Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-49793Path traversal in `CodeChecker server` in the endpoint of `CodeChecker store`PyPI · codechecker · fixed in 6.23.0
- CVE-2024-3121Remote Code Execution in create_conda_env function in parisneo/lollmsPyPI · lollms
- CVE-2024-5443Remote Code Execution via Path Traversal in parisneo/lollmsPyPI · lollms · fixed in 9.5.1
- CVE-2024-4940Open Redirect in gradio-app/gradioPyPI · gradio
- CVE-2024-34693Apache Superset: Server arbitrary file readPyPI · apache-superset · fixed in 3.1.3, 4.0.1
- CVE-2024-28397An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.PyPI · js2py
- CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elementsPyPI · django-tinymce · fixed in 4.1.0
- CVE-2024-38356TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp optionPyPI · django-tinymce · fixed in 4.1.0
- CVE-2024-37891Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3PyPI · urllib3 · fixed in 1.26.19, 2.2.2
- CVE-2024-38459langchain_experimental (aka LangChain Experimental) before 0.0.61 for LangChain provides Python REPL access without an opt-in step.PyPI · langchain-experimental · fixed in 0.0.61
- CVE-2024-34694LNbits improperly handles potential network and payment failures when using Eclair backendPyPI · lnbits · fixed in 0.12.6
- CVE-2024-25142Apache Airflow: Cache Control - Storage of Sensitive Data in Browser Cache PyPI · apache-airflow · fixed in 2.9.2
- CVE-2024-37300Globus `identity_provider` restriction ignored when used with `allow_all` in JupyterHub 5.0PyPI · oauthenticator · fixed in 16.3.1
- CVE-2024-36265Apache Submarine Server Core: authorization bypassPyPI · apache-submarine
- CVE-2024-36264Apache Submarine Commons Utils: default secretPyPI · apache-submarine
- CVE-2024-4315LFI Vulnerability due to Lack of Path Sanitization in parisneo/lollmsPyPI · lollms · fixed in 9.5.0
- CVE-2024-35225Jupyter Server Proxy has a reflected XSS issue in host parameterPyPI · jupyter-server-proxy · fixed in 3.2.4, 4.2.0
- CVE-2024-37301document-merge-service vulnerable to Remote Code Execution via Server-Side Template InjectionPyPI · document-merge-service · fixed in 6.5.2
- CVE-2024-35255Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege VulnerabilityPyPI · azure-identity · fixed in 1.16.1
- CVE-2024-37014Langflow through 0.6.19 allows remote code execution if untrusted users are able to reach the "POST /api/v1/custom_component" endpoint and pPyPI · langflow · fixed in 1.0.15, 1.0.0a3
- CVE-2024-37568lepture Authlib before 1.3.1 has algorithm confusion with asymmetric public keys.PyPI · authlib · fixed in 1.3.1
- CVE-2024-4680Insufficient Session Expiration in zenml-io/zenmlPyPI · zenml
- CVE-2024-36827An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of ebookmeta before v1.2.8 allows attackers to access sensPyPI · ebookmeta · fixed in 1.2.8
- CVE-2024-37388An XML External Entity (XXE) vulnerability in the ebookmeta.get_metadata function of lxml before v4.9.1 allows attackers to access sensitivePyPI · ebookmeta · fixed in 1.2.8
- CVE-2024-3408Authentication Bypass and RCE in man-group/dtalePyPI · dtale
- CVE-2024-2965Denial-of-Service in LangChain SitemapLoader in langchain-ai/langchainPyPI · langchain, langchain-community · fixed in 0.2.5
- CVE-2024-2032Race Condition Vulnerability in zenml-io/zenmlPyPI · zenml · fixed in 0.55.5
- CVE-2024-5187Arbitrary File Overwrite in download_model_with_test_data in onnx/onnxPyPI · onnx · fixed in 1.16.2
- CVE-2024-3429Path Traversal in parisneo/lollmsPyPI · lollms · fixed in 9.5.0
- CVE-2024-4888Arbitrary File Deletion in BerriAI/litellmPyPI · litellm · fixed in 1.35.36