Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-27522Apache HTTP Server: mod_proxy_uwsgi HTTP response splittingPyPI · uwsgi · fixed in 2.0.22
- CVE-2022-3277An uncontrolled resource consumption flaw was found in openstack-neutron.PyPI · neutron · fixed in 19.5.0, 18.6.0, 20.3.0
- CVE-2022-4134A flaw was found in openstack-glance.PyPI · glance
- CVE-2023-27891rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session.PyPI · pretix · fixed in 4.17.1, 4.16.1, 4.15.1
- CVE-2023-22432Open redirect vulnerability exists in web2py versions prior to 2.23.1.PyPI · web2py · fixed in 2.23.1
- CVE-2023-23929Refresh tokens do not expire in Vantage6PyPI · vantage6 · fixed in 3.8.0
- CVE-2023-26052Saleor is vulnerable to unauthenticated information disclosure via Python exceptionsPyPI · saleor · fixed in 3.1.48, 3.11.12, 3.10.14 and more
- CVE-2023-26051Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptionsPyPI · saleor · fixed in 3.1.48, 3.7.59, 3.8.30 and more
- CVE-2023-22738Improper Preservation of Permissions in vantage6PyPI · vantage6 · fixed in 3.6.1, 3.8.0rc3, 3.8.0
- CVE-2022-39228Observable Response Discrepancy in vantage6PyPI · vantage6 · fixed in 3.8.0
- CVE-2023-26043XML External Entity (XXE) injection in GeoServer style upload functionalityPyPI · geonode · fixed in 4.0.3
- CVE-2023-25956Apache Airflow AWS Provider: Arbitrary file read via AWS providerPyPI · apache-airflow-providers-amazon · fixed in 7.2.1
- CVE-2023-25696Apache Airflow Hive Provider Beeline RCEPyPI · apache-airflow-providers-apache-hive · fixed in 5.1.3
- CVE-2023-25693Sqoop Apache Airflow Provider Remote Code Execution VulnerabilityPyPI · apache-airflow, apache-airflow-providers-apache-sqoop · fixed in 3.1.1
- CVE-2023-25692Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServicePyPI · apache-airflow-providers-google · fixed in 8.10.0
- CVE-2023-25691Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionPyPI · apache-airflow-providers-google · fixed in 8.10.0
- CVE-2023-25823Gradio contains Use of Hard-coded CredentialsPyPI · gradio · fixed in 3.13.1
- CVE-2023-26303markdown-it-py crash on null assertionsPyPI · markdown-it-py · fixed in 2.2.0
- CVE-2023-26302markdown-it-py CLI crash on invalid UTF-8 charactersPyPI · markdown-it-py · fixed in 2.2.0
- CVE-2023-0949Cross-site Scripting (XSS) - Reflected in modoboa/modoboaPyPI · modoboa · fixed in 2.0.5
- CVE-2023-25657Remote code execution in Jinja2 template rendering in NautobotPyPI · nautobot · fixed in 1.5.7
- CVE-2021-33226Buffer Overflow vulnerability in Saltstack v.3003 and before allows attacker to execute arbitrary code via the func variable in salt/salt/moPyPI · salt · fixed in 3003.1
- CVE-2021-33926An issue in Plone CMS v.PyPI · plone · fixed in 5.2.5
- CVE-2023-24769Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page.PyPI · changedetection-io · fixed in 0.40.1.1, 0.40.2
- CVE-2020-6817bleach.clean behavior parsing style attributes could result in a regular expression denial of service (ReDoS).PyPI · bleach · fixed in 3.1.4
- CVE-2021-23980A mutation XSS affects users calling bleach.clean with all of: svg or math in the allowed tags p or br in allowed tags style, title, noscripPyPI · bleach · fixed in 3.3.0
- CVE-2022-0637open redirect in pollbot (pollbot.services.mozilla.com) in versions before 1.4.6PyPI · pollbot · fixed in 1.4.6
- CVE-2023-0860Improper Restriction of Excessive Authentication Attempts in modoboa/modoboa-installerPyPI · modoboa · fixed in 2.0.4
- CVE-2023-25578Starlite DoS vulnerability when parsing multipart request bodyPyPI · starlite · fixed in 1.51.2
- CVE-2023-24580An issue was discovered in the Multipart Request Parser in Django 3.2 before 3.2.18, 4.0 before 4.0.10, and 4.1 before 4.1.7.PyPI · django · fixed in 3.2.18, 4.1.7, 4.0.10