Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-45847An arbitrary code execution vulnerability exists in versions 23.11.4.2 up to 24.7.4.1 of the MindsDB platform, when one of several integratiPyPI · mindsdb · fixed in 24.7.4.1
- CVE-2024-45846An arbitrary code execution vulnerability exists in versions 23.10.3.0 up to 24.7.4.1 of the MindsDB platform, when the Weaviate integrationPyPI · mindsdb · fixed in 24.7.4.1
- CVE-2024-45857Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl fPyPI · cleanlab
- CVE-2024-27321An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabPyPI · refuel-autolabel
- CVE-2024-27320An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classifiPyPI · refuel-autolabel
- CVE-2024-6091Shell Command Denylist Bypass in significant-gravitas/autogptPyPI · agpt
- CVE-2024-45595D-Tale allows Remote Code Execution through the Query input on Chart BuilderPyPI · dtale · fixed in 3.14.1
- CVE-2024-45034Apache Airflow: Authenticated DAG authors could execute code on scheduler nodesPyPI · apache-airflow · fixed in 2.10.1
- CVE-2024-45498Apache Airflow: Command Injection in an example DAGPyPI · apache-airflow · fixed in 2.10.1
- CVE-2024-45758H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command exPyPI · h2o
- CVE-2024-24759MindsDB Vulnerable to Bypass of SSRF Protection with DNS RebindingPyPI · mindsdb · fixed in 23.12.4.2
- CVE-2024-45399Indico has a Cross-Site-Scripting during account creationPyPI · indico · fixed in 3.3.4
- CVE-2024-45314Flask-AppBuilder login form allows browser to cache sensitive fieldsPyPI · flask-appbuilder · fixed in 4.5.1
- CVE-2024-45053Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating EnginePyPI · ethyca-fides · fixed in 2.44.0
- CVE-2024-45052Fides Webserver Authentication Timing-Based Username Enumeration VulnerabilityPyPI · ethyca-fides · fixed in 2.44.0
- CVE-2024-43805HTML injection in Jupyter Notebook and JupyterLab leading to DOM ClobberingPyPI · jupyterlab, notebook · fixed in 3.6.8, 4.2.5, 7.2.2
- CVE-2024-42816A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary PyPI · fastapi-admin
- CVE-2024-42818A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary wPyPI · fastapi-admin
- CVE-2024-45190Mage AI pipeline interaction request remote arbitrary file leakPyPI · mage-ai
- CVE-2024-45189Mage AI git content request remote arbitrary file leakPyPI · mage-ai
- CVE-2024-45188Mage AI file content request remote arbitrary file leakPyPI · mage-ai
- CVE-2024-45187Mage AI allows deleted users to use the terminal server with admin access, leading to remote code executionPyPI · mage-ai
- CVE-2024-8113Stored XSS in Placeholder Samples in Mail PreviewPyPI · pretix · fixed in 2024.7.1
- CVE-2024-8072Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary usersPyPI · mage-ai
- CVE-2024-45201An issue was discovered in llama_index before 0.10.38.PyPI · llama-index, llama-index-core · fixed in 0.10.38
- CVE-2024-41937Apache Airflow: Stored XSS Vulnerability on provider linkPyPI · apache-airflow · fixed in 2.10.0
- CVE-2024-43371Potential access to sensitive URLs via CKAN extensions (SSRF)PyPI · ckan · fixed in 2.10.5
- CVE-2024-41675CKAN has a Cross-site Scripting vector in the Datatables view pluginPyPI · ckan · fixed in 2.10.5
- CVE-2024-41674CKAN may leak Solr credentials via error message in package_search actionPyPI · ckan · fixed in 2.10.5
- CVE-2024-43396Khoj Vulnerable to Stored Cross-site Scripting In Automate (Preview feature)PyPI · khoj · fixed in 1.15.0