Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-38200Keylime: registrar is subject to a dos against ssl connectionsPyPI · keylime · fixed in 7.4.0
- CVE-2022-43607An out-of-bounds write vulnerability exists in the MOL2 format attribute and value functionality of Open Babel 3.1.1 and master commit 530dbPyPI · openbabel · fixed in 3.2.0
- CVE-2022-46290Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3.PyPI · openbabel · fixed in 3.2.0
- CVE-2022-46289Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3.PyPI · openbabel · fixed in 3.2.0
- CVE-2022-46295Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabPyPI · openbabel · fixed in 3.2.0
- CVE-2022-46294Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabPyPI · openbabel · fixed in 3.2.0
- CVE-2022-46293Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabPyPI · openbabel · fixed in 3.2.0
- CVE-2022-46292Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabPyPI · openbabel · fixed in 3.2.0
- CVE-2022-46291Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabPyPI · openbabel · fixed in 3.2.0
- CVE-2022-41793An out-of-bounds write vulnerability exists in the CSR format title functionality of Open Babel 3.1.1 and master commit 530dbfa3.PyPI · openbabel · fixed in 3.2.0
- CVE-2022-42885A use of uninitialized pointer vulnerability exists in the GRO format res functionality of Open Babel 3.1.1 and master commit 530dbfa3.PyPI · openbabel · fixed in 3.2.0
- CVE-2022-44451A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3.PyPI · openbabel · fixed in 3.2.0
- CVE-2022-46280A use of uninitialized pointer vulnerability exists in the PQS format pFormat functionality of Open Babel 3.1.1 and master commit 530dbfa3.PyPI · openbabel · fixed in 3.2.0
- CVE-2022-43467An out-of-bounds write vulnerability exists in the PQS format coord_file functionality of Open Babel 3.1.1 and master commit 530dbfa3.PyPI · openbabel · fixed in 3.2.0
- CVE-2022-37331An out-of-bounds write vulnerability exists in the Gaussian format orientation functionality of Open Babel 3.1.1 and master commit 530dbfa3.PyPI · openbabel · fixed in 3.2.0
- CVE-2023-37901Cross-Site-Scripting via confirmation promptsPyPI · indico · fixed in 3.2.6
- CVE-2023-37276aiohttp vulnerable to HTTP request smugglingPyPI · aiohttp · fixed in 3.8.5
- CVE-2023-3674Keylime: attestation failure when the quote's signature does not validatePyPI · keylime · fixed in 7.2.5
- CVE-2023-3765Absolute Path Traversal in mlflow/mlflowPyPI · mlflow · fixed in 2.5.0
- CVE-2022-40896A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.PyPI · pygments · fixed in 2.15.1, 2.15.0
- CVE-2023-37480Fides Webserver Vulnerable to Zip Bomb File UploadsPyPI · ethyca-fides · fixed in 2.16.0
- CVE-2023-37481Fides Webserver Vulnerable to SVG Bomb File UploadsPyPI · ethyca-fides · fixed in 2.16.0
- CVE-2018-25088Blue Yonder postgraas_server PostgreSQL Backend postgres_cluster_driver.py create_postgres_db sql injectionPyPI · postgraas-server · fixed in 2.0.0
- CVE-2023-37474Path traversal in copypartyPyPI · copyparty · fixed in 1.8.2
- CVE-2023-38325The cryptography package before 41.0.2 for Python mishandles SSH certificates that have critical options.PyPI · cryptography · fixed in 41.0.2
- CVE-2023-37415Apache Airflow Apache Hive Provider: Improper Input Validation in Hive Provider with proxy_userPyPI · apache-airflow-providers-apache-hive · fixed in 6.1.2
- CVE-2023-22888Apache Airflow: Scheduler remote DoSPyPI · apache-airflow · fixed in 2.6.3
- CVE-2023-36543Apache Airflow: ReDoS via dags functionPyPI · apache-airflow · fixed in 2.6.3
- CVE-2022-46651Apache Airflow: Security vulnerability on AirFlow ConnectionsPyPI · apache-airflow · fixed in 2.6.3
- CVE-2023-22887Apache Airflow path traversal by authenticated userPyPI · apache-airflow · fixed in 2.6.3