Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-40024Reflected Cross-Site Scripting (XSS) in scancode.io license endpointPyPI · scancodeio · fixed in 32.5.2
- CVE-2023-39553Apache Airflow Drill Provider Arbitrary File Read VulnerabilityPyPI · apache-airflow, apache-airflow-providers-apache-drill · fixed in 2.4.3
- CVE-2023-27506Improper buffer restrictions in the Intel(R) Optimization for Tensorflow software before version 2.12 may allow an authenticated user to potPyPI · intel-tensorflow, intel-tensorflow-avx512 +1 · fixed in 2.12
- CVE-2020-35139An issue was discovered in OFPBundleCtrlMsg in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of servicPyPI · ryu
- CVE-2020-35141An issue was discovered in OFPQueueGetConfigReply in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of PyPI · ryu
- CVE-2023-40267GitPython before 3.1.32 does not block insecure non-multi options in clone and clone_from.PyPI · gitpython · fixed in 3.1.32
- CVE-2023-39531Sentry vulnerable to incorrect credential validation on OAuth token requestsPyPI · sentry · fixed in 23.7.2
- CVE-2023-33953Denial-of-Service in gRPCPyPI · grpcio · fixed in 1.53.2, 1.54.3, 1.55.2 and more
- CVE-2023-35838The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that usesPyPI · wireguard
- CVE-2023-38758Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the licensPyPI · wger
- CVE-2023-38759Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges viaPyPI · wger
- CVE-2023-39523ScanCode.io command injection in docker image fetch processPyPI · scancodeio · fixed in 32.5.1
- CVE-2023-39363Vyper incorrectly allocated named re-entrancy locksPyPI · vyper · fixed in 0.3.1
- CVE-2023-39349Sentry vulnerable to privilege escalation via ApiTokensEndpointPyPI · sentry · fixed in 23.7.2
- CVE-2023-39508Apache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledgesPyPI · apache-airflow · fixed in 2.6.0b1, 2.6.0
- CVE-2023-36095An issue in Harrison Chase langchain v.0.0.194 allows an attacker to execute arbitrary code via the python exec calls in the PALChain, affecPyPI · langchain · fixed in 0.0.236
- CVE-2023-38699MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issuePyPI · mindsdb · fixed in 23.7.4.0
- CVE-2023-38686Sydent does not verify email server certificatesPyPI · matrix-sydent · fixed in 2.5.6
- CVE-2023-4138Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.8.1
- CVE-2023-4033OS Command Injection in mlflow/mlflowPyPI · mlflow · fixed in 2.6.0
- CVE-2023-38673Command injection in fs.pyPyPI · paddlepaddle · fixed in 2.5.0
- CVE-2023-38672FPE in paddle.linalg.matrix_powerPyPI · paddlepaddle · fixed in 2.5.0
- CVE-2023-38671Heap buffer overflow in paddle.tracePyPI · paddlepaddle · fixed in 2.5.0
- CVE-2023-38670Null pointer dereference in paddle.flipPyPI · paddlepaddle · fixed in 2.5.0
- CVE-2023-38669Use after free in paddle.diagonal in PaddlePaddle before 2.5.0.PyPI · paddlepaddle · fixed in 2.5.0
- CVE-2023-38501copyparty vulnerable to reflected cross-site scripting via k304 parameterPyPI · copyparty · fixed in 1.8.7
- CVE-2023-37920Certifi's removal of e-Tugra root certificatePyPI · certifi · fixed in 2023.7.22
- CVE-2023-37902Vyper's ecrecover can return undefined data if signature does not verifyPyPI · vyper · fixed in 0.3.9, 0.3.10
- CVE-2023-36826Sentry vulnerable to improper authorization on debug and artifact file downloadsPyPI · sentry · fixed in 23.5.2
- CVE-2023-3637Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)PyPI · neutron