Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-35908Apache Airflow: Access to DAGs without relevant permissionPyPI · apache-airflow · fixed in 2.6.3
- CVE-2023-37271RestrictedPython vulnerable to arbitrary code execution via stack frame sandbox escapePyPI · restrictedpython · fixed in 5.3, 6.1
- CVE-2023-37659xalpha v0.11.4 is vulnerable to Remote Command Execution (RCE).PyPI · xalpha · fixed in 0.11.9
- CVE-2023-36829Sentry CORS misconfiguration vulnerabilityPyPI · sentry · fixed in 23.6.2
- CVE-2023-35934yt-dlp File Downloader cookie leakPyPI · yt-dlp · fixed in 2023.7.06
- CVE-2023-36830SQLFluff vulnerability for users with access to config file, using `library_path` to call arbitrary python code.PyPI · sqlfluff · fixed in 2.1.2
- CVE-2023-29824A use-after-free issue was discovered in Py_FindObjects() function in SciPy versions prior to 1.8.0.PyPI · scipy · fixed in 1.8.0
- CVE-2023-36188An issue in langchain v.0.0.64 allows a remote attacker to execute arbitrary code via the PALChain parameter in the Python exec method.PyPI · langchain · fixed in 0.0.247
- CVE-2023-36189SQL injection vulnerability in langchain before v0.0.247 allows a remote attacker to obtain sensitive information via the SQLDatabaseChain cPyPI · langchain · fixed in 0.0.247
- CVE-2023-36827Fides vulnerable to Path Traversal in Webserver APIPyPI · ethyca-fides · fixed in 2.15.1
- CVE-2023-36809Kiwi TCMS's misconfigured HTTP headers allow stored XSS execution with FirefoxPyPI · kiwitcms · fixed in 12.5
- CVE-2023-34457MechanicalSoup vulnerable to malicious web server reading arbitrary files on client using file input inside HTML formPyPI · mechanicalsoup · fixed in 1.3.0
- CVE-2023-25399A refcounting issue which leads to potential memory leak was discovered in scipy commit 8627df31ab in Py_FindObjects() function.PyPI · scipy · fixed in 1.10.0
- CVE-2023-36814zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal modulePyPI · products-cmfcore · fixed in 3.2, 2.7.1
- CVE-2023-35797Apache Airflow Hive Provider Beeline RCE with PrincipalPyPI · apache-airflow-providers-apache-hive · fixed in 6.1.1
- CVE-2023-36053In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regulaPyPI · django · fixed in 3.2.20, 4.1.10, 4.2.3
- CVE-2023-36258An issue in LangChain before 0.0.236 allows an attacker to execute arbitrary code because Python code with os.system, exec, or eval can be uPyPI · langchain · fixed in 0.0.247
- CVE-2023-36810Quadratic runtime with malformed PDF missing xref marker in pypdfPyPI · pypdf2 · fixed in 1.27.9
- CVE-2023-36807Infinite Loop when reading malformed objects in pypdfPyPI · pypdf2 · fixed in 2.10.6
- CVE-2023-31543A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the cPyPI · pipreqs · fixed in 0.4.12
- CVE-2023-37360pacparser_find_proxy in Pacparser before 1.4.2 allows JavaScript injection, and possibly privilege escalation, when the attacker controls thPyPI · pacparser · fixed in 1.4.2
- CVE-2023-37365Hnswlib 0.7.0 has a double free in init_index when the M argument is a large integer.PyPI · hnswlib · fixed in 0.8.0
- CVE-2023-22886Apache Airflow JDBC Provider: RCE VulnerabilityPyPI · apache-airflow-providers-jdbc · fixed in 4.0.0
- CVE-2020-26708requests-xml v0.2.3 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitraPyPI · requests-xml
- CVE-2020-26709py-xml v1.0 was discovered to contain an XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary code PyPI · py-xml
- CVE-2020-26710easy-parse v0.1.1 was discovered to contain a XML External Entity Injection (XXE) vulnerability which allows attackers to execute arbitrary PyPI · easy-parse
- CVE-2023-36464Infinite Loop when a comment isn't followed by a character in pypdfPyPI · pypdf, pypdf2 · fixed in 3.9.0
- CVE-2023-35798Airflow Apache ODBC and MSSQL Providers Arbitrary File Read VulnerabilityPyPI · apache-airflow-providers-microsoft-mssql, apache-airflow-providers-odbc · fixed in 3.4.1, 4.0.0
- CVE-2023-34395Apache Airflow ODBC Provider: Remote code execution vulnerabilityPyPI · apache-airflow-providers-odbc · fixed in 4.0.0
- CVE-2023-35932jcvi vulnerable to Configuration Injection due to unsanitized user input PyPI · jcvi