Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-48056PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption.PyPI · pypinksign
- CVE-2023-48224Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fidesPyPI · ethyca-fides · fixed in 2.24.0
- CVE-2023-46121Generic Extractor MITM Vulnerability in yt-dlpPyPI · yt-dlp · fixed in 2023.11.14
- CVE-2023-5189Hub: insecure galaxy-importer tarfile extractionPyPI · galaxy-importer
- CVE-2023-47631vantage6 Node accepts non-whitelisted algorithms from malicious serverPyPI · vantage6-node, vantage6-server · fixed in 4.1.2
- CVE-2023-47627Request smuggling in aiohttpPyPI · aiohttp · fixed in 3.8.6
- CVE-2023-47641Inconsistent interpretation of `Content-Length` vs. `Transfer-Encoding` in aiohttpPyPI · aiohttp · fixed in 3.8.0
- CVE-2023-46445An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a "PyPI · asyncssh · fixed in 2.14.1
- CVE-2023-46446An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shelPyPI · asyncssh · fixed in 2.14.1
- CVE-2023-47117Object Relational Mapper Leak Vulnerability in Filtering Task in Label StudioPyPI · label-studio · fixed in 1.9.2, 1.9.2.post0
- CVE-2023-47163Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack.PyPI · remarshal · fixed in 0.17.1
- CVE-2023-42781Apache Airflow: Permission verification bypass allows viewing dagruns of other dagsPyPI · apache-airflow · fixed in 2.7.3
- CVE-2023-47037Apache Airflow missing fix for CVE-2023-40611 in 2.7.1 (DAG run broken access)PyPI · apache-airflow · fixed in 2.7.3
- CVE-2023-47128piccolo SQL Injection via named transaction savepointsPyPI · piccolo · fixed in 1.1.1
- CVE-2023-43791Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session TokensPyPI · label-studio · fixed in 1.8.2
- CVE-2023-47248PyArrow, PyArrow: Arbitrary code execution when loading a malicious data filePyPI · pyarrow · fixed in 14.0.1
- CVE-2023-46894An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.PyPI · esptool
- CVE-2023-47114Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR PackagesPyPI · ethyca-fides · fixed in 2.23.3
- CVE-2023-45875An issue was discovered in Couchbase Server 7.2.0.PyPI · couchbase
- CVE-2023-44398Out-of-bounds write in exiv2PyPI · exiv2
- CVE-2023-41164In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (deniPyPI · django · fixed in 3.2.21, 4.1.11, 4.2.5
- CVE-2023-43665In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when usedPyPI · django · fixed in 3.2.22, 4.1.12, 4.2.6
- CVE-2023-44271An issue was discovered in Pillow before 10.0.0.PyPI · pillow · fixed in 10.0.0
- CVE-2023-46695An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.PyPI · django · fixed in 3.2.23, 4.1.13, 4.2.7
- CVE-2023-47204Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.PyPI · transmute-core · fixed in 1.13.5
- CVE-2023-43796Synapse vulnerable to leak of remote user device informationPyPI · matrix-synapse · fixed in 1.95.1
- CVE-2023-46250pypdf possible Infinite Loop when PdfWriter(clone_from) is used with a PDFPyPI · pypdf · fixed in 3.17.0
- CVE-2023-46215Apache Airflow Celery provider, Apache Airflow: Sensitive information logged as clear text when rediss, amqp, rpc protocols are used as Celery result backendPyPI · apache-airflow, apache-airflow-providers-celery · fixed in 2.7.0, 3.4.1
- CVE-2023-46137twisted.web has disordered HTTP pipeline responsePyPI · twisted · fixed in 23.10.0rc1
- CVE-2023-46134D-Tale vulnerable to Remote Code Execution through the Custom Filter InputPyPI · dtale · fixed in 3.7.0