Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-22889Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crPyPI · plone
- CVE-2024-28088LangChain through 0.1.10 allows ../ directory traversal by an actor who is able to control the final part of the path parameter in a load_chPyPI · langchain, langchain-core · fixed in 0.1.11, 0.0.339, 0.1.30
- CVE-2024-2057LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgeryPyPI · langchain-community
- CVE-2024-26280Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)PyPI · apache-airflow · fixed in 2.8.2
- CVE-2024-27292Docassemble unauthorized access through URL manipulationPyPI · docassemble-base, docassemble-webapp · fixed in 1.4.97
- CVE-2024-27291Docassemble open redirectPyPI · docassemble-webapp · fixed in 1.4.97
- CVE-2024-27290Docassemble HTML and javascript injectionPyPI · docassemble-webapp · fixed in 1.4.97
- CVE-2024-27906Apache Airflow: Dag Code and Import Error Permissions IgnoredPyPI · apache-airflow · fixed in 2.8.2
- CVE-2024-27083Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)PyPI · flask-appbuilder · fixed in 4.2.1
- CVE-2024-25128Flask-AppBuilder incorrect authentication when using auth type OpenID PyPI · flask-appbuilder · fixed in 4.3.11
- CVE-2024-26016Apache Superset: Improper authorization validation on dashboards and charts importPyPI · apache-superset · fixed in 3.0.4, 3.1.1
- CVE-2024-24779Apache Superset: Improper data authorization when creating a new datasetPyPI · apache-superset · fixed in 3.0.4, 3.1.1
- CVE-2024-24772Apache Superset: Improper Neutralisation of custom SQL on embedded contextPyPI · apache-superset · fixed in 3.0.4, 3.1.1
- CVE-2024-24773Apache Superset: Improper validation of SQL statements allows for unauthorized access to dataPyPI · apache-superset · fixed in 3.0.4, 3.1.1
- CVE-2024-27315Apache Superset: Improper error handling on alertsPyPI · apache-superset · fixed in 3.0.4, 3.1.1
- CVE-2024-1892ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpiderPyPI · scrapy · fixed in 2.11.1, 1.8.4
- CVE-2024-25169An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.PyPI · mezzanine
- CVE-2024-25170An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.PyPI · mezzanine
- CVE-2024-25723ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{usPyPI · zenml · fixed in 0.42.2, 0.43.1, 0.44.4 and more
- CVE-2024-24564Vyper extract32 can ready dirty memoryPyPI · vyper · fixed in 0.4.0
- CVE-2024-26149Vyper _abi_decode Memory OverflowPyPI · vyper · fixed in 0.4.0b1, 0.4.0
- CVE-2024-27081ESPHome remote code execution via arbitrary file writePyPI · esphome · fixed in 2024.2.1
- CVE-2024-27444langchain_experimental (aka LangChain Experimental) in LangChain before 0.1.8 allows an attacker to bypass the CVE-2023-44467 fix and executPyPI · langchain-experimental · fixed in 0.0.52
- CVE-2024-27447pretix before 2024.1.1 mishandles file validation.PyPI · pretix · fixed in 2024.1.1
- CVE-2024-27454orjson.loads in orjson before 3.9.15 does not limit recursion for deeply nested JSON documents.PyPI · orjson · fixed in 3.9.15
- CVE-2024-0243Server-side Request Forgery In Recursive URL LoaderPyPI · langchain, langchain-exa · fixed in 0.1.0
- CVE-2024-21502Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath_mul function PyPI · fastecdsa · fixed in 2.3.2
- CVE-2024-27133Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.PyPI · mlflow · fixed in 2.10.0
- CVE-2024-27132Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.PyPI · mlflow · fixed in 2.10.0
- CVE-2024-27319Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions PyPI · onnx · fixed in 1.16.0