Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-41129The ops library leaks secrets if `subprocess.CalledProcessError` happens with a `secret-*` CLI commandPyPI · ops · fixed in 2.15.0
- CVE-2024-6961XXE in Guardrails AI when consuming RAIL documentsPyPI · guardrails-ai · fixed in 0.5.0
- CVE-2024-6281Path Traversal in parisneo/lollmsPyPI · lollms · fixed in 9.5.1
- CVE-2024-41124Puncia Cleartext Transmission of Sensitive Information via HTTP urls in `API_URLS`PyPI · puncia · fixed in 0.21
- CVE-2024-39123In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitizPyPI · calibreweb
- CVE-2024-35198TorchServe bypass allowed_urls configurationPyPI · torchserve · fixed in 0.11.0
- CVE-2024-35199TorchServe gRPC Port ExposurePyPI · torchserve · fixed in 0.11.0
- CVE-2024-40647Unintentional exposure of environment variables to subprocesses in sentry-sdkPyPI · sentry-sdk · fixed in 1.45.1, 2.8.0
- CVE-2024-31411Apache StreamPipes: Potential remote code execution (RCE) via file uploadPyPI · streampipes · fixed in 0.95.0
- CVE-2024-31979Apache StreamPipes: Possibility of SSRF in pipeline element installation processPyPI · streampipes · fixed in 0.95.0
- CVE-2024-30471Apache StreamPipes: Potential creation of multiple identical accountsPyPI · streampipes · fixed in 0.95.0
- CVE-2024-39877Apache Airflow: DAG Author Code Execution possibility in airflow-schedulerPyPI · apache-airflow · fixed in 2.9.3
- CVE-2024-39863Apache Airflow: Potential XSS VulnerabilityPyPI · apache-airflow · fixed in 2.9.3
- CVE-2024-39124In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.PyPI · roundup · fixed in 2.4.0
- CVE-2024-39125Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.PyPI · roundup · fixed in 2.4.0
- CVE-2024-39126Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.PyPI · roundup · fixed in 2.4.0
- CVE-2024-40637Implicit override for built-in materializations from installed packages in dbt-corePyPI · dbt-core · fixed in 1.6.14, 1.7.14
- CVE-2024-39700Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub ActionPyPI · jupyterlab · fixed in 4.3.0
- CVE-2024-39887Apache Superset: Improper SQL authorisation, parse not checking for specific engine functionsPyPI · apache-superset · fixed in 4.0.2
- CVE-2024-40627OpaMiddleware does not filter HTTP OPTIONS requestsPyPI · fastapi-opa · fixed in 2.0.1
- CVE-2024-21513Versions of the package langchain-experimental from 0.0.15 and before 0.0.21 are vulnerable to Arbitrary Code Execution when retrieving valuPyPI · langchain-experimental · fixed in 0.0.21
- CVE-2024-6345Remote Code Execution in pypa/setuptoolsPyPI · setuptools · fixed in 70.0.0
- CVE-2024-39903Local File Inclusion in SolaraPyPI · solara · fixed in 1.35.1
- CVE-2024-39905Red-DiscordBot vulnerable to Incorrect Authorization in commands APIPyPI · red-discordbot · fixed in 3.5.10
- CVE-2024-39317Wagtail regular expression denial-of-service via search query parsingPyPI · wagtail · fixed in 6.0.6, 6.1.3, 5.2.6
- CVE-2024-6035Stored XSS in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6036Denial of Service in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6037Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-38875An issue was discovered in Django 4.2 before 4.2.14 and 5.0 before 5.0.7.PyPI · django · fixed in 4.2.14, 5.0.7
- CVE-2024-39329An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.PyPI · django · fixed in 5.0.7, 4.2.14