Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-42458Zope vulnerable to Stored Cross Site Scripting with SVG imagesPyPI · zope · fixed in 4.8.10, 5.8.5
- CVE-2023-42457plone.rest vulnerable to Denial of Service when ++api++ is used many timesPyPI · plone-rest · fixed in 2.0.1, 3.0.1
- CVE-2023-41048plone.namedfile vulnerable to Stored Cross Site Scripting with SVG imagesPyPI · plone-namedfile · fixed in 5.6.1, 6.0.3, 6.1.3 and more
- CVE-2023-42261Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions.PyPI · mobsf · fixed in 3.9.7
- CVE-2019-19450paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in PyPI · reportlab · fixed in 3.5.31
- CVE-2023-42443Vyper vulnerable to memory corruption in certain builtins utilizing `msize`PyPI · vyper · fixed in 0.3.10
- CVE-2023-42441Vyper has incorrect re-entrancy lock when key is empty stringPyPI · vyper · fixed in 0.3.10
- CVE-2023-42439GeoNode SSRF Bypass to return internal host dataPyPI · geonode · fixed in 4.1.3.post1
- CVE-2023-41626Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.PyPI · gradio
- CVE-2023-41267Apache HDFS Provider error message suggested installation of incorrect pip packagePyPI · apache-airflow-providers-apache-hdfs · fixed in 4.1.1
- CVE-2023-4785Denial of Service in gRPC CorePyPI · grpcio · fixed in 1.55.3, 1.54.3, 1.53.2
- CVE-2023-41885Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumerationPyPI · piccolo · fixed in 0.121.0
- CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boPyPI · pillow · fixed in 10.0.1
- CVE-2023-40712Apache Airflow: Secrets can be unmasked in the "Rendered Template" PyPI · apache-airflow · fixed in 2.7.1
- CVE-2023-40611Apache Airflow Dag Runs Broken Access Control VulnerabilityPyPI · apache-airflow · fixed in 2.7.1
- CVE-2023-41369External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)PyPI · hana-ml
- CVE-2023-41329Domain restrictions bypass via DNS Rebinding in WireMock and WireMock StudioPyPI · wiremock · fixed in 2.6.1
- CVE-2023-41050Information disclosure through Python's "format" functionality in Zope AccessControlPyPI · accesscontrol, zope · fixed in 4.4, 5.8, 6.2 and more
- CVE-2023-41319Remote Code Execution in Custom Integration Upload in FidesPyPI · ethyca-fides · fixed in 2.19.0
- CVE-2023-32672Apache Superset: SQL parser edge case bypasses data access authorizationPyPI · apache-superset · fixed in 2.1.1
- CVE-2023-37941Apache Superset: Metadata db write access can lead to remote code executionPyPI · apache-superset · fixed in 2.1.1
- CVE-2023-39265Apache Superset: Possible Unauthorized Registration of SQLite Database ConnectionsPyPI · apache-superset · fixed in 2.1.1
- CVE-2023-39264Apache Superset: Stack traces enabled by defaultPyPI · apache-superset · fixed in 2.1.1
- CVE-2023-27523Apache Superset: Improper data permission validation on Jinja templated queriesPyPI · apache-superset · fixed in 2.1.1
- CVE-2023-36388Apache Superset: Improper API permission for low privilege users allows for SSRFPyPI · apache-superset · fixed in 2.1.1
- CVE-2023-27526Apache Superset: Improper Authorization check on import chartsPyPI · apache-superset · fixed in 2.1.1
- CVE-2023-36387Apache Superset: Improper API permission for low privilege usersPyPI · apache-superset
- CVE-2023-20898Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 300PyPI · salt · fixed in 3005.2, 3006.2
- CVE-2023-20897Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return.PyPI · salt · fixed in 3005.2, 3006.2
- CVE-2023-40015Vyper: reversed order of side effects for some operationsPyPI · vyper · fixed in 0.3.10rc1