Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-37053Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-37052Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-4253Command Injection in gradio-app/gradioPyPI · gradio · fixed in 4.29.0
- CVE-2024-3829Arbitrary File Read and Write during Snapshot Recovery in qdrant/qdrantPyPI · qdrant-client · fixed in 1.9.0
- CVE-2024-35196Slack integration leaks sensitive information in logs in SentryPyPI · sentry · fixed in 24.5.0
- CVE-2024-5565Prompt Injection in "ask" API with visualization leads to RCEPyPI · vanna
- CVE-2024-35189Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in FidesPyPI · ethyca-fides · fixed in 2.37.0
- CVE-2024-35228Improper Handling of Insufficient Permissions in WagtailPyPI · wagtail · fixed in 6.0.5, 6.1.2
- CVE-2024-3924Code Injection in huggingface/text-generation-inferencePyPI · text-generation · fixed in 2.0.0
- CVE-2024-4330Path Traversal in parisneo/lollms-webuiPyPI · lollms
- CVE-2024-34715Partial Password Exposure Vulnerability in Fides Webserver LogsPyPI · ethyca-fides · fixed in 2.37.0
- CVE-2024-36112Nautobot dynamic-group-members doesn't enforce permission restrictions on member objectsPyPI · nautobot · fixed in 1.6.23, 2.2.5, 2.3.0b1
- CVE-2024-36110Cross-site scripting in ansibleguy-webuiPyPI · ansibleguy-webui · fixed in 0.0.21
- CVE-2024-36105dbt allows Binding to an Unrestricted IP Address via socketsocketPyPI · dbt-core · fixed in 1.6.15, 1.7.15, 1.8.1
- CVE-2022-4969bwoodsend rockhopper Binary Parser ragged_array.c count_rows buffer overflowPyPI · rockhopper · fixed in 0.2.0
- CVE-2024-35374Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to PyPI · mocodo · fixed in 4.2.7
- CVE-2024-28188jupyter-scheduler's endpoint is missing authenticationPyPI · jupyter-scheduler · fixed in 1.1.6, 1.2.1, 1.8.2 and more
- CVE-2024-26139OpenCTI Authenticated Privilege EscalationPyPI · pycti · fixed in 5.12.32
- CVE-2024-32969vantage6 collaboration admins can extend their influence by expanding the collaborationPyPI · vantage6 · fixed in 4.5.0rc3
- CVE-2024-35180OMERO.web JSONP callback vulnerabilityPyPI · omero-web · fixed in 5.26.0
- CVE-2024-35056NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions.PyPI · ait-core
- CVE-2024-35057An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet.PyPI · ait-core
- CVE-2024-35058An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string.PyPI · ait-core
- CVE-2024-35059An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.PyPI · ait-core
- CVE-2024-35061NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-thPyPI · ait-core
- CVE-2024-36039PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.PyPI · pymysql · fixed in 1.1.1
- CVE-2024-35195Requests `Session` object does not verify requests after making first request with verify=FalsePyPI · requests · fixed in 2.32.0
- CVE-2024-1968Authorization Header Leakage in scrapy/scrapy on Scheme Change RedirectsPyPI · scrapy · fixed in 2.0.0, 2.11.2
- CVE-2024-34083STARTTLS unencrypted commands injectionPyPI · aiosmtpd · fixed in 1.4.6
- CVE-2024-4264Remote Code Execution in berriai/litellmPyPI · litellm