Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-1141Glance-store: glance store access key logged in debug log levelPyPI · glance-store · fixed in 4.7.0
- CVE-2024-23637OctoPrint Unverified Password Change via Access Control SettingsPyPI · octoprint · fixed in 1.10.0rc1
- CVE-2023-47116Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` ProtectionsPyPI · label-studio · fixed in 1.11.0
- CVE-2024-24567raw_call `value=` kwargs not disabled for static and delegate callsPyPI · vyper · fixed in 0.4.0b1, 0.4.0
- CVE-2024-22193vantage6 unencrypted task can be created in encrypted collaborationPyPI · vantage6 · fixed in 4.2.0
- CVE-2024-21671vantage6 username timing attackPyPI · vantage6, vantage6-server · fixed in 4.2.0
- CVE-2024-21653vantage6 insecure SSH configuration for node and server containersPyPI · vantage6, vantage6-node +1 · fixed in 4.2.0
- CVE-2024-21649Remote code execution PyPI · vantage6 · fixed in 4.2.0
- CVE-2024-23334aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalPyPI · aiohttp · fixed in 3.9.2
- CVE-2024-23829aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separatorsPyPI · aiohttp · fixed in 3.9.2
- CVE-2024-0960flink-extended ai-flow workflow_command.py cloudpickle.loads deserializationPyPI · ai-flow
- CVE-2024-0937van_der_Schaar LAB synthcity PKL File load_from_file deserializationPyPI · synthcity
- CVE-2024-0936van_der_Schaar LAB TemporAI PKL File load_from_file deserializationPyPI · temporai
- CVE-2024-0727PKCS12 Decoding crashesPyPI · cryptography · fixed in 42.0.2
- CVE-2023-50944Apache Airflow: Bypass permission verification to read code of other dagsPyPI · apache-airflow · fixed in 2.8.1, 2.8.1rc1
- CVE-2023-50943Apache Airflow: Potential pickle deserialization vulnerability in XComsPyPI · apache-airflow · fixed in 2.8.1, 2.8.1rc1
- CVE-2023-51702Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer servicePyPI · apache-airflow, apache-airflow-providers-cncf-kubernetes · fixed in 2.6.1, 7.0.0
- CVE-2024-23633 Label Studio XSS Vulnerability on Data ImportPyPI · label-studio · fixed in 1.10.1
- CVE-2023-47115Label Studio XSS Vulnerability on Avatar UploadPyPI · label-studio · fixed in 1.9.2
- CVE-2024-23341TuiTse-TsuSin html injection vulnerability in `tuitse_html` functionPyPI · tuitse-tsusin · fixed in 1.3.2
- CVE-2024-22417Whoogle Search Cross-site Scripting vulnerabilityPyPI · whoogle-search · fixed in 0.8.4
- CVE-2024-22205Whoogle Search Server Side Request Forgery vulnerabilityPyPI · whoogle-search · fixed in 0.8.4
- CVE-2024-22204Whoogle Search Limited File Write vulnerabilityPyPI · whoogle-search · fixed in 0.8.4
- CVE-2024-22203Whoogle Search Server Side Request Forgery vulnerabilityPyPI · whoogle-search · fixed in 0.8.4
- CVE-2023-49657Apache Superset: Stored XSS in Dashboard Title and Chart TitlePyPI · apache-superset · fixed in 3.0.3
- CVE-2024-23345Nautobot has XSS potential in rendered Markdown fieldsPyPI · nautobot · fixed in 2.1.2, 1.6.10
- CVE-2024-23342python-ecdsa vulnerable to Minerva attack on P-256PyPI · ecdsa
- CVE-2024-23750MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprPyPI · metagpt · fixed in 0.6.5
- CVE-2024-23751LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQuerPyPI · llama-index · fixed in 0.9.35
- CVE-2024-23752GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrarPyPI · pandasai