Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-29733Apache Airflow FTP Provider: FTP_TLS instance with unverified SSL contextPyPI · apache-airflow-providers-ftp · fixed in 3.7.0
- CVE-2024-1681Log Injection Vulnerability in corydolphin/flask-corsPyPI · flask-cors · fixed in 4.0.1
- CVE-2024-31584Pytorch before v2.2.0 has an Out-of-bounds Read vulnerability via the component torch/csrc/jit/mobile/flatbuffer_loader.cpp.PyPI · torch · fixed in 2.2.0
- CVE-2024-32474Sentry's superuser cleartext password leaked in logsPyPI · sentry · fixed in 24.4.1
- CVE-2024-27306aiohttp vulnerable to XSS on index pages for static file handlingPyPI · aiohttp · fixed in 3.9.4
- CVE-2024-31869Apache Airflow: Sensitive configuration for providers displayed when "non-sensitive-only" config usedPyPI · apache-airflow · fixed in 2.9.0
- CVE-2024-31580PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component /runtime/vararg_functions.cpp.PyPI · torch, torch-npu · fixed in 2.2.0
- CVE-2024-31583Pytorch before version v2.2.0 was discovered to contain a use-after-free vulnerability in torch/csrc/jit/mobile/interpreter.cpp.PyPI · torch · fixed in 2.2.0
- CVE-2024-3660Arbitrary code injection vulnerability in Keras framework < 2.13PyPI · keras · fixed in 2.13.1rc0
- CVE-2024-1561Arbitrary Local File Read via Component Method Invocation in gradio-app/gradioPyPI · gradio · fixed in 4.13.0
- CVE-2024-2083Directory Traversal in zenml-io/zenmlPyPI · zenml · fixed in 0.55.5
- CVE-2024-3571Path Traversal in langchain-ai/langchainPyPI · langchain · fixed in 0.0.353
- CVE-2024-2912Insecure Deserialization Leading to RCE in bentoml/bentomlPyPI · bentoml · fixed in 1.2.5
- CVE-2024-3574Authorization Header Leak During Cross-Domain Redirect in scrapy/scrapyPyPI · scrapy · fixed in 1.8.4, 2.11.1
- CVE-2024-3271Command Injection in run-llama/llama_indexPyPI · llama-index-core · fixed in 0.10.24
- CVE-2024-2260Session Fixation Vulnerability in zenml-io/zenmlPyPI · zenml · fixed in 0.56.2
- CVE-2024-1135HTTP Request Smuggling in benoitc/gunicornPyPI · gunicorn · fixed in 22.0.0
- CVE-2024-3573Local File Inclusion (LFI) via Scheme Confusion in mlflow/mlflowPyPI · mlflow · fixed in 2.10.0
- CVE-2024-1558Path Traversal Vulnerability in mlflow/mlflowPyPI · mlflow · fixed in 2.12.1
- CVE-2024-1594Local File Read via Path Traversal in mlflow/mlflowPyPI · mlflow
- CVE-2024-3572XML External Entity (XXE) Vulnerability in scrapy/scrapyPyPI · scrapy · fixed in 2.11.1, 1.8.4
- CVE-2024-1183SSRF Vulnerability in gradio-app/gradioPyPI · gradio · fixed in 4.10.0
- CVE-2024-1593Path Traversal via Parameter Smuggling in mlflow/mlflowPyPI · mlflow
- CVE-2024-1483Path Traversal Vulnerability in mlflow/mlflowPyPI · mlflow · fixed in 2.12.1
- CVE-2024-3575Cross-site Scripting (XSS) - Stored in mindsdb/mindsdbPyPI · mindsdb
- CVE-2024-1560Path Traversal Vulnerability in mlflow/mlflowPyPI · mlflow
- CVE-2024-3772Regular expression denial of service in Pydantic < 2.4.0PyPI · pydantic · fixed in 2.4.0, 1.10.13
- CVE-2024-32005Local File Inclusion in NiceGUI leaflet componentPyPI · nicegui · fixed in 1.4.21
- CVE-2024-28718An issue in OpenStack magnum yoga-eom version allows a remote attacker to execute arbitrary code via the cert_manager.py.PyPI · magnum · fixed in 14.1.2, 15.0.2, 16.0.2 and more
- CVE-2023-29483eventlet before 0.35.2, as used in dnspython before 2.6.0, allows remote attackers to interfere with DNS name resolution by quickly sending PyPI · dnspython, eventlet · fixed in 2.6.1, 0.35.2