Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-41218Integer division by 0 in `tf.raw_ops.AllToAll`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41206Incomplete validation of shapes in multiple TF opsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4
- CVE-2021-41208Incomplete validation in boosted trees codePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41207Division by zero in `ParallelConcat`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41202Overflow/crash in `tf.range`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41209FPE in convolutions with zero size filtersPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41203Missing validation during checkpoint loadingPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41215Null pointer exception in `DeserializeSparse`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41217Null pointer exception when `Exit` node is not preceded by `Enter` opPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41219Undefined behavior via `nullptr` reference binding in sparse matrix multiplicationPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41214Reference binding to `nullptr` in `tf.ragged.cross`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41204Segfault while copying constant resource tensorPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41226Heap OOB read in `SparseBinCount`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41223Heap OOB read in `FusedBatchNorm` kernelsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41224`SparseFillEmptyRows` heap OOB readPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41212Heap OOB read in `tf.ragged.cross`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41211Heap OOB read in shape inference for `QuantizeV2`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.7.0
- CVE-2021-41205Heap OOB read in all `tf.raw_ops.QuantizeAndDequantizeV*` opsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41210Heap OOB read in `tf.raw_ops.SparseCountSparseOutput`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41201Unitialized access in `EinsumHelper::ParseEquation`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41200Incomplete validation in `tf.summary.create_file_writer`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41197Crashes due to overflow and `CHECK`-fail in ops with large tensor shapesPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41198Overflow/crash in `tf.tile` when tiling tensor is largePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41199Overflow/crash in `tf.image.resize` when size is largePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1 and more
- CVE-2021-41196Crash in `max_pool3d` when size argument is 0 or negativePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.6.1, 2.5.2, 2.4.4 and more
- CVE-2021-41195Crash in `tf.math.segment_*` operationsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.4.4, 2.5.2, 2.6.1
- CVE-2021-41247incomplete logout in JupyterHubPyPI · jupyterhub · fixed in 1.5.0
- CVE-2021-41134Stored XSS in Jupyter nbdimePyPI · nbdime · fixed in 1.1.1, 2.1.1, 3.1.1
- CVE-2020-26705The parseXML function in Easy-XML 0.5.0 was discovered to have a XML External Entity (XXE) vulnerability which allows for an attacker to expPyPI · easy-xml
- CVE-2021-41194Improper Access Control in jupyterhub-firstuseauthenticatorPyPI · jupyterhub-firstuseauthenticator · fixed in 1.0.0