Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-5023Arbitrary File Read Vulnerability in ConsoleMe via Limited Git command RCEPyPI · consoleme · fixed in 1.4.0
- CVE-2024-4078Arbitrary Code Execution in parisneo/lollmsPyPI · lollms · fixed in 9.5.0
- CVE-2024-4263Improper Access Control in mlflow/mlflowPyPI · mlflow · fixed in 2.10.1
- CVE-2024-4181Command Injection in run-llama/llama_indexPyPI · llama-index, llama-index-llms-rungpt · fixed in 0.10.13, 0.1.3
- CVE-2024-3848Path Traversal Bypass in mlflow/mlflowPyPI · mlflow · fixed in 2.12.1
- CVE-2024-4321Local File Inclusion (LFI) in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-32977OctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabledPyPI · octoprint · fixed in 1.10.1
- CVE-2024-32077Apache Airflow: XSS vulnerability in Task Instance Log/Log DetailsPyPI · apache-airflow · fixed in 2.9.1
- CVE-2024-34707Nautobot's BANNER_* configuration can be used to inject arbitrary HTML content into Nautobot pagesPyPI · nautobot · fixed in 1.6.22, 2.2.4
- CVE-2024-34359llama-cpp-python vulnerable to Remote Code Execution by Server-Side Template Injection in Model MetadataPyPI · llama-cpp-python · fixed in 0.2.72
- CVE-2024-32874In Frigate, Malicious Long Unicode filenames may cause a Multiple Application-level Denial of ServicePyPI · frigate · fixed in 0.13.2
- CVE-2024-28148Apache Superset: Incorrect datasource authorization on explore REST API PyPI · apache-superset · fixed in 3.1.2
- CVE-2024-34078html-sanitizer allows arbitrary HTML present after sanitization because of unicode normalizationPyPI · html-sanitizer · fixed in 2.4.2
- CVE-2024-34069Werkzeug's improper usage of a pathname and improper CSRF protection results in the remote command executionPyPI · werkzeug · fixed in 3.0.3
- CVE-2024-34064Jinja vulnerable to HTML attribute injection when passing user input as keys to xmlattr filterPyPI · jinja2 · fixed in 3.1.4
- CVE-2024-32982Litestar and Starlite affected by Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')PyPI · litestar, starlite · fixed in 2.8.3, 2.7.2, 2.6.4 and more
- CVE-2024-34246wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platfoPyPI · pywasm3
- CVE-2024-34249wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/sPyPI · pywasm3
- CVE-2024-34252wasm3 v0.5.0 was discovered to contain a global buffer overflow which leads to segmentation fault via the function "PreserveRegisterIfOccupiPyPI · pywasm3
- CVE-2024-34483OFPGroupDescStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPBucket.len=0.PyPI · ryu
- CVE-2024-34484OFPBucket in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via action.len=0.PyPI · ryu
- CVE-2024-34486OFPPacketQueue in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via OFPQueueProp.len=0.PyPI · ryu
- CVE-2024-34487OFPFlowStats in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via inst.length=0.PyPI · ryu
- CVE-2024-34488OFPMultipartReply in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via b.length=0.PyPI · ryu
- CVE-2024-34489OFPHello in parser.py in Faucet SDN Ryu 4.34 allows attackers to cause a denial of service (infinite loop) via length=0.PyPI · ryu
- CVE-2024-34510Gradio before 4.20 allows credential leakage on Windows.PyPI · gradio · fixed in 4.20.0
- CVE-2024-34528WordOps through 3.20.0 has a wo/cli/plugins/stack_pref.py TOCTOU race condition because the conf_path os.open does not use a mode parameter PyPI · wordops · fixed in 3.21.3, 3.21.0
- CVE-2024-34529Nebari through 2024.4.1 prints the temporary Keycloak root password.PyPI · nebari · fixed in 2024.6.1rc2
- CVE-2024-34072Deserialization of Untrusted Data in sagemaker-python-sdkPyPI · sagemaker · fixed in 2.218.0
- CVE-2024-34073Command Injection in sagemaker-python-sdkPyPI · sagemaker · fixed in 2.214.3