Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-27318Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor protPyPI · onnx · fixed in 1.16.0
- CVE-2024-26152Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config PyPI · label-studio · fixed in 1.11.0
- CVE-2024-26151Potentially untrusted input is rendered as HTML in final outputPyPI · mjml · fixed in 0.11.0
- CVE-2024-26130cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash overridePyPI · cryptography · fixed in 42.0.4
- CVE-2024-23346pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_stringPyPI · pymatgen · fixed in 2024.2.20
- CVE-2024-25141Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongoPyPI · apache-airflow-providers-mongo · fixed in 4.0.0
- CVE-2024-1647pyhtml2pdf 0.0.6 - Local File Read via Server Side XSSPyPI · pyhtml2pdf
- CVE-2024-26134CBOR2 decoder has potential buffer overflowPyPI · cbor2 · fixed in 5.6.2
- CVE-2024-24826Out-of-bounds read in QuickTimeVideo::NikonTagsDecoder in Exiv2PyPI · exiv2 · fixed in 0.16.1
- CVE-2024-25112Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2PyPI · exiv2 · fixed in 0.16.1
- CVE-2023-6681Jwcrypto: denail of service via specifically crafted jwePyPI · jwcrypto · fixed in 1.5.1
- CVE-2024-25711diffoscope before 256 allows directory traversal via an embedded filename in a GPG file.PyPI · diffoscope · fixed in 256
- CVE-2024-21624Potential Information Leak in User-Constructed Message Templates in nonebot2PyPI · nonebot2 · fixed in 2.2.0
- CVE-2024-24825TokenManager not checking permissions on cached tokens in DIRACPyPI · dirac · fixed in 8.0.37
- CVE-2024-24563Vyper array negative index vulnerabilityPyPI · vyper · fixed in 0.4.0, 0.4.0b1
- CVE-2024-24811Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query executionPyPI · products-sqlalchemyda · fixed in 2.2
- CVE-2024-24591A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploadedPyPI · clearml · fixed in 1.14.2
- CVE-2024-24590Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliPyPI · clearml · fixed in 1.14.3rc0
- CVE-2024-0690Ansible-core: possible information leak in tasks that ignore ansible_no_log configurationPyPI · ansible-core · fixed in 2.14.14, 2.16.3, 2.15.9 and more
- CVE-2024-24808pyLoad open redirect vulnerability due to improper validation of the is_safe_url functionPyPI · pyload-ng · fixed in 0.5.0b3.dev79
- CVE-2024-24680An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2.PyPI · django · fixed in 3.2.24, 4.2.10, 5.0.2
- CVE-2024-0964LFI in GradioPyPI · gradio · fixed in 4.9.0
- CVE-2024-24595Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaPyPI · clearml
- CVE-2024-24559Vyper SHA3 code generation bugPyPI · vyper · fixed in 0.4.0, 0.4.0b1
- CVE-2023-50782Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659PyPI · cryptography · fixed in 42.0.0
- CVE-2023-50781M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657PyPI · m2crypto
- CVE-2024-24762python-multipart vulnerable to content-type header Regular expression Denial of ServicePyPI · fastapi, python-multipart · fixed in 0.109.1, 0.0.7
- CVE-2024-24560Vyper external calls can overflow return data to return input bufferPyPI · vyper · fixed in 0.4.0, 0.4.0b1
- CVE-2024-21485Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packaPyPI · dash, dash-core-components +1 · fixed in 2.15.0, 2.13.0, 2.0.0
- CVE-2024-24561Vyper bounds check on built-in `slice()` function can be overflowedPyPI · vyper · fixed in 0.4.0b1, 0.4.0