Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-52313FPE in paddle.argmin and paddle.argmaxPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52312Null pointer dereference in paddle.cropPyPI · paddlepaddle · fixed in 2.6.0, 2.6.1
- CVE-2023-52311Command injection in _wget_downloadPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52310Command injection in get_online_pass_intervalPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52309Heap buffer overflow in paddle.repeat_interleavePyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52308FPE in paddle.aminPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52307Stack overflow in paddle.linalg.lu_unpackPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52306FPE in paddle.lerpPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52305FPE in paddle.topkPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52304Stack overflow in paddle.searchsortedPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52303Segfault in paddle.put_along_axisPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-52302Segfault in paddle.nextafterPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-38678Segfault in paddle.modePyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-38677FPE in paddle.linalg.eigPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-38676Segfault in paddle.dotPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-38675FPE in paddle.linalg.matrix_rankPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-38674FPE in paddle.nanmedianPyPI · paddlepaddle · fixed in 2.6.0
- CVE-2023-51663Hail authentication can be bypassed by changing email addressPyPI · hail · fixed in 0.2.127
- CVE-2023-7152MicroPython modselect.c poll_set_add_fd use after freePyPI · micropython-copy, micropython-io +2
- CVE-2023-49438An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to maliciousPyPI · flask-security-too · fixed in 5.3.3
- CVE-2023-51449Make the `/file` secure against file traversal attacksPyPI · gradio · fixed in 4.11.0
- CVE-2023-50731MindsDB has arbitrary file write in file.pyPyPI · mindsdb · fixed in 23.11.4.1
- CVE-2023-51649Nautobot missing object-level permissions enforcement when running Job ButtonsPyPI · nautobot · fixed in 1.6.8, 2.1.0
- CVE-2023-48291Apache Airflow: Improper access control to DAG resourcesPyPI · apache-airflow · fixed in 2.8.0
- CVE-2023-50783Apache Airflow: Improper access control vulnerability on the "varimport" endpointPyPI · apache-airflow · fixed in 2.8.0
- CVE-2023-47265Apache Airflow: DAG Params alllow to embed unchecked JavascriptPyPI · apache-airflow · fixed in 2.8.0b1
- CVE-2023-49920Apache Airflow: Missing CSRF protection on DAG/triggerPyPI · apache-airflow · fixed in 2.8.0b1, 2.8.0
- CVE-2023-7018Deserialization of Untrusted Data in huggingface/transformersPyPI · transformers · fixed in 4.36.0
- CVE-2023-6977Path Traversal: '\..\filename'PyPI · mlflow · fixed in 2.9.2
- CVE-2023-6976Unrestricted Upload of File with Dangerous TypePyPI · mlflow · fixed in 2.9.2