Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-2195Remote Code Execution in aimhubio/aimPyPI · aim
- CVE-2024-2196CSRF Vulnerability in aimhubio/aimPyPI · aim
- CVE-2024-2217Improper Access Control in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-3098Prompt Injection leading to Arbitrary Code Execution in run-llama/llama_indexPyPI · llama-index-core · fixed in 0.10.24
- CVE-2024-1728Local File Inclusion in gradio-app/gradioPyPI · gradio · fixed in 4.19.2
- CVE-2024-3568Arbitrary Code Execution via Deserialization in huggingface/transformersPyPI · transformers · fixed in 4.38.0
- CVE-2024-2952Server-Side Template Injection in BerriAI/litellmPyPI · litellm · fixed in 1.34.42
- CVE-2024-22423yt-dlp `--exec` command injection when using `%q` in yt-dlp on WindowsPyPI · yt-dlp · fixed in 2024.04.09
- CVE-2024-29905DIRAC: Unauthorized users can read proxy contents during generationPyPI · dirac · fixed in 8.0.41
- CVE-2024-28732An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) PyPI · ryu
- CVE-2024-0081 NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources withouPyPI · nemo-asr
- CVE-2024-31215Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database checkPyPI · mobsf · fixed in 3.9.8
- CVE-2024-30266Wasmtime vulnerable to panic when using a dropped extenref-typed element segmentPyPI · wasmtime
- CVE-2024-3116Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4PyPI · pgadmin4 · fixed in 8.5
- CVE-2024-30265Voilà Local file inclusionPyPI · voila · fixed in 0.2.17, 0.3.8, 0.4.4 and more
- CVE-2024-28219In _imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy.PyPI · pillow · fixed in 10.3.0
- CVE-2024-30248Piccolo Admin's raw SVG loading may lead to complete data compromise from admin pagePyPI · piccolo-admin · fixed in 1.3.2
- CVE-2024-1729Timing Attack Vulnerability in gradio-app/gradioPyPI · gradio · fixed in 4.19.2
- CVE-2024-29640An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid paramePyPI · aliyundrive-webdav
- CVE-2024-29888Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery methodPyPI · saleor · fixed in 3.14.61, 3.15.37, 3.16.34 and more
- CVE-2024-28233XSS in JupyterHub via Self-XSS leveraged by Cookie TossingPyPI · jupyterhub · fixed in 4.1.0
- CVE-2024-27091GeoNode stored XSS to full account takeoverPyPI · geonode · fixed in 4.2.3
- CVE-2024-2206SSRF Vulnerability in gradio-app/gradioPyPI · gradio · fixed in 4.18.0
- CVE-2024-28335Lektor before 3.3.11 does not sanitize DB path traversal.PyPI · lektor · fixed in 3.3.11, 3.4.0b11
- CVE-2024-29735Apache Airflow: Potentially harmful permission changing by log task handlerPyPI · apache-airflow · fixed in 2.8.4
- CVE-2024-1455Billion Laughs Attack leading to DoS in langchain-ai/langchainPyPI · langchain-core · fixed in 0.1.35
- CVE-2024-29199Unauthenticated views may expose information to anonymous usersPyPI · nautobot · fixed in 1.6.16, 2.1.9
- CVE-2024-29189ansys-geometry-core OS Command Injection vulnerabilityPyPI · ansys-geometry-core · fixed in 0.3.3, 0.4.12
- CVE-2024-1603confirmedPyPI · paddlepaddle
- CVE-2024-29190MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)PyPI · mobsf, mobsfscan · fixed in 3.9.7, 0.3.8