Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-41895`MirrorPadGrad` heap out of bounds read in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41896`tf.raw_ops.Mfcc` crashes in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41897`FractionalMaxPoolGrad` Heap out of bounds read in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41898`CHECK` fail via inputs in `SparseFillEmptyRowsGrad` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41899`CHECK` fail via inputs in `SdcaOptimizer` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41900FractionalMaxPool and FractionalAVGPool heap out-of-bounds acess in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41901`CHECK_EQ` fail via input in `SparseMatrixNNZ` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41907Overflow in `ResizeNearestNeighborGrad` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41908`CHECK` fail via inputs in `PyFunc` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41909Segfault in `CompositeTensorVariantToComponents` in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-41911Invalid char to bool conversion when printing a tensor in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.4, 2.9.3, 2.10.1
- CVE-2022-43171A heap buffer overflow in the LIEF::MachO::BinaryParser::parse_dyldinfo_generic_bind function of LIEF v0.12.1 allows attackers to cause a DePyPI · lief · fixed in 0.12.3
- CVE-2022-4018Missing Authentication for Critical Function in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.11a1, 2.5.0a6
- CVE-2022-45402Apache Airflow: Open redirect during loginPyPI · apache-airflow · fixed in 2.4.3
- CVE-2022-27949Apache Airflow prior to 2.3.1 may include sensitive values in rendered templatePyPI · apache-airflow · fixed in 2.3.1
- CVE-2022-3362Insufficient Session Expiration in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.5.0
- CVE-2022-40127Apache Airflow <2.4.0 has an RCE in a bash examplePyPI · apache-airflow · fixed in 2.4.0
- CVE-2022-45198Pillow before 9.2.0 performs Improper Handling of Highly Compressed GIF Data (Data Amplification).PyPI · pillow · fixed in 9.2.0
- CVE-2022-45199Pillow before 9.3.0 allows denial of service via SAMPLESPERPIXEL.PyPI · pillow · fixed in 9.3.0
- CVE-2022-41892Arches vulnerable to SQL InjectionPyPI · arches · fixed in 6.1.2, 6.2.1, 7.2.0
- CVE-2022-41905wsgidav is vulnerable to Cross-Site Scripting (XSS) when directory browsing is enabledPyPI · wsgidav · fixed in 4.1.0
- CVE-2022-42964Exponential ReDoS in pymatgen leads to denial of servicePyPI · pymatgen · fixed in 2025.10.7
- CVE-2022-42965Exponential ReDoS in snowflake-connector-python leads to denial of servicePyPI · snowflake-connector-python · fixed in 2.8.2
- CVE-2022-42966Exponential ReDoS in cleo leads to denial of servicePyPI · cleo · fixed in 2.0.0
- CVE-2022-44244An authentication bypass in Lin-CMS v0.2.1 allows attackers to escalate privileges to Super Administrator.PyPI · lin-cms
- CVE-2021-39432diplib v3.0.0 is vulnerable to Double Free.PyPI · diplib · fixed in 3.1.0
- CVE-2022-33684Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate ValidationPyPI · pulsar-client · fixed in 2.7.5, 2.8.4, 2.9.3 and more
- CVE-2022-43982Apache Airflow prior to 2.4.2 allows reflected XSS via Origin Query Argument in URLPyPI · apache-airflow · fixed in 2.4.2rc1, 2.4.2
- CVE-2022-43985Apache Airflow prior to 2.4.2 has an open redirectPyPI · apache-airflow · fixed in 2.4.2, 2.4.2rc1
- CVE-2022-31777Apache Spark XSS vulnerability in log viewer UI JavascriptPyPI · pyspark · fixed in 3.2.2, 3.3.1