Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-41882vantage6 Improper Access Control vulnerabilityPyPI · vantage6 · fixed in 4.0.0
- CVE-2023-41881Deleting a collaboration should also delete linked resourcesPyPI · vantage6 · fixed in 4.0.0
- CVE-2023-28635Defining resource name as integer in vantage6 may give unintended accessPyPI · vantage6, vantage6-node · fixed in 4.0.0
- CVE-2023-23930vantage6's Pickle serialization is insecurePyPI · vantage6 · fixed in 4.0.2
- CVE-2023-45129matrix-synapse vulnerable to denial of service due to malicious server ACL eventsPyPI · matrix-synapse · fixed in 1.94.0
- CVE-2023-36566Microsoft Common Data Model SDK Denial of Service VulnerabilityPyPI · commondatamodel-objectmodel · fixed in 1.7.4
- CVE-2023-41047Improper Neutralization of Special Elements Used in a Template Engine in OctoPrintPyPI · octoprint · fixed in 1.9.3
- CVE-2023-44467langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execPyPI · langchain-experimental · fixed in 0.0.15
- CVE-2023-43810opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metricsPyPI · opentelemetry-instrumentation · fixed in 0.41b0
- CVE-2023-4570Improper Restriction in NI MeasurementLink Python ServicesPyPI · ni-measurementlink-service · fixed in 1.1.1, 1.2.0
- CVE-2023-44389Zope management interface vulnerable to stored cross site scripting via the title propertyPyPI · zope · fixed in 4.8.11, 5.8.6
- CVE-2023-43804`Cookie` HTTP header isn't stripped on cross-origin redirectsPyPI · urllib3 · fixed in 2.0.6, 1.26.17
- CVE-2023-4237Platform: ec2_key module prints out the private key directly to the standard outputPyPI · ansible-core
- CVE-2023-26150Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space witPyPI · asyncua · fixed in 0.9.96
- CVE-2023-26151Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet anPyPI · asyncua · fixed in 0.9.96
- CVE-2023-44463An issue was discovered in pretix before 2023.7.1.PyPI · pretix · fixed in 2023.7.1
- CVE-2023-39410Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDKPyPI · avro · fixed in 1.11.3
- CVE-2023-5289Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.8.4
- CVE-2023-44464pretix before 2023.7.2 allows Pillow to parse EPS files.PyPI · pretix · fixed in 2023.7.2
- CVE-2023-43654TorchServe Server-Side Request ForgeryPyPI · torchserve · fixed in 0.8.2
- CVE-2023-26145This affects versions of the package pydash before 6.0.0.PyPI · pydash · fixed in 6.0.0
- CVE-2023-41335Temporary storage of plaintext passwords during password changes in matrix synapsePyPI · matrix-synapse · fixed in 1.93.0
- CVE-2023-42453Improper validation of receipts allows forged read receipts in matrix synapsePyPI · matrix-synapse · fixed in 1.93.0
- CVE-2023-42460_abi_decode input not validated in complex expressions in VyperPyPI · vyper · fixed in 0.3.10
- CVE-2023-40581yt-dlp command injection when using `%q` in `--exec` on WindowsPyPI · yt-dlp · fixed in 2023.09.24
- CVE-2023-41419An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.PyPI · gevent · fixed in 23.9.0
- CVE-2023-1633Insecure barbican configuration file leaking credentialPyPI · barbican
- CVE-2023-1636Incomplete container isolationPyPI · barbican
- CVE-2023-1625Information leak in apiPyPI · openstack-heat · fixed in 20.0.0
- CVE-2023-5002Pgadmin4: remote code execution by an authenticated userPyPI · pgadmin4 · fixed in 7.7