Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-31124Possible leak of key's raw field if declared length is incorrect in openssh_key_parserPyPI · openssh-key-parser · fixed in 0.0.6
- CVE-2021-37839Improper access to dataset metadata informationPyPI · apache-superset · fixed in 1.5.1
- CVE-2022-31116Incorrect handling of invalid surrogate pair characters in ujsonPyPI · ujson · fixed in 5.4.0
- CVE-2022-31117Double free of buffer during string decoding in ujsonPyPI · ujson · fixed in 5.4.0
- CVE-2022-30290In OpenCTI through 5.2.4, a broken access control vulnerability has been identified in the profile endpoint.PyPI · pycti · fixed in 5.3.0
- CVE-2022-30289A stored Cross-site Scripting (XSS) vulnerability was identified in the Data Import functionality of OpenCTI through 5.2.4.PyPI · pycti · fixed in 5.3.0
- CVE-2022-2309NULL Pointer Dereference in lxml/lxmlPyPI · lxml · fixed in 4.9.1
- CVE-2022-34265An issue was discovered in Django 3.2 before 3.2.14 and 4.0 before 4.0.6.PyPI · django · fixed in 3.2.14, 4.0.6
- CVE-2022-31605NVFLARE, versions prior to 2.1.2, contains a vulnerability in its utils module, where YAML files are loaded via yaml.load() instead of yaml.PyPI · nvflare · fixed in 2.1.2
- CVE-2022-31604NVFLARE, versions prior to 2.1.2, contains a vulnerability in its PKI implementation module, where The CA credentials are transported via piPyPI · nvflare · fixed in 2.1.2
- CVE-2022-31052URL previews can crash Synapse media repositories or Synapse monolithsPyPI · matrix-synapse · fixed in 1.61.1
- CVE-2022-26477Denial of service in readExternal methodPyPI · systemds · fixed in 2.2.2
- CVE-2022-33146Open redirect vulnerability in web2py versions prior to 2.22.5 allows a remote attacker to redirect a user to an arbitrary web site and condPyPI · web2py · fixed in 2.22.5
- CVE-2022-30885The pyesasky for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.PyPI · pyesasky · fixed in 1.4.3
- CVE-2022-34061The Catly-Translate package in PyPI v0.0.3 to v0.0.5 was discovered to contain a code execution backdoor.PyPI · catly-translate · fixed in 0.0.6
- CVE-2022-34054The Perdido package in PyPI v0.0.1 to v0.0.2 was discovered to contain a code execution backdoor via the request package.PyPI · perdido · fixed in 0.0.3
- CVE-2022-33004The Beginner package in PyPI v0.0.2 to v0.0.4 was discovered to contain a code execution backdoor via the request package.PyPI · beginner · fixed in 0.0.5
- CVE-2022-33000The ML-Scanner package in PyPI v0.1.0 to v0.1.5 was discovered to contain a code execution backdoor via the request package.PyPI · ml-scanner · fixed in 0.1.7
- CVE-2022-32998The cryptoasset-data-downloader package in PyPI v1.0.0 to v1.0.1 was discovered to contain a code execution backdoor via the request packagePyPI · cryptoasset-data-downloader · fixed in 1.0.2
- CVE-2022-32997The RootInteractive package in PyPI v0.0.5 to v0.0.19b0 was discovered to contain a code execution backdoor via the request package.PyPI · rootinteractive · fixed in 0.0.19
- CVE-2022-32996The django-navbar-client package of v0.9.50 to v1.0.1 was discovered to contain a code execution backdoor via the request package.PyPI · django-navbar-client · fixed in 1.0.2
- CVE-2022-22967An issue was discovered in SaltStack Salt in versions before 3002.9, 3003.5, 3004.2.PyPI · salt · fixed in 3002.9, 3003.5, 3004.2
- CVE-2021-46823python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regulaPyPI · python-ldap · fixed in 3.4.0
- CVE-2022-2112Improper Neutralization of Formula Elements in a CSV File in inventree/inventreePyPI · inventree · fixed in 0.7.2
- CVE-2022-2111Unrestricted Upload of File with Dangerous Type in inventree/inventreePyPI · inventree · fixed in 0.7.2
- CVE-2022-29241Known or guessable hidden files may be accessed in Jupyter ServerPyPI · jupyter-server · fixed in 1.17.0, 1.17.1, 2.0.0a1
- CVE-2022-29238Forced Browsing in Jupyter NotebookPyPI · notebook · fixed in 6.4.12
- CVE-2022-2054Code Injection in nuitka/nuitkaPyPI · nuitka · fixed in 0.9
- CVE-2022-32563An issue was discovered in Couchbase Sync Gateway 3.x before 3.0.2.PyPI · couchbase · fixed in 3.0.2
- CVE-2022-31313api-res-py package in PyPI 0.1 is vulnerable to a code execution backdoor in the request package.PyPI · api-res-py