Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-1727CSRF Vulnerability in gradio-app/gradioPyPI · gradio · fixed in 4.19.2
- CVE-2024-29019ESPHome vulnerable to Authentication bypass via Cross site request forgeryPyPI · esphome · fixed in 2024.3.0
- CVE-2024-29033GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspacePyPI · oauthenticator · fixed in 16.3.0
- CVE-2024-29032`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary codePyPI · qiskit-ibm-runtime · fixed in 0.21.2
- CVE-2024-28179Jupyter Server Proxy's Websocket Proxying does not require authenticationPyPI · jupyter-server-proxy · fixed in 4.1.1, 3.2.3
- CVE-2024-21503Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_ePyPI · black · fixed in 24.3.0
- CVE-2024-28865django-wiki denial of service via regular expressionPyPI · wiki · fixed in 0.10.1
- CVE-2024-28237OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settingsPyPI · octoprint · fixed in 1.10.0, 1.10.0rc3
- CVE-2023-41334astropy vulnerable to RCE in TranformGraph().to_dot_graph functionPyPI · astropy · fixed in 5.3.3
- CVE-2024-29156In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to saPyPI · yaql · fixed in 3.0.0
- CVE-2024-22513djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure.PyPI · djangorestframework-simplejwt · fixed in 5.5.1
- CVE-2024-27351In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and thPyPI · django · fixed in 3.2.25, 4.2.11, 5.0.3
- CVE-2024-23823CORS settings overly permissive in vantage6PyPI · vantage6, vantage6-server · fixed in 4.3.0, 4.2.1
- CVE-2024-24770Username timing attack on recover password/MFA token in vantage6PyPI · vantage6 · fixed in 4.3.0
- CVE-2024-28746Apache Airflow: Ignored Airflow PermissionsPyPI · apache-airflow · fixed in 2.8.3rc1
- CVE-2024-28423Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py.PyPI · airflow-diagrams
- CVE-2024-28425greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py.PyPI · greykite
- CVE-2024-27097Potential log injection in reset user endpoint in ckanPyPI · ckan · fixed in 2.9.11, 2.10.4
- CVE-2024-27305SMTP smuggling in aiosmtpdPyPI · aiosmtpd · fixed in 1.4.5
- CVE-2024-26164Microsoft Django Backend for SQL Server Remote Code Execution VulnerabilityPyPI · mssql-django · fixed in 1.4.1
- CVE-2024-27758In RPyC before 6.0.0, when a server exposes a method that calls the attribute named __array__ for a client-provided netref (e.g., np.array(cPyPI · rpyc · fixed in 6.0.0
- CVE-2024-28184WeasyPrint allows the attachment of arbitrary files and URLs to a PDFPyPI · weasyprint · fixed in 61.2
- CVE-2024-2319Cross-Site Scripting vulnerability in Django MarkdownXPyPI · django-markdownx
- CVE-2024-2044Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4PyPI · pgadmin4 · fixed in 8.4
- CVE-2024-0818Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6PyPI · paddlepaddle
- CVE-2024-0917remote code execution in paddlepaddle/paddle 2.6.0PyPI · paddlepaddle
- CVE-2024-0815Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0PyPI · paddlepaddle · fixed in 3.0.0-beta0
- CVE-2024-0817Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0PyPI · paddlepaddle · fixed in 3.0.0-beta0
- CVE-2024-28102JWCrypto vulnerable to JWT bomb Attack in `deserialize` functionPyPI · jwcrypto · fixed in 1.5.6
- CVE-2024-27287ESPHome vulnerable to stored Cross-site Scripting in edit configuration file APIPyPI · esphome · fixed in 2024.2.2