Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-23385Open RedirectPyPI · flask-security · fixed in 5.5.1
- CVE-2022-35920Improper Limitation of a Pathname to a Restricted Directory in sanicPyPI · sanic · fixed in 20.12.7, 22.6.1, 21.12.2
- CVE-2022-35918Streamlit directory traversal vulnerabilityPyPI · streamlit · fixed in 1.11.1
- CVE-2022-31177Possible to infer sensitive information through query strings in Flask-AppBuilderPyPI · flask-appbuilder · fixed in 4.1.3
- CVE-2022-2589Cross-site Scripting (XSS) - Reflected in beancount/favaPyPI · fava · fixed in 1.22.3
- CVE-2022-36447An inflation issue was discovered in Chia Network CAT1 Standard 1.0.0.PyPI · chia-blockchain
- CVE-2022-34558WMAgent v1.3.3rc2 and 1.3.3rc1, reqmgr 2 1.4.1rc5 and 1.4.0rc2, reqmon 1.4.1rc5, and global-workqueue 1.4.1rc5 allows attackers to execute aPyPI · global-workqueue, reqmgr2 +2 · fixed in 2.0.4
- CVE-2022-34529WASM3 v0.5.0 was discovered to contain a segmentation fault via the component Compile_Memory_CopyFill.PyPI · pywasm3
- CVE-2022-33977untangle is a python library to convert XML data to python objects.PyPI · untangle · fixed in 1.2.1
- CVE-2022-31471untangle is a python library to convert XML data to python objects.PyPI · untangle · fixed in 1.2.1
- CVE-2022-2523Cross-site Scripting (XSS) - Reflected in beancount/favaPyPI · fava · fixed in 1.22.2
- CVE-2022-2514Cross-site Scripting (XSS) - Reflected in beancount/favaPyPI · fava · fixed in 1.22
- CVE-2022-34749In mistune through 2.0.2, support of inline markup is implemented by using regular expressions that can involve a high amount of backtrackinPyPI · mistune · fixed in 2.0.3
- CVE-2022-24294ReDoS in Apache MXNet RTC ModulePyPI · mxnet · fixed in 1.9.1
- CVE-2018-25045Django REST framework (aka django-rest-framework) before 3.9.1 allows XSS because the default DRF Browsable API view templates disable autoePyPI · django-rest-framework · fixed in 3.9.1
- CVE-2022-34982The eziod package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.PyPI · eziod · fixed in 0.0.2
- CVE-2022-34983The scu-captcha package in PyPI v0.0.1 to v0.0.4 included a code execution backdoor inserted by a third party.PyPI · scu-captcha · fixed in 0.0.5
- CVE-2022-34981The PyCrowdTangle package in PyPI before v0.0.1 included a code execution backdoor inserted by a third party.PyPI · pycrowdtangle · fixed in 0.0.3
- CVE-2022-33891Apache Spark shell command injection vulnerability via Spark UIPyPI · pyspark · fixed in 3.1.3, 3.2.2
- CVE-2021-36711WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled.PyPI · octobot · fixed in 0.4.4
- CVE-2022-31153OpenZeppelin Contracts for Cairo account cannot process transactions on GoerliPyPI · openzeppelin-cairo-contracts · fixed in 0.2.1
- CVE-2019-10800Command InjectionPyPI · codecov · fixed in 2.0.16
- CVE-2022-30187Azure Storage Library Information Disclosure VulnerabilityPyPI · azure-storage-blob, azure-storage-queue · fixed in 12.13.0, 12.4.0
- CVE-2022-25303Cross-site Scripting (XSS)PyPI · whoogle-search · fixed in 0.7.2
- CVE-2022-31573The chainer/chainerrl-visualizer repository through 0.1.1 on GitHub allows absolute path traversal because the Flask send_file function is uPyPI · chainerrl-visualizer
- CVE-2022-31558The tooxie/shiva-server repository through 0.10.0 on GitHub allows absolute path traversal because the Flask send_file function is used unsaPyPI · shiva
- CVE-2022-31507The ganga-devs/ganga repository before 8.5.10 on GitHub allows absolute path traversal because the Flask send_file function is used unsafelyPyPI · ganga · fixed in 8.5.10
- CVE-2022-31506The cmusatyalab/opendiamond repository through 10.1.1 on GitHub allows absolute path traversal because the Flask send_file function is used PyPI · opendiamond
- CVE-2022-35411rpc.py through 0.6.0 allows Remote Code Execution because an unpickle occurs when the "serializer: pickle" HTTP header is sent.PyPI · rpc-py
- CVE-2022-35410mat2 (aka metadata anonymisation toolkit) before 0.13.0 allows ../ directory traversal during the ZIP archive cleaning process.PyPI · mat2 · fixed in 0.13.0