Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-6975Path Traversal: '\..\filename'PyPI · mlflow · fixed in 2.9.2
- CVE-2023-6974Server-Side Request Forgery (SSRF)PyPI · mlflow · fixed in 2.9.2
- CVE-2023-6730Deserialization of Untrusted Data in huggingface/transformersPyPI · transformers · fixed in 4.36.0
- CVE-2023-49734Apache Superset: Privilege Escalation VulnerabilityPyPI · apache-superset · fixed in 2.1.3, 3.0.2
- CVE-2023-49736Apache Superset: SQL Injection on where_in JINJA macroPyPI · apache-superset · fixed in 2.1.3, 3.0.2
- CVE-2023-46104Apache Superset: Allows for uncontrolled resource consumption via a ZIP bombPyPI · apache-superset · fixed in 2.1.2, 3.1.0rc1
- CVE-2023-6940Command InjectionPyPI · mlflow · fixed in 2.9.2
- CVE-2023-5115Ansible: malicious role archive can cause ansible-galaxy to overwrite arbitrary filesPyPI · ansible · fixed in 8.5.0
- CVE-2023-6909Path Traversal: '\..\filename' in mlflow/mlflowPyPI · mlflow · fixed in 2.9.2
- CVE-2023-48795The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypasPyPI · paramiko · fixed in 3.4.0
- CVE-2023-50715User accounts disclosed to unauthenticated actors on the LANPyPI · homeassistant · fixed in 2023.12.3
- CVE-2023-6831Path Traversal: '\..\filename' in mlflow/mlflowPyPI · mlflow · fixed in 2.9.2
- CVE-2023-6572Command Injection in gradio-app/gradioPyPI · gradio · fixed in 4.14.0
- CVE-2023-6569External Control of File Name or Path in h2oai/h2o-3PyPI · h2o · fixed in 3.46.0.1
- CVE-2023-50248CKAN out of memory error when submitting the dataset form with a specially-crafted fieldPyPI · ckan · fixed in 2.9.10, 2.10.3
- CVE-2023-46247Vyper has incorrect storage layout for contracts containing large arraysPyPI · vyper · fixed in 0.3.8
- CVE-2023-6753Path Traversal in mlflow/mlflowPyPI · mlflow · fixed in 2.9.2
- CVE-2023-50263Nautobot allows unauthenticated db-file-storage viewsPyPI · nautobot · fixed in 1.6.7, 2.0.6
- CVE-2023-5764Ansible: template injectionPyPI · ansible-core · fixed in 2.16.1, 2.15.8, 2.14.12
- CVE-2023-35625Azure Machine Learning Compute Instance for SDK Users Information Disclosure VulnerabilityPyPI · mltable · fixed in 1.5.0
- CVE-2023-6709Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflowPyPI · mlflow · fixed in 2.9.2
- CVE-2023-50423Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)PyPI · sap-xssec · fixed in 4.1.0
- CVE-2023-43364main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.PyPI · searchor · fixed in 2.4.2
- CVE-2023-49796MindsDB Arbitrary File Write vulnerabilityPyPI · mindsdb · fixed in 23.11.4.1
- CVE-2023-49795MindsDB Server-Side Request Forgery vulnerabilityPyPI · mindsdb · fixed in 23.11.4.1
- CVE-2023-49797Local Privilege Escalation in pyinstaller on WindowsPyPI · pyinstaller · fixed in 5.13.1
- CVE-2023-48311Any image allowed by defaultPyPI · dockerspawner · fixed in 13.0.0
- CVE-2023-6568Reflected XSS via Content-Type Header in mlflow/mlflowPyPI · mlflow · fixed in 2.9.0, 2.9.1
- CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alPyPI · pubnub · fixed in 7.3.0
- CVE-2023-49297Unsafe YAML deserialization in PyDrive2PyPI · pydrive2 · fixed in 1.16.2