Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-23730The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_loadPyPI · llama-hub · fixed in 0.0.67
- CVE-2024-23731The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function arguPyPI · embedchain · fixed in 0.1.57
- CVE-2024-23732The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py.PyPI · embedchain · fixed in 0.1.57
- CVE-2024-0521Code Injection in paddlepaddle/paddlePyPI · paddlepaddle · fixed in 2.6.0
- CVE-2024-22420Stored cross site scripting in Markdown Preview in JupyterLabPyPI · jupyterlab, notebook · fixed in 4.0.11, 7.0.7
- CVE-2024-22421Potential authentication and CSRF tokens leak in JupyterLabPyPI · jupyterlab, notebook · fixed in 4.0.11, 3.6.7, 7.0.7
- CVE-2024-23329changedetection.io API endpoint is not secured with API tokenPyPI · changedetection-io · fixed in 0.45.13
- CVE-2023-50447Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2PyPI · pillow · fixed in 10.2.0
- CVE-2024-22415Unsecured endpoints in the jupyter-lsp server extensionPyPI · jupyter-lsp · fixed in 2.2.2
- CVE-2024-22419concat built-in can corrupt memory in vyperPyPI · vyper · fixed in 0.4.0, 0.4.0b1
- CVE-2024-0669Cross-Frame Scripting (XFS) on Plone CMSPyPI · plone · fixed in 6.0.7
- CVE-2024-22416Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalationPyPI · pyload-ng · fixed in 0.5.0b3.dev78
- CVE-2023-6395Mock: privilege escalation for users that can access mock configurationPyPI · templated-dictionary · fixed in 1.4.1
- CVE-2023-46226Apache IoTDB: Remote Code Execution (RCE) risk via the UDFPyPI · apache-iotdb · fixed in 1.3.0
- CVE-2023-52288An issue was discovered in the flaskcode package through 0.0.8 for Python.PyPI · flaskcode
- CVE-2023-52289An issue was discovered in the flaskcode package through 0.0.8 for Python.PyPI · flaskcode
- CVE-2016-20021In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file bPyPI · portage · fixed in 3.0.47
- CVE-2024-21669Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VCPyPI · aries-cloudagent · fixed in 0.10.5, 0.11.0
- CVE-2024-22195Jinja vulnerable to Cross-Site Scripting (XSS)PyPI · jinja2 · fixed in 3.1.3
- CVE-2024-22194cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration codePyPI · case-utils, cdo-local-uuid · fixed in 0.5.1, 0.6.1, 0.7.1 and more
- CVE-2024-22190Untrusted search path under some conditions on Windows allows arbitrary code executionPyPI · gitpython · fixed in 3.1.41
- CVE-2023-45139fonttools XML External Entity Injection (XXE) VulnerabilityPyPI · fonttools · fixed in 4.43.0
- CVE-2023-50974In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json filePyPI · appwrite · fixed in 3.0.0
- CVE-2024-21644pyLoad unauthenticated flask configuration leakagePyPI · pyload-ng · fixed in 0.5.0b3.dev77
- CVE-2024-21645pyLoad Log InjectionPyPI · pyload-ng · fixed in 0.5.0b3.dev77
- CVE-2023-47890pyLoad 0.5.0 is vulnerable to Unrestricted File Upload.PyPI · pyload-ng · fixed in 0.5.0b3.dev75
- CVE-2024-21642D-Tale server-side request forgery through Web uploadsPyPI · dtale · fixed in 3.9.0
- CVE-2023-52323PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.PyPI · pycryptodome, pycryptodomex · fixed in 3.19.1
- CVE-2024-21910Cross-site scripting vulnerability in TinyMCE pluginsPyPI · django-tinymce · fixed in 3.4.0
- CVE-2023-52314Command injection in convert_shape_comparePyPI · paddlepaddle · fixed in 2.6.0