Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-34062tqdm CLI arguments injection attackPyPI · tqdm · fixed in 4.66.3
- CVE-2024-31636An issue in LIEF v.0.14.1 allows a local attacker to obtain sensitive information via the name parameter of the machd_reader.c component.PyPI · lief · fixed in 0.15.0
- CVE-2024-4216XSS vulnerability in /settings/store API response json payload in pgAdmin 4PyPI · pgadmin4 · fixed in 8.6
- CVE-2024-4215The Multi Factor Authentication bypass vulnerability in pgAdmin 4PyPI · pgadmin4 · fixed in 8.6
- CVE-2024-34061Reflected cross site scripting in changedetection.ioPyPI · changedetection-io · fixed in 0.45.22
- CVE-2024-30251Denial of service when trying to parse malformed POST requests in aiohttpPyPI · aiohttp · fixed in 3.9.4
- CVE-2024-3955Arbitrary code execution in CraftBeerPi 4PyPI · cbpi4 · fixed in 4.4.1.a1
- CVE-2024-32882Permission check bypass when editing a model with per-field restrictions in wagtailPyPI · wagtail · fixed in 6.0.3
- CVE-2024-32979Reflected Cross-site Scripting potential in all object list views in NautobotPyPI · nautobot · fixed in 1.6.20, 2.2.3
- CVE-2024-33763lunasvg v2.3.9 was discovered to contain a stack-buffer-underflow at lunasvg/source/layoutcontext.cpp.PyPI · lunasvg
- CVE-2024-33764lunasvg v2.3.9 was discovered to contain a stack-overflow at lunasvg/source/element.h.PyPI · lunasvg
- CVE-2024-33766lunasvg v2.3.9 was discovered to contain an FPE (Floating Point Exception) at blend_transformed_tiled_argb.isra.0.PyPI · lunasvg
- CVE-2024-33767lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source.PyPI · lunasvg
- CVE-2024-33768lunasvg v2.3.9 was discovered to contain a segmentation violation via the component composition_solid_source_over.PyPI · lunasvg
- CVE-2024-4340Passing a heavily nested list to sqlparse.parse() leads to a Denial of Service due to RecursionError.PyPI · sqlparse · fixed in 0.5.0
- CVE-2023-46960Buffer Overflow vulnerability in PyPXE v.1.8.4 allows a remote attacker to cause a denial of service via the handle function in the tftp modPyPI · pypxe
- CVE-2023-1000cyanomiko dcnnt-py Notification notifications.py main command injectionPyPI · dcnnt · fixed in 0.9.1
- CVE-2024-32880pyLoad allows upload to arbitrary folder lead to RCEPyPI · pyload-ng
- CVE-2024-32651Server Side Template Injection in Jinja2 allows Remote Command ExecutionPyPI · changedetection-io · fixed in 0.45.21
- CVE-2024-32649vyper performs double eval of the argument of sqrtPyPI · vyper · fixed in 0.4.0
- CVE-2024-32648vyper default functions don't respect nonreentrancy keysPyPI · vyper · fixed in 0.3.0
- CVE-2024-32647vyper performs double eval of raw_args in create_from_blueprintPyPI · vyper · fixed in 0.4.0
- CVE-2024-32646vyper performs double eval of the slice args when buffer from adhoc locationsPyPI · vyper · fixed in 0.4.0
- CVE-2024-32645vyper performs incorrect topic logging in raw_logPyPI · vyper · fixed in 0.4.0
- CVE-2024-32481vyper's range(start, start + N) reverts for negative numbersPyPI · vyper · fixed in 0.4.0b1, 0.4.0
- CVE-2024-33663python-jose through 3.3.0 has algorithm confusion with OpenSSH ECDSA keys and other key formats.PyPI · python-jose · fixed in 3.4.0
- CVE-2024-33664python-jose through 3.3.0 allows attackers to cause a denial of service (resource consumption) during a decode via a crafted JSON Web EncrypPyPI · python-jose · fixed in 3.4.0
- CVE-2024-32879social-auth-app-django Improper Handling of Case Sensitivity vulnerabilityPyPI · social-auth-app-django · fixed in 5.4.1
- CVE-2024-31208Synapse's V2 state resolution weakness allows DoS from remote room membersPyPI · matrix-synapse · fixed in 1.105.1
- CVE-2024-28717An issue in OpenStack Storlets yoga-eom allows a remote attacker to execute arbitrary code via the gateway.py component.PyPI · storlets · fixed in 13.0.0.0rc1