Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-3274Cross-Site Request Forgery (CSRF) on user's settings in GitHub repository ikus060/rdiffweb prior to 2.4.6. in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.7
- CVE-2022-3267Cross-Site Request Forgery (CSRF) in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.6
- CVE-2022-1941Out of Memory issue in ProtocolBuffers for cpp and pythonPyPI · protobuf · fixed in 3.18.3, 3.19.5, 3.20.2 and more
- CVE-2022-3233Cross-Site Request Forgery (CSRF) in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.6
- CVE-2022-3250Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.6
- CVE-2022-3068Improper Privilege Management in octoprint/octoprintPyPI · octoprint · fixed in 1.8.3
- CVE-2022-2888Insufficient Session Expiration in octoprint/octoprintPyPI · octoprint · fixed in 1.8.3
- CVE-2022-2872Unrestricted Upload of File with Dangerous Type in octoprint/octoprintPyPI · octoprint · fixed in 1.8.3
- CVE-2022-40754Open RedirectPyPI · apache-airflow · fixed in 2.4.0rc1, 2.4.0b1
- CVE-2022-40604Format String VulnerabilityPyPI · apache-airflow · fixed in 2.4.0rc1, 2.4.0b1
- CVE-2022-39974WASM3 v0.5.0 was discovered to contain a segmentation fault via the component op_Select_i32_srs in wasm3/source/m3_exec.h.PyPI · pywasm3
- CVE-2022-3232Cross-Site Request Forgery (CSRF) in ikus060/rdiffwebPyPI · rdiffweb · fixed in 2.4.5
- CVE-2022-36015Integer overflow in math ops in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-36012Assertion fail on MLIR empty edge names in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35996Floating point exception in `Conv2D` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-36027Segfault TFLite converter on per-channel quantized transposed convolutions in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-36017Segfault in `Requantize` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-36014Null-dereference in `mlir::tfg::TFOp::nameAttr` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-36000Null dereference on MLIR on empty function attributes in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-36011Null dereference on MLIR on empty function attributes in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-36013Null-dereference in `mlir::tfg::GraphDefImporter::ConvertNodeDef` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35994`CHECK` fail in `CollectiveGather` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35993`CHECK` fail in `SetSize` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35992`CHECK` fail in `TensorListFromTensor` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35991`CHECK` fail in `TensorListScatter` and `TensorListScatterV2` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35999`CHECK` fail in `Conv2DBackpropInput` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35998`CHECK` fail in `EmptyTensorList` in TensorFlowPyPI · tensorflow · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35997`CHECK` fail in `tf.sparse.cross` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-35995`CHECK` fail in `AudioSummaryV2` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1
- CVE-2022-36016`CHECK`-fail in `tensorflow::full_type::SubstituteFromAttrs` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.7.2, 2.8.1, 2.9.1