Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-25664TensorFlow vulnerable to Heap Buffer Overflow in AvgPoolGrad PyPI · tensorflow, tensorflow-cpu · fixed in 2.11.1
- CVE-2023-25667TensorFlow vulnerable to segfault when opening multiframe gifPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25666TensorFlow has Floating Point Exception in AudioSpectrogram PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25665TensorFlow has Null Pointer Error in SparseSparseMaximumPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25668TensorFlow vulnerable to heap out-of-buffer read in the QuantizeAndDequantize operationPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25669TensorFlow has Floating Point Exception in AvgPoolGrad with XLAPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25670TensorFlow has Null Pointer Error in QuantizedMatMulWithBiasAndDequantizePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25671TensorFlow has segmentation fault in tfg-translate PyPI · tensorflow, tensorflow-cpu · fixed in 2.11.1
- CVE-2023-25672TensorFlow has Null Pointer Error in LookupTableImportV2PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25673TensorFlow has Floating Point Exception in TensorListSplit with XLA PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25674TensorFlow has Null Pointer Error in RandomShuffle with XLA enablePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25675TensorFlow has Segfault in Bincount with XLAPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25676TensorFlow has null dereference on ParallelConcat with XLAPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-25801TensorFlow has double free in Fractional(Max/Avg)PoolPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-27579TensorFlow has Floating Point Exception in TFLite in conv kernelPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.11.1
- CVE-2023-1176Absolute Path Traversal in mlflow/mlflowPyPI · mlflow · fixed in 2.2.1, 2.2.2
- CVE-2023-1177Path Traversal: '\..\filename' in mlflow/mlflowPyPI · mlflow · fixed in 2.2.1
- CVE-2022-3101A flaw was found in tripleo-ansible.PyPI · tripleo-ansible
- CVE-2022-3146A flaw was found in tripleo-ansible.PyPI · tripleo-ansible
- CVE-2023-28117Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`PyPI · sentry-sdk · fixed in 1.14.0
- CVE-2018-25082zwczou WeChat SDK Python to_xml xml external entity referencePyPI · weixin-python · fixed in 0.5.5
- CVE-2023-27586CairoSVG improperly processes SVG files loaded from external resourcesPyPI · cairosvg · fixed in 2.7.0
- CVE-2023-27494Streamlit Cross-site Scripting vulnerabilityPyPI · streamlit · fixed in 0.81.0
- CVE-2023-25695Information disclosure in Apache AirflowPyPI · apache-airflow · fixed in 2.5.2rc1, 2.5.2
- CVE-2023-25617OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)PyPI · sap-ai-sdk-base
- CVE-2017-20182Mobile Vikings Django AJAX Utilities Backslash pagination.js Pagination cross site scriptingPyPI · django-ajax-utilities · fixed in 1.2.8
- CVE-2023-27115WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.PyPI · wabt
- CVE-2023-27117WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.PyPI · wabt
- CVE-2023-27119WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.PyPI · wabt
- CVE-2023-27476XML External Entity (XXE) Injection in OWSLibPyPI · owslib · fixed in 0.28.1