Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-46136Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginningPyPI · werkzeug · fixed in 2.3.8, 3.0.1
- CVE-2023-46124Server-Side Request Forgery Vulnerability in Custom Integration UploadPyPI · ethyca-fides · fixed in 2.22.1
- CVE-2023-46125Fides Information Disclosure Vulnerability in Config API EndpointPyPI · ethyca-fides · fixed in 2.22.1
- CVE-2023-46126Fides JavaScript Injection Vulnerability in Privacy Center URLPyPI · ethyca-fides · fixed in 2.22.1
- CVE-2023-5752Mercurial configuration injectable in repo revision when installing via pipPyPI · pip · fixed in 23.3
- CVE-2023-46128Exposure of hashed user passwords via REST API in NautobotPyPI · nautobot · fixed in 2.0.3
- CVE-2023-46288Apache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is setPyPI · apache-airflow · fixed in 2.7.2, 2.7.0
- CVE-2023-46331WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.PyPI · wabt
- CVE-2023-46332WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.PyPI · wabt
- CVE-2021-46897views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traverPyPI · coderedcms · fixed in 0.22.3
- CVE-2021-46898views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but tPyPI · django-grappelli · fixed in 2.15.2
- CVE-2023-45805Trojan Lockfilein pdmPyPI · pdm · fixed in 2.10.0
- CVE-2023-5690Cross-Site Request Forgery (CSRF) in modoboa/modoboaPyPI · modoboa · fixed in 2.2.2
- CVE-2023-5689Cross-site Scripting (XSS) - DOM in modoboa/modoboaPyPI · modoboa · fixed in 2.2.2
- CVE-2023-5688Cross-site Scripting (XSS) - DOM in modoboa/modoboaPyPI · modoboa · fixed in 2.2.2
- CVE-2023-32786In Langchain through 0.0.155, prompt injection allows an attacker to force the service to retrieve data from an arbitrary URL, essentially pPyPI · langchain · fixed in 0.0.329
- CVE-2023-41893Account takeover via auth_callback login in Home Assistant CorePyPI · homeassistant · fixed in 2023.9.0
- CVE-2023-45815ArchiveBox: Viewing wget extractor output while logged in as an admin allows archived JS to execute in the admins contextPyPI · archivebox · fixed in 0.9.0, 0.7.0
- CVE-2023-45809Disclosure of user names via admin bulk action views in wagtailPyPI · wagtail · fixed in 4.1.9, 5.0.5, 5.1.3
- CVE-2023-44690Inadequate encryption strength in mycli 1.27.0 allows attackers to view sensitive information via /mycli/config.pyPyPI · mycli
- CVE-2023-46229LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to anPyPI · langchain · fixed in 0.0.317
- CVE-2023-45813Inefficient Regular Expression Complexity in TorBotPyPI · torbot · fixed in 4.0.0
- CVE-2023-45803Request body not stripped after redirect in urllib3PyPI · urllib3 · fixed in 2.0.7, 1.26.18
- CVE-2023-5590NULL Pointer Dereference in seleniumhq/seleniumPyPI · selenium · fixed in 4.14.0
- CVE-2018-25091urllib3 before 1.24.2 does not remove the authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs inPyPI · urllib3 · fixed in 1.24.2
- CVE-2023-42663Apache Airflow: Bypass permission verification to view task instances of other dagsPyPI · apache-airflow · fixed in 2.7.2
- CVE-2023-42792Apache Airflow: Improper access control to DAG resourcesPyPI · apache-airflow · fixed in 2.7.2
- CVE-2023-45348Apache Airflow: Configuration information leakage vulnerabilityPyPI · apache-airflow · fixed in 2.7.2
- CVE-2023-42780Apache Airflow: Improper access control vulnerability in the "List dag warnings" featurePyPI · apache-airflow · fixed in 2.7.2
- CVE-2023-45853MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_64 via a long filename,PyPI · pyminizip