Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-32303Planet's secret file is created with excessive permissionsPyPI · planet · fixed in 2.0.1
- CVE-2023-32059Vyper vulnerable to incorrect ordering of arguments for kwargs passed to internal callsPyPI · vyper · fixed in 0.3.8
- CVE-2023-32058Vyper vulnerable to integer overflow in loopPyPI · vyper · fixed in 0.3.8
- CVE-2023-31146Vyper vulnerable to OOB DynArray access when array is on both LHS and RHS of an assignmentPyPI · vyper · fixed in 0.3.8
- CVE-2023-30172A directory traversal vulnerability in the /get-artifact API method of the mlflow platform up to v2.0.1 allows attackers to read arbitrary fPyPI · mlflow · fixed in 2.0.1, 2.0.0rc0
- CVE-2023-32076in-toto vulnerable to Configuration Read From Local DirectoryPyPI · in-toto · fixed in 2.0.0
- CVE-2023-31143Mage terminal user authentication not working properlyPyPI · mage-ai · fixed in 0.8.72
- CVE-2023-30837Vyper storage allocator overflowPyPI · vyper · fixed in 0.3.8
- CVE-2023-25754Apache Airflow: Privilege escalation using airflow logsPyPI · apache-airflow · fixed in 2.6.0b1, 2.6.0
- CVE-2023-29247Stored XSS on Apache AirflowPyPI · apache-airflow · fixed in 2.6.0
- CVE-2023-31047In Django 3.2 before 3.2.19, 4.x before 4.1.9, and 4.2 before 4.2.1, it was possible to bypass validation when using one form field to uploaPyPI · django · fixed in 3.2.19, 4.1.9, 4.2.1
- CVE-2023-30861Flask vulnerable to possible disclosure of permanent session cookie due to missing Vary: Cookie headerPyPI · flask · fixed in 2.2.5, 2.3.2
- CVE-2023-32007Apache Spark: Shell command injection via Spark UIPyPI · pyspark · fixed in 3.2.2
- CVE-2023-2356Relative Path Traversal in mlflow/mlflowPyPI · mlflow · fixed in 2.3.1
- CVE-2023-30629Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success valuePyPI · vyper · fixed in 0.3.8
- CVE-2023-30628Kiwi TCMS has command injection vulnerability in changelog.yml CI workflowPyPI · kiwitcms · fixed in 12.3
- CVE-2023-30613Kiwi TCMS unrestricted file upload vulnerabilityPyPI · kiwitcms · fixed in 12.2
- CVE-2023-30544Kiwi TCMS may allow user to update email address to unverified onePyPI · kiwitcms · fixed in 12.2
- CVE-2023-30776Apache Superset: Database connection password leakPyPI · apache-superset · fixed in 2.1.0
- CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEYPyPI · apache-superset · fixed in 2.1.0
- CVE-2023-30620Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdbPyPI · mindsdb · fixed in 23.2.1.0
- CVE-2023-30798MultipartParser DOS with too many fields or files in Starlette FrameworkPyPI · starlette · fixed in 0.25.0
- CVE-2023-2227Improper Authorization in modoboa/modoboaPyPI · modoboa · fixed in 2.1.0
- CVE-2023-2228Cross-Site Request Forgery (CSRF) in modoboa/modoboaPyPI · modoboa · fixed in 2.1.0
- CVE-2023-28458pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).PyPI · pretalx · fixed in 2.3.2
- CVE-2023-28459pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).PyPI · pretalx · fixed in 2.3.2
- CVE-2023-30797Insecure Random Generation in Netflix LemurPyPI · lemur · fixed in 1.3.2
- CVE-2023-30608Parser contains an inefficient regular expression in sqlparsePyPI · sqlparse · fixed in 0.4.4
- CVE-2023-2160Weak Password Requirements in modoboa/modoboaPyPI · modoboa · fixed in 2.1.0
- CVE-2023-25504Apache Superset: Possible SSRF on import datasetsPyPI · apache-superset · fixed in 2.1.0