galaxy-auth, galaxy-data · fixed in 24.1.1
- CVE-2024-8375Object deserialization in Reverb leading to RCEPyPI · dm-reverb, dm-reverb-nightly
- CVE-2024-46946langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through syPyPI · langchain-experimental
- CVE-2024-45601Local file Inclusion via static file serving functionality in MesopPyPI · mesop · fixed in 0.12.4
- CVE-2024-45858An arbitrary code execution vulnerability exists in versions 0.2.9 up to 0.5.10 of the Guardrails AI Guardrails framework because of the wayPyPI · guardrails-ai · fixed in 0.5.10
- CVE-2024-35515Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.PyPI · sqlitedict
- CVE-2024-45605Improper authorization on deletion of user issue alert notifications in sentryPyPI · sentry · fixed in 24.9.0
- CVE-2024-45606Improper authorization on muting of alert rules in sentryPyPI · sentry · fixed in 24.9.0
- CVE-2024-8948MicroPython objint.c mpz_as_bytes heap-based overflowPyPI · micropython-copy, micropython-io +1
- CVE-2024-8947MicroPython objarray.c use after freePyPI · micropython-copy, micropython-io
- CVE-2024-8946MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflowPyPI · micropython-copy, micropython-io +2
- CVE-2024-8939Vllm: denials of service in vllm json web apiPyPI · vllm
- CVE-2024-8768Vllm: a completions api request with an empty prompt will crash the vllm api server.PyPI · vllm · fixed in 0.5.5
- CVE-2024-5998Deserialization of Untrusted Data in langchain-ai/langchainPyPI · langchain, langchain-community · fixed in 0.2.9, 0.2.4
- CVE-2024-8865composiohq composio api.py path path traversalPyPI · composio-core
- CVE-2024-8864composiohq composio calculator.py Calculator code injectionPyPI · composio-core
- CVE-2024-8863aimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scriptingPyPI · aim
- CVE-2024-8862h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserializationPyPI · dtale · fixed in 3.14.1
- CVE-2024-8775Ansible-core: exposure of sensitive information in ansible vault files due to improper loggingPyPI · ansible-core · fixed in 2.17.6, 2.16.13
- CVE-2024-6587SSRF in berriai/litellmPyPI · litellm · fixed in 1.44.8
- CVE-2024-45856A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whPyPI · mindsdb
- CVE-2024-45855Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousPyPI · mindsdb
- CVE-2024-45854Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousPyPI · mindsdb
- CVE-2024-45853Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousPyPI · mindsdb
- CVE-2024-45852Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model toPyPI · mindsdb
- CVE-2024-45851An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointPyPI · mindsdb · fixed in 24.7.4.1
- CVE-2024-45850An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointPyPI · mindsdb · fixed in 24.7.4.1
- CVE-2024-45849An arbitrary code execution vulnerability exists in versions 23.10.5.0 up to 24.7.4.1 of the MindsDB platform, when the Microsoft SharePointPyPI · mindsdb · fixed in 24.7.4.1
- CVE-2024-45848An arbitrary code execution vulnerability exists in versions 23.12.4.0 up to 24.7.4.1 of the MindsDB platform, when the ChromaDB integrationPyPI · mindsdb · fixed in 24.7.4.1