Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-2928Local File Inclusion (LFI) via URI Fragment Parsing in mlflow/mlflowPyPI · mlflow · fixed in 2.11.3
- CVE-2024-3095SSRF in Langchain Web Research Retriever in langchain-ai/langchainPyPI · langchain-community · fixed in 0.2.9
- CVE-2024-5206Sensitive Data Leakage in sklearn.feature_extraction.text.TfidfVectorizer in scikit-learn/scikit-learnPyPI · scikit-learn · fixed in 1.5.0
- CVE-2024-2035Improper Authorization in zenml-io/zenmlPyPI · zenml · fixed in 0.56.2
- CVE-2024-4890Blind SQL Injection in berriai/litellmPyPI · litellm
- CVE-2024-2171Stored XSS in zenml-io/zenmlPyPI · zenml · fixed in 0.56.2
- CVE-2024-5225SQL Injection in berriai/litellmPyPI · litellm · fixed in 1.40.0
- CVE-2024-0520Remote Code Execution due to Full Controlled File Write in mlflow/mlflowPyPI · mlflow · fixed in 2.9.0
- CVE-2024-2213Improper Authentication in zenml-io/zenmlPyPI · zenml · fixed in 0.56.3
- CVE-2024-5550Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3PyPI · h2o
- CVE-2024-2383Clickjacking Vulnerability in zenml-io/zenmlPyPI · zenml · fixed in 0.56.3
- CVE-2024-4881Path Traversal in parisneo/lollmsPyPI · lollms · fixed in 5.9.0, 9.5.0
- CVE-2024-3099Denial of Service and Data Model Poisoning via URL Encoding in mlflow/mlflowPyPI · mlflow · fixed in 2.11.3
- CVE-2024-4325Server-Side Request Forgery (SSRF) in gradio-app/gradioPyPI · gradio
- CVE-2024-4941Local File Inclusion in JSON component in gradio-app/gradioPyPI · gradio · fixed in 4.31.3, 4.31.4
- CVE-2024-5452RCE via Property/Class Pollution in lightning-ai/pytorch-lightningPyPI · lightning, pytorch-lightning · fixed in 2.3.3
- CVE-2024-35178Jupyter server on Windows discloses Windows user password hashPyPI · jupyter-server · fixed in 2.14.1
- CVE-2024-5629Out-of-bounds read in bson module of PyMongoPyPI · pymongo · fixed in 4.6.3
- CVE-2024-37065Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to ruPyPI · skops
- CVE-2024-37064Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciouslPyPI · ydata-profiling
- CVE-2024-37063A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to PyPI · ydata-profiling
- CVE-2024-37062Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicouslyPyPI · ydata-profiling
- CVE-2024-37061Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLprojectPyPI · mlflow
- CVE-2024-37060Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously craftPyPI · mlflow
- CVE-2024-37059Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-37058Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-37057Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uplPyPI · mlflow
- CVE-2024-37056Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaPyPI · mlflow
- CVE-2024-37055Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaPyPI · mlflow
- CVE-2024-37054Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploadPyPI · mlflow