Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-43406LF Edge eKuiper has a SQL Injection in sqlKvStorePyPI · ekuiper · fixed in 1.14.2
- CVE-2024-43399Mobile Security Framework (MobSF) has a Zip Slip Vulnerability in .a Static Library FilesPyPI · mobsf · fixed in 4.0.7
- CVE-2024-6221Improper Access Control in corydolphin/flask-corsPyPI · flask-cors · fixed in 4.0.2
- CVE-2024-42353WebOb's location header normalization during redirect leads to open redirectPyPI · webob · fixed in 1.8.8
- CVE-2024-42474Streamlit Path Traversal Security Vulnerability on WindowsPyPI · streamlit · fixed in 1.37.0
- CVE-2024-42367In aiohttp, compressed files as symlinks are not protected from path traversalPyPI · aiohttp · fixed in 3.10.2
- CVE-2024-41942JupyterHub has a privilege escalation vulnerability with the `admin:users` scopePyPI · jupyterhub · fixed in 4.1.6, 5.1.0
- CVE-2024-6706Open WebUI Stored Cross-Site ScriptingPyPI · open-webui · fixed in 0.3.14
- CVE-2024-7143Pulpcore: rbac permissions incorrectly assigned in tasks that create objectsPyPI · pulpcore
- CVE-2024-41989An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.PyPI · django · fixed in 5.0.8, 4.2.15
- CVE-2024-41990An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.PyPI · django · fixed in 5.0.8, 4.2.15
- CVE-2024-41991An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.PyPI · django · fixed in 5.0.8, 4.2.15
- CVE-2024-42005An issue was discovered in Django 5.0 before 5.0.8 and 4.2 before 4.2.15.PyPI · django · fixed in 5.0.8, 4.2.15
- CVE-2024-42447Apache Airflow Providers FAB: FAB provider 1.2.1 and 1.2.0 did not let user to logout for AirflowPyPI · apache-airflow, apache-airflow-providers-fab · fixed in 1.2.2
- CVE-2024-7319Openstack-heat: incomplete fix for cve-2023-1625PyPI · openstack-heat
- CVE-2024-41951PheonixAppAPI has visible Encoding MapsPyPI · pheonixappapi · fixed in 0.2.5
- CVE-2024-41955Mobile Security Framework (MobSF) has an Open Redirect in Login RedirectPyPI · mobsf · fixed in 4.0.5
- CVE-2024-41950Insecure Jinja2 templates rendered in Haystack Components can lead to RCEPyPI · haystack-ai · fixed in 2.3.1
- CVE-2024-7340W&B Weave server remote arbitrary file leak and privilege escalationPyPI · weave · fixed in 0.50.8
- CVE-2024-6255Path Traversal in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2023-33976TensorFlow segfault in array_ops.upper_boundPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.12.1
- CVE-2024-6578Stored XSS in aimhubio/aimPyPI · aim
- CVE-2024-41810HTML injection in HTTP redirect bodyPyPI · twisted · fixed in 24.7.0rc1
- CVE-2024-41671twisted.web has disordered HTTP pipeline responsePyPI · twisted · fixed in 24.7.0rc1
- CVE-2024-41672DuckDB: sniff_csv provides filesystem access even when enable_external_access is disabledPyPI · duckdb · fixed in 1.1.0
- CVE-2024-40767In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 imPyPI · nova
- CVE-2024-41656Sentry vulnerable to stored Cross-Site Scripting (XSS)PyPI · sentry · fixed in 24.7.1
- CVE-2024-29073An vulnerability in the handling of Latex exists in Ankitects Anki 24.04.PyPI · anki · fixed in 24.6
- CVE-2024-26020An arbitrary script execution vulnerability exists in the MPV functionality of Ankitects Anki 24.04.PyPI · anki · fixed in 24.06
- CVE-2024-32152A blocklist bypass vulnerability exists in the LaTeX functionality of Ankitects Anki 24.04.PyPI · anki · fixed in 24.6