Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-29199Missing validation causes denial of service in TensorFlow via `LoadAndRemapMatrix`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29200Missing validation causes denial of service in TensorFlow via `LSTMBlockCell`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29193Missing validation causes `TensorSummaryV2` in TensorFlow to crashPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29194Missing validation causes denial of service via `DeleteSessionTensor` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29191Missing validation causes denial of service via `GetSessionTensor` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-29192Missing validation crashes `QuantizeAndDequantizeV4Grad` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.4, 2.7.2, 2.8.1
- CVE-2022-21195Regular Expression Denial of Service (ReDoS)PyPI · url-regex
- CVE-2022-28990WASM3 v0.5.0 was discovered to contain a heap overflow via the component /wabt/bin/poc.wasm.PyPI · pywasm3
- CVE-2022-1432Cross-site Scripting (XSS) - Generic in octoprint/octoprintPyPI · octoprint · fixed in 1.8.0
- CVE-2022-1430Cross-site Scripting (XSS) - DOM in octoprint/octoprintPyPI · octoprint · fixed in 1.8.0
- CVE-2022-30765Calibre-Web before 0.6.18 allows user table SQL Injection.PyPI · calibreweb · fixed in 0.6.18
- CVE-2022-28470marcador package in PyPI 0.1 through 0.13 included a code-execution backdoor.PyPI · marcador · fixed in 0.14
- CVE-2018-25033ADMesh through 0.98.4 has a heap-based buffer over-read in stl_update_connects_remove_1 (called from stl_remove_degenerate) in connect.c in PyPI · admesh · fixed in 0.98.5
- CVE-2022-1053Keylime does not enforce that the agent registrar data is the same when the tenant uses it for validation of the EK and identity quote and tPyPI · keylime · fixed in 6.4.0
- CVE-2022-24902Memory issue in playing videosPyPI · tkvideoplayer · fixed in 2.0.0
- CVE-2022-1592Server-Side Request Forgery in scout in clinical-genomics/scoutPyPI · scout-browser · fixed in 4.52
- CVE-2022-30284In the python-libnmap package through 0.7.2 for Python, remote command execution can occur (if used in a client application that does not vaPyPI · python-libnmap · fixed in 0.7.3
- CVE-2022-1554Path Traversal due to `send_file` call in clinical-genomics/scoutPyPI · scout-browser · fixed in 4.52
- CVE-2021-41945Encode OSS httpx < 0.23.0 is affected by improper input validation in `httpx.URL`, `httpx.Client` and some functions using `httpx.URL.copy_wPyPI · httpx · fixed in 0.20.0, 0.23.0
- CVE-2022-23942Apache Doris hardcoded cryptography initializationPyPI · pydoris · fixed in 1.0.0
- CVE-2022-24880Potential Captcha Validate Bypass in flask-session-captchaPyPI · flask-session-captcha · fixed in 1.2.1
- CVE-2022-28108Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/fPyPI · selenium · fixed in 4.0.0
- CVE-2022-24859Manipulated inline images can cause Infinite Loop in PyPDF2PyPI · pypdf2 · fixed in 1.27.5
- CVE-2022-24857Multi factor authentication bypass in django-mfa3PyPI · django-mfa3 · fixed in 0.5.0
- CVE-2022-24845Integer bounds error in VyperPyPI · vyper · fixed in 0.3.2
- CVE-2022-27479SQL injection vulnerability in chart data APIPyPI · apache-superset · fixed in 1.4.2
- CVE-2022-24788Buffer overflow in VyperPyPI · vyper · fixed in 0.3.2
- CVE-2022-28346An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.PyPI · django · fixed in 2.2.28, 3.2.13, 4.0.4
- CVE-2022-28347A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4.PyPI · django · fixed in 2.2.28, 3.2.13, 4.0.4
- CVE-2022-24787Incorrect Comparison in VyperPyPI · vyper · fixed in 0.3.2