Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-34110Flask-AppBuilder vulnerable to possible disclosure of sensitive information on user errorPyPI · flask-appbuilder · fixed in 4.3.2
- CVE-2023-34541Langchain 0.0.171 is vulnerable to Arbitrary code execution in load_prompt.PyPI · langchain · fixed in 0.0.247
- CVE-2023-35005Apache Airflow: Information disclosure on configuration viewPyPI · apache-airflow · fixed in 2.6.2rc1, 2.6.2
- CVE-2023-34540Langchain before v0.0.225 was discovered to contain a remote code execution (RCE) vulnerability in the component JiraAPIWrapper (aka the JIRPyPI · langchain · fixed in 0.0.225
- CVE-2023-32731Information leak in gRPCPyPI · grpcio · fixed in 1.53.1, 1.54.2
- CVE-2023-32732Denial-of-Service in gRPCPyPI · grpcio · fixed in 1.53.1, 1.54.2
- CVE-2023-1428Denial-of-Service in gRPCPyPI · grpcio · fixed in 1.53.0
- CVE-2023-34233Snowflake Python Connector vulnerable to Command InjectionPyPI · snowflake-connector-python · fixed in 3.0.2
- CVE-2023-34239Unfiltered paths in gradioPyPI · gradio · fixed in 3.34.0
- CVE-2023-32683URL deny list bypass via oEmbed and image URLs when generating previews in SynapsePyPI · matrix-synapse · fixed in 1.85.0
- CVE-2023-32682Improper checks for deactivated users during login in synapsePyPI · matrix-synapse · fixed in 1.85.0
- CVE-2023-33977Stored cross site scripting (XSS) via unrestricted file upload in Kiwi TCMSPyPI · kiwitcms · fixed in 12.4
- CVE-2023-33733Reportlab up to v3.6.12 allows attackers to execute arbitrary code via supplying a crafted PDF file.PyPI · reportlab · fixed in 3.6.13
- CVE-2023-29159Directory traversal vulnerability in Starlette versions 0.13.5 and later and prior to 0.27.0 allows a remote unauthenticated attacker to viePyPI · starlette · fixed in 0.27.0
- CVE-2023-33234Apache Airflow CNCF Kubernetes Provider: KubernetesPodOperator RCE via connection configurationPyPI · apache-airflow-providers-cncf-kubernetes · fixed in 7.0.0
- CVE-2023-2970MindSpore json_helper.cc UpdateArray memory corruptionPyPI · mindspore
- CVE-2023-33175ToUI allows user-specific variables to be shared between usersPyPI · toui · fixed in 2.4.1
- CVE-2023-32686kiwitcms vulnerable to stored XSS via unrestricted files uploadPyPI · kiwitcms · fixed in 12.3
- CVE-2023-32321CKAN remote code execution and private information access via crafted resource idsPyPI · ckan · fixed in 2.9.9, 2.10.1
- CVE-2023-33185Incorrect signature verification in django-sesPyPI · django-ses · fixed in 3.5.0
- CVE-2023-32681Unintended leak of Proxy-Authorization header in requestsPyPI · requests · fixed in 2.31.0
- CVE-2022-39374Synapse Denial of service due to incorrect application of event authorization rules during state resolutionPyPI · matrix-synapse · fixed in 1.68.0rc1, 1.68.0
- CVE-2022-39335Synapse does not apply enough checks to servers requesting auth events of events in a roomPyPI · matrix-synapse · fixed in 1.69.0
- CVE-2023-32323Synapse Outgoing federation to specific hosts can be disabled by sending malicious invitesPyPI · matrix-synapse · fixed in 1.74.0
- CVE-2023-28370Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrarPyPI · tornado · fixed in 6.3.2
- CVE-2023-32675Nonpayable default functions are sometimes payable in vyperPyPI · vyper · fixed in 0.3.8
- CVE-2023-2800Insecure Temporary File in huggingface/transformersPyPI · transformers · fixed in 4.30.0
- CVE-2023-2780Path Traversal: '\..\filename' in mlflow/mlflowPyPI · mlflow · fixed in 2.3.0, 2.3.1
- CVE-2023-32309Arbitrary file inclusion with the pymdowm-snippets extensionPyPI · pymdown-extensions · fixed in 10.0
- CVE-2023-32758giturlparse (aka git-url-parse) through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS (Regular Expression Denial ofPyPI · git-url-parse