Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-39330An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.PyPI · django · fixed in 5.0.7, 4.2.14
- CVE-2024-39614An issue was discovered in Django 5.0 before 5.0.7 and 4.2 before 4.2.14.PyPI · django · fixed in 5.0.7, 4.2.14
- CVE-2024-5569Denial of Service via crafted zip file in jaraco/zippPyPI · zipp · fixed in 3.19.1
- CVE-2024-6227Infinite Loop in aimhubio/aimPyPI · aim
- CVE-2024-3651Denial of Service via Quadratic Complexity in kjd/idnaPyPI · idna · fixed in 3.7
- CVE-2024-5753Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vannaPyPI · vanna
- CVE-2024-39689Certifi removes GLOBALTRUST root certificatePyPI · certifi · fixed in 2024.7.4
- CVE-2024-32498An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3.PyPI · cinder, glance +1
- CVE-2024-31223Fides Information Disclosure Vulnerability in Privacy Center of SERVER_SIDE_FIDES_API_URLPyPI · ethyca-fides · fixed in 2.39.2
- CVE-2024-38537Inclusion of Untrusted polyfill.io Code Vulnerability in fides.jsPyPI · ethyca-fides · fixed in 2.39.1
- CVE-2024-38519yt-dlp and youtube-dl vulnerable to file system modification and RCE through improper file-extension sanitizationPyPI · yt-dlp · fixed in 2024.07.01
- CVE-2024-39303Weblate vulnerabler to improper sanitization of project backupsPyPI · weblate · fixed in 5.6.2
- CVE-2024-39236Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py.PyPI · gradio
- CVE-2024-5062Reflected XSS through survey redirect parameter in zenml-io/zenmlPyPI · zenml · fixed in 0.58.0
- CVE-2024-5980Arbitrary File Write via /v1/runs API endpoint in lightning-ai/pytorch-lightningPyPI · lightning, pytorch-lightning · fixed in 2.3.3
- CVE-2024-6139Path Traversal in parisneo/lollmsPyPI · lollms
- CVE-2024-5824Path Traversal in parisneo/lollmsPyPI · lollms · fixed in 9.5.0
- CVE-2024-6085Path Traversal in parisneo/lollmsPyPI · lollms
- CVE-2024-5822Server-Side Request Forgery (SSRF) in gaizhenbiao/ChuanhuChatGPTPyPI · chuanhuchatgpt
- CVE-2024-6038ReDoS Vulnerability in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-5710Improper Access Control in Team Management in berriai/litellmPyPI · litellm · fixed in 1.40.15
- CVE-2024-6090Path Traversal Vulnerability in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-5751Remote Code Execution in BerriAI/litellmPyPI · litellm · fixed in 1.40.16
- CVE-2024-5826Remote Code Execution via Prompt Injection in vanna-ai/vannaPyPI · vanna
- CVE-2024-5979Denial of Service via Invalid Argument in h2oai/h2o-3PyPI · h2o
- CVE-2024-22232Specially crafted url can be created which leads to a directory traversal in the salt file serverPyPI · salt · fixed in 3005.5, 3006.6
- CVE-2024-22231Syndic cache directory creation is vulnerable to a directory traversal attackPyPI · salt · fixed in 3005.5, 3006.6
- CVE-2024-39705NLTK through 3.8.1 allows remote code execution if untrusted packages have pickled Python code, and the integrated data package download funPyPI · nltk · fixed in 3.9
- CVE-2024-21520Versions of the package djangorestframework before 3.15.2 are vulnerable to Cross-site Scripting (XSS) via the break_long_headers template fPyPI · djangorestframework · fixed in 3.15.2
- CVE-2024-38526pdoc embeds link to malicious CDN if math mode is enabledPyPI · pdoc · fixed in 14.5.1