Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-41052Vyper: incorrect order of evaluation of side effects for some builtinsPyPI · vyper · fixed in 0.3.10rc1, 0.3.10
- CVE-2023-41057Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in hyper-bump-itPyPI · hyper-bump-it · fixed in 0.5.1
- CVE-2023-39631An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr librPyPI · langchain, numexpr · fixed in 0.0.308, 2.8.5
- CVE-2023-41040GitPython blind local file inclusionPyPI · gitpython · fixed in 3.1.37, 3.1.35
- CVE-2023-36811Archive spoofing vulnerability in borgbackupPyPI · borgbackup · fixed in 1.2.5
- CVE-2023-41039Sandbox escape via various forms of "format" in RestrictedPythonPyPI · restrictedpython · fixed in 5.4, 6.2
- CVE-2023-40889A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90.PyPI · zbar
- CVE-2023-39968Open Redirect Vulnerability in jupyter-serverPyPI · jupyter-server · fixed in 2.7.2
- CVE-2023-40170cross-site inclusion (XSSI) of files in jupyter-serverPyPI · jupyter-server · fixed in 2.7.2
- CVE-2023-40590Untrusted search path on Windows systems leading to arbitrary code executionPyPI · gitpython · fixed in 3.1.33
- CVE-2023-40195Apache Airflow Spark Provider Deserialization Vulnerability RCEPyPI · apache-airflow-providers-apache-spark · fixed in 4.1.3
- CVE-2023-27604Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityPyPI · apache-airflow-providers-apache-sqoop · fixed in 4.0.0
- CVE-2023-40587Pyramid static view path traversal up one directoryPyPI · pyramid · fixed in 2.0.2
- CVE-2023-38201Keylime: challenge-response protocol bypass during agent registrationPyPI · keylime · fixed in 7.5.0
- CVE-2023-40570Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated usersPyPI · datasette · fixed in 1.0a4
- CVE-2023-40017Geonode Server Side Request Forgery vulnerabilityPyPI · geonode · fixed in 4.2.0, 4.1.3
- CVE-2023-39441Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate ValidationPyPI · apache-airflow, apache-airflow-providers-imap +1 · fixed in 2.7.0, 3.3.0, 1.3.0
- CVE-2023-37379Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featurePyPI · apache-airflow · fixed in 2.7.0, 2.7.0b1
- CVE-2023-40273Session fixation in Apache Airflow web interfacePyPI · apache-airflow · fixed in 2.7.1rc1, 2.7.0rc2
- CVE-2020-18831Buffer Overflow vulnerability in tEXtToDataBuf function in pngimage.cpp in Exiv2 0.27.1 allows remote attackers to cause a denial of servicePyPI · exiv2
- CVE-2022-25024The json2xml package through 3.12.0 for Python allows an error in typecode decoding enabling a remote attack that can lead to an exception, PyPI · json2xml · fixed in 3.14.0
- CVE-2022-45582Open Redirect vulnerability in Horizon Web Dashboard 19.4.0 thru 20.1.4 via the success_url parameter.PyPI · horizon · fixed in 20.2.0
- CVE-2023-36281An issue in langchain v.0.0.171 allows a remote attacker to execute arbitrary code via a JSON file to load_prompt.PyPI · langchain · fixed in 0.0.312, 0.0.171
- CVE-2023-39660An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prPyPI · pandasai · fixed in 0.8.1
- CVE-2023-40272Apache Airflow Spark Provider Arbitrary File Read via JDBCPyPI · apache-airflow-providers-apache-spark · fixed in 4.1.3
- CVE-2023-38860An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.PyPI · langchain · fixed in 0.0.247
- CVE-2023-38896An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and frPyPI · langchain · fixed in 0.0.195, 0.0.236
- CVE-2023-39659An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the PythoPyPI · langchain · fixed in 0.0.325, 0.0.233
- CVE-2023-39661An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.PyPI · pandasai
- CVE-2023-39662An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEnginePyPI · llama-index · fixed in 0.7.14, 0.9.14