Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-43472An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.PyPI · mlflow · fixed in 2.9.0
- CVE-2023-49080Jupyter Server errors include tracebacks with path informationPyPI · jupyter-server · fixed in 2.11.2
- CVE-2023-49277Reflected Cross-site Scripting Vulnerability in dpastePyPI · dpaste · fixed in 3.8
- CVE-2023-49081aiohttp's ClientSession is vulnerable to CRLF injection via versionPyPI · aiohttp · fixed in 3.9.0
- CVE-2023-49082aiohttp's ClientSession is vulnerable to CRLF injection via methodPyPI · aiohttp · fixed in 3.9.0
- CVE-2023-49083cryptography vulnerable to NULL-dereference when loading PKCS7 certificatesPyPI · cryptography · fixed in 41.0.6
- CVE-2023-42504Apache Superset: Lack of rate limiting allows for possible denial of servicePyPI · apache-superset · fixed in 3.0.0
- CVE-2023-42505Apache Superset: Sensitive information disclosure on db connection detailsPyPI · apache-superset · fixed in 3.0.0
- CVE-2023-42502Apache Superset: Open Redirect VulnerabilityPyPI · apache-superset · fixed in 3.0.0
- CVE-2023-48022Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API.PyPI · ray
- CVE-2023-43701Apache Superset: Stored XSS on API endpointPyPI · apache-superset · fixed in 2.1.2
- CVE-2023-42501Apache Superset: Unnecessary read permissions within the Gamma rolePyPI · apache-superset · fixed in 2.1.2
- CVE-2023-40610Apache Superset: Privilege escalation with default examples databasePyPI · apache-superset · fixed in 2.1.2
- CVE-2023-48796Apache dolphinscheduler sensitive information disclosurePyPI · apache-dolphinscheduler · fixed in 3.0.2
- CVE-2023-48705nautobot has XSS potential in custom links, job buttons, and computed fieldsPyPI · nautobot · fixed in 1.6.6, 2.0.5
- CVE-2023-37924Apache Submarine: SQL injection from unauthorized loginPyPI · apache-submarine · fixed in 0.8.0
- CVE-2023-48700Clear Text Credentials Exposed via Onboarding TaskPyPI · nautobot-device-onboarding · fixed in 3.0.0
- CVE-2023-48699fastbots Eval Injection vulnerabilityPyPI · fastbots · fixed in 0.1.5
- CVE-2023-48299TorchServe ZipSlipPyPI · torchserve · fixed in 0.9.0
- CVE-2023-46302Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserializationPyPI · apache-submarine · fixed in 0.8.0
- CVE-2023-48051An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.PyPI · upydev
- CVE-2023-6014MLflow Authentication BypassPyPI · mlflow · fixed in 2.8.0
- CVE-2023-6020Ray Static File Local File IncludePyPI · ray · fixed in 2.8.1
- CVE-2023-6019Ray Command Injection in cpu_profile ParameterPyPI · ray · fixed in 2.8.1
- CVE-2023-6021Ray Log File Local File IncludePyPI · ray · fixed in 2.8.1
- CVE-2023-6022Cross-Site Request Forgery (CSRF) in prefecthq/prefectPyPI · prefect · fixed in 2.16.5
- CVE-2023-6015MLflow Arbitrary File UploadPyPI · mlflow · fixed in 2.8.1
- CVE-2023-6018MLflow Arbitrary File WritePyPI · mlflow · fixed in 2.9.2
- CVE-2023-48052Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-inPyPI · httpie · fixed in 3.2.3
- CVE-2023-48054Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a maPyPI · localstack