Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-27525Apache Superset: Incorrect default permissions for Gamma rolePyPI · apache-superset · fixed in 2.1.0
- CVE-2023-22946Apache Spark proxy-user privilege escalation from malicious configuration classPyPI · pyspark · fixed in 3.4.0, 3.3.2
- CVE-2023-30771Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchPyPI · apache-iotdb
- CVE-2023-24831Apache IoTDB grafana-connector Login Bypass VulnerabilityPyPI · apache-iotdb · fixed in 0.13.5
- CVE-2021-34337An issue was discovered in Mailman Core before 3.3.5.PyPI · mailman · fixed in 3.3.5
- CVE-2022-2525Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.20
- CVE-2023-2106Weak Password Requirements in janeczku/calibre-webPyPI · calibreweb · fixed in 0.6.20
- CVE-2023-29005No Rate Limiting on Login AUTH DBPyPI · flask-appbuilder · fixed in 4.3.0
- CVE-2023-25392Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.PyPI · bigflow · fixed in 1.6.0
- CVE-2023-28710Apache Airflow Spark Provider Arbitrary File Read via JDBCPyPI · apache-airflow-providers-apache-spark · fixed in 4.0.1
- CVE-2023-28706Apache Airflow Hive Provider Beeline Remote Command ExecutionPyPI · apache-airflow-providers-apache-hive · fixed in 6.0.0
- CVE-2023-28707Airflow Apache Drill Provider Arbitrary File Read VulnerabilityPyPI · apache-airflow, apache-airflow-providers-apache-drill · fixed in 2.3.2
- CVE-2023-29374In LangChain through 0.0.131, the LLMMathChain chain allows prompt injection attacks that can execute arbitrary code via the Python exec metPyPI · langchain · fixed in 0.0.132
- CVE-2023-28837Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large filesPyPI · wagtail · fixed in 4.2.2, 4.1.4
- CVE-2022-38072An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and vPyPI · admesh · fixed in 0.98.5
- CVE-2023-26112All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\PyPI · configobj · fixed in 5.0.9
- CVE-2023-28836Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin viewsPyPI · wagtail · fixed in 4.1.4, 4.2.2
- CVE-2022-4899A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause bufferPyPI · zstd · fixed in 1.5.4.0
- CVE-2022-23522Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdbPyPI · mindsdb · fixed in 22.11.4.3
- CVE-2023-1712Use of Hard-coded, Security-relevant Constants in deepset-ai/haystackPyPI · farm-haystack
- CVE-2023-27489Stored cross site scripting via SVG file upload in Kiwi TCMSPyPI · kiwitcms · fixed in 12.1
- CVE-2023-25661Denial of Service in TensorFlowPyPI · tensorflow, tensorflow-cpu · fixed in 2.11.1
- CVE-2023-0241pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability.PyPI · pgadmin4 · fixed in 6.19
- CVE-2023-28858redis-py before 4.5.3 leaves a connection open after canceling an async Redis command at an inopportune time, and can send response data to PyPI · redis · fixed in 4.4.3, 4.5.3, 4.3.6
- CVE-2023-28859redis-py before 4.4.4 and 4.5.x before 4.5.4 leaves a connection open after canceling an async Redis command at an inopportune time, and canPyPI · redis · fixed in 4.4.4, 4.5.4
- CVE-2023-25660TensorFlow vulnerable to seg fault in `tf.raw_ops.Print`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25659TensorFlow vulnerable to Out-of-Bounds Read in DynamicStitchPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25658TensorFlow vulnerable to Out-of-Bounds Read in GRUBlockCellGradPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25662TensorFlow vulnerable to integer overflow in EditDistancePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25663TensorFlow has Null Pointer Error in TensorArrayConcatV2PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1