Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-30877The keep for python, as distributed on PyPI, included a code-execution backdoor inserted by a third party.PyPI · keep
- CVE-2022-31027Authorization Bypass Through User-Controlled Key when using CILogonOAuthenticator in oauthenticatorPyPI · oauthenticator · fixed in 15.0.0
- CVE-2022-29255Multiple evaluation of contract address in call in vyperPyPI · vyper · fixed in 0.3.4
- CVE-2022-24840Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in django-s3filePyPI · django-s3file · fixed in 5.5.1
- CVE-2022-29773An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackersPyPI · aleksis-core · fixed in 2.9
- CVE-2022-24065Command InjectionPyPI · cookiecutter · fixed in 2.1.1
- CVE-2022-31015Uncaught Exception (due to a data race) leads to process termination in WaitressPyPI · waitress · fixed in 2.1.2
- CVE-2022-30034Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass.PyPI · flower · fixed in 1.2.0
- CVE-2022-31799Bottle before 0.12.20 mishandles errors during early request binding.PyPI · bottle · fixed in 0.12.20
- CVE-2022-30595libImaging/TgaRleDecode.c in Pillow 9.1.0 has a heap buffer overflow in the processing of invalid TGA image files.PyPI · pillow · fixed in 9.1.1
- CVE-2022-29361Improper parsing of HTTP requests in Pallets Werkzeug v2.1.0 and below allows attackers to perform HTTP Request Smuggling using a crafted HTPyPI · werkzeug · fixed in 2.1.1
- CVE-2022-29217Key confusion through non-blocklisted public key formats in PyJWTPyPI · pyjwt · fixed in 2.4.0
- CVE-2022-29216Code injection in `saved_model_cli` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29213Incomplete validation in signal ops leads to crashes in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29210Heap buffer overflow due to incorrect hash function in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.8.1
- CVE-2022-29209Type confusion leading to `CHECK`-failure based denial of service in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29211Segfault in TensorFlow if `tf.histogram_fixed_width` is called with NaN valuesPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29212Core dump when loading TFLite models with quantization in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29201Missing validation in `QuantizedConv2D` results in undefined behavior in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29202Denial of service in TensorFlow due to lack of validation in `tf.ragged.constant`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29203Integer overflow in `SpaceToBatchND` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29204Missing validation causes denial of service in TensorFlow via `Conv3DBackpropFilterV2`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29208Segfault and Out-of-bounds Write write due to incomplete validation in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29205Segfault due to missing support for quantized types in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29206Missing validation results in undefined behavior in `SparseTensorDenseAdd` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29207Undefined behavior when users supply invalid resource handles in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29195Missing validation causes denial of service in TensorFlow via `StagePeek`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29197Missing validation causes denial of service in TensorFlow via `UnsortedSegmentJoin`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29196Missing validation causes denial of service in TensorFlow via `Conv3DBackpropFilterV2`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29198Missing validation causes denial of service in TensorFlow via `SparseTensorToCSRSparseMatrix`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1