Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-22815path_getbbox in path.c in Pillow before 9.0.0 improperly initializes ImagePath.Path.PyPI · pillow · fixed in 9.0.0
- CVE-2022-22816path_getbbox in path.c in Pillow before 9.0.0 has a buffer over-read during initialization of ImagePath.Path.PyPI · pillow · fixed in 9.0.0
- CVE-2022-22817PIL.ImageMath.eval in Pillow before 9.0.0 allows evaluation of arbitrary expressions, such as ones that use the Python exec method.PyPI · pillow · fixed in 9.0.0, 9.0.1
- CVE-2021-45115An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1.PyPI · django · fixed in 2.2.26, 3.2.11, 4.0.1
- CVE-2021-45116An issue was discovered in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1.PyPI · django · fixed in 2.2.26, 3.2.11, 4.0.1
- CVE-2021-45452Storage.save in Django 2.2 before 2.2.26, 3.2 before 3.2.11, and 4.0 before 4.0.1 allows directory traversal if crafted filenames are directPyPI · django · fixed in 2.2.26, 3.2.11, 4.0.1
- CVE-2021-3842Inefficient Regular Expression Complexity in nltk/nltkPyPI · nltk · fixed in 3.6.6
- CVE-2021-45958UltraJSON (aka ujson) through 5.1.0 has a stack-based buffer overflow in Buffer_AppendIndentUnchecked (called from encode).PyPI · ujson · fixed in 5.2.0, 5.1.0
- CVE-2021-45943GDAL 3.3.0 through 3.4.0 has a heap-based buffer overflow in PCIDSK::CPCIDSKFile::ReadFromFile (called from PCIDSK::CPCIDSKSegment::ReadFromPyPI · gdal · fixed in 3.4.1
- CVE-2021-23727Stored Command InjectionPyPI · celery · fixed in 5.2.2
- CVE-2021-43857Gerapy may contain remote code execution vulnerabilityPyPI · gerapy · fixed in 0.9.8
- CVE-2021-44078An issue was discovered in split_region in uc.c in Unicorn Engine before 2.0.0-rc5.PyPI · unicorn · fixed in 2.0.0rc1
- CVE-2021-4162Cross-Site Request Forgery (CSRF) in archivy/archivyPyPI · archivy · fixed in 1.6.2
- CVE-2021-43854Inefficient Regular Expression Complexity in nltkPyPI · nltk · fixed in 3.6.5, 3.6.6
- CVE-2021-4118Deserialization of Untrusted Data in pytorchlightning/pytorch-lightningPyPI · lightning, pytorch-lightning · fixed in 1.6.0
- CVE-2021-41500Incomplete string comparison vulnerability exits in cvxopt.org cvxop <= 1.2.6 in APIs (cvxopt.cholmod.diag, cvxopt.cholmod.getfactor, cvxoptPyPI · cvxopt · fixed in 1.2.7
- CVE-2021-41499Buffer Overflow Vulnerability exists in ajaxsoundstudio.com n Pyo < 1.03 in the Server_debug function, which allows remote attackers to condPyPI · pyo · fixed in 1.0.3
- CVE-2021-41498Buffer overflow in ajaxsoundstudio.com Pyo < and 1.03 in the Server_jack_init function.PyPI · pyo · fixed in 1.0.4
- CVE-2021-41497Null pointer reference in CMS_Conservative_increment_obj in RaRe-Technologies bounter version 1.01 and 1.10, allows attackers to conduct DenPyPI · bounter
- CVE-2021-41496Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service aPyPI · numpy · fixed in 1.19, 1.19.0
- CVE-2021-41495Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-valPyPI · numpy · fixed in 1.19.1, 1.19
- CVE-2021-34141An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying byPyPI · numpy · fixed in 1.22, 1.10.0
- CVE-2021-33430A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large diPyPI · numpy · fixed in 1.21, 1.10.0
- CVE-2021-43837Template injection in vault-cliPyPI · vault-cli · fixed in 3.0.0
- CVE-2021-43831Files on the host computer can be accessed from the Gradio interfacePyPI · gradio · fixed in 2.5.0
- CVE-2021-43818HTML Cleaner allows crafted and SVG embedded scripts to pass throughPyPI · lxml · fixed in 4.6.5
- CVE-2021-41265Improper Authentication in Flask-AppBuilderPyPI · flask-appbuilder · fixed in 3.3.4
- CVE-2021-43811Code injection via unsafe YAML loadingPyPI · sockeye · fixed in 2.3.24
- CVE-2021-37941A local privilege escalation issue was found with the APM Java agent, where a user on the system could attach a malicious file to an applicaPyPI · elastic-apm · fixed in 1.27.0
- CVE-2021-44420In Django 2.2 before 2.2.25, 3.1 before 3.1.14, and 3.2 before 3.2.10, HTTP requests for URLs with trailing newlines could bypass upstream aPyPI · django · fixed in 2.2.25, 3.1.14, 3.2.10