Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-31020Remote code execution in Indy's NODE_UPGRADE transactionPyPI · indy-node · fixed in 1.12.5rc1
- CVE-2022-38369Login check vulnerability by session IdPyPI · apache-iotdb · fixed in 0.13.1
- CVE-2022-30331The User-Defined Functions (UDF) feature in TigerGraph 3.6.0 allows installation of a query (in the GSQL query language) without proper valiPyPI · pytigergraph
- CVE-2022-31152Synapse vulnerable to denial of service (DoS) due to incorrect application of event authorization rulesPyPI · matrix-synapse · fixed in 1.62.0rc1, 1.62.0
- CVE-2022-38054Session FixationPyPI · apache-airflow · fixed in 2.3.4rc1
- CVE-2022-38170Overly permissive umask for daemonsPyPI · apache-airflow · fixed in 2.3.4
- CVE-2022-23452An authorization flaw was found in openstack-barbican, where anyone with an admin role could add secrets to a different project container.PyPI · barbican · fixed in 14.0.0
- CVE-2022-2806It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered.PyPI · sosreport · fixed in 4.4
- CVE-2022-2996A flaw was found in the python-scciclient when making an HTTPS connection to a server where the server's certificate would not be verified.PyPI · python-scciclient · fixed in 0.12.0
- CVE-2022-36046Unexpected server crash in Next.js version 12.2.3PyPI · nextjs
- CVE-2022-0718A flaw was found in python-oslo-utils.PyPI · oslo-utils · fixed in 4.10.1
- CVE-2022-34668NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivilePyPI · nvflare · fixed in 2.1.4
- CVE-2022-38792The exotel (aka exotel-py) package in PyPI as of 0.1.6 includes a code execution backdoor inserted by a third party.PyPI · exotel
- CVE-2021-3563A flaw was found in openstack-keystone.PyPI · keystone
- CVE-2021-3427The Deluge Web-UI is vulnerable to XSS through a crafted torrent file.PyPI · deluge · fixed in 2.1.0
- CVE-2022-2255A vulnerability was found in mod_wsgi.PyPI · mod-wsgi · fixed in 4.9.3
- CVE-2021-42521There is a NULL pointer dereference vulnerability in VTK before 9.2.5, and it lies in IO/Infovis/vtkXMLTreeReader.cxx.PyPI · vtk · fixed in 9.0.1
- CVE-2021-4041A flaw was found in ansible-runner.PyPI · ansible-runner · fixed in 2.1.0
- CVE-2021-3702A race condition flaw was found in ansible-runner, where an attacker could watch for rapid creation and deletion of a temporary directory, sPyPI · ansible-runner · fixed in 2.1.0
- CVE-2021-3701A flaw was found in ansible-runner where the default temporary files configuration in ansible-2.0.0 are written to world R/W locations.PyPI · ansible-runner · fixed in 2.1.0
- CVE-2022-25304Denial of Service (DoS)PyPI · asyncua, opcua · fixed in 0.9.96
- CVE-2022-1930ReDoS in eth-account encode_structured_data functionPyPI · eth-account · fixed in 0.5.9
- CVE-2022-2930Unverified Password Change in octoprint/octoprintPyPI · octoprint · fixed in 1.8.3
- CVE-2022-36024Bots using py-cord as discord api wrapper are vulnerable to shutdowns through remote code executionPyPI · py-cord · fixed in 2.0.1
- CVE-2021-32862nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit pathsPyPI · nbconvert · fixed in 6.3.0a0, 6.5.1
- CVE-2022-38362Docker Provider <3.0 RCE vulnerability in example dagPyPI · apache-airflow-providers-docker · fixed in 3.0.0
- CVE-2022-2822Authentication Bypass by Primary Weakness in octoprint/octoprintPyPI · octoprint
- CVE-2022-36124Memory overconsumption in Avro Rust SDKPyPI · avro
- CVE-2022-37394An issue was discovered in OpenStack Nova before 23.2.2, 24.x before 24.1.2, and 25.x before 25.0.2.PyPI · nova · fixed in 23.2.2, 24.1.2, 25.0.2
- CVE-2022-36359An issue was discovered in the HTTP FileResponse class in Django 3.2 before 3.2.15 and 4.0 before 4.0.7.PyPI · django · fixed in 3.2.15, 4.0.7