Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-41078Nameko through 2.13.0 can be tricked into performing arbitrary code execution when deserializing the config file.PyPI · nameko · fixed in 2.14.0, 3.0.0rc10
- CVE-2021-42343An issue was discovered in the Dask distributed package before 2021.10.0 for Python.PyPI · dask, distributed · fixed in 2021.10.0
- CVE-2021-41127Maliciously Crafted Model Archive Can Lead To Arbitrary File Write in rasaPyPI · rasa · fixed in 2.8.10
- CVE-2021-41146Arbitrary command execution on Windows in qutebrowserPyPI · qutebrowser · fixed in 1.8.0, 2.4.0
- CVE-2021-42771Babel.Locale in Babel before 2.9.1 allows attackers to load arbitrary locale .dat files (containing serialized Python objects) via directoryPyPI · babel · fixed in 2.9.1
- CVE-2021-41131Client metadata path-traversal in python-tufPyPI · tuf · fixed in 0.19.0
- CVE-2021-42576The bluemonday sanitizer before 1.0.16 for Go, and before 0.0.8 for Python (in pybluemonday), does not properly enforce policies associated PyPI · pybluemonday · fixed in 0.0.8
- CVE-2021-41971Possible SQL Injection when template processing is enabledPyPI · apache-superset · fixed in 1.3.1
- CVE-2021-32609XSS vulnerability on Explore pagePyPI · apache-superset · fixed in 1.2.0
- CVE-2021-40720Ops CLI Deserialization of Untrusted Data leads to Abritrary Code ExecutionPyPI · ops-cli · fixed in 2.0.5
- CVE-2021-41132Inconsistent input sanitisation leads to XSS vectorsPyPI · omero-figure, omero-web · fixed in 4.4.1, 5.11.0
- CVE-2021-42134The Unicorn framework before 0.36.1 for Django allows XSS via a component.PyPI · django-unicorn · fixed in 0.36.1
- CVE-2021-40978The mkdocs 1.2.2 built-in dev-server allows directory traversal using the port 8000, enabling remote exploitation to obtain :sensitive inforPyPI · mkdocs · fixed in 1.2.3
- CVE-2021-42053The Unicorn framework through 0.35.3 for Django allows XSS via component.name.PyPI · django-unicorn · fixed in 0.36.0
- CVE-2021-41125HTTP authentication credential leak to target websites in scrapyPyPI · scrapy · fixed in 1.8.1, 2.5.1
- CVE-2021-41121Memory corruption in VyperPyPI · vyper · fixed in 0.3.0
- CVE-2020-19003An issue in Gate One 1.2.0 allows attackers to bypass to the verification check done by the origins list and connect to Gate One instances uPyPI · gateone
- CVE-2021-41122Bounds check missing for decimal args in VyperPyPI · vyper · fixed in 0.3.0
- CVE-2021-41124Splash authentication credentials potentially leaked to target websites in scrapy-splashPyPI · scrapy-splash · fixed in 0.8.0
- CVE-2021-41867An information disclosure vulnerability in OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to retrieve the full list of paPyPI · onionshare-cli · fixed in 2.4
- CVE-2021-41868OnionShare 2.3 before 2.4 allows remote unauthenticated attackers to upload files on a non-public node when using the --receive functionalitPyPI · onionshare-cli · fixed in 2.4
- CVE-2021-22557Code execution in SLO Generator via YAML PayloadPyPI · slo-generator · fixed in 2.0.1
- CVE-2021-40325Cobbler before 3.3.0 allows authorization bypass for modification of settings.PyPI · cobbler · fixed in 3.3.0
- CVE-2021-40324Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.PyPI · cobbler · fixed in 3.3.0
- CVE-2021-40323Cobbler before 3.3.0 allows log poisoning, and resultant Remote Code Execution, via an XMLRPC method that logs to the logfile for template iPyPI · cobbler · fixed in 3.3.0
- CVE-2021-25963Shuup - Reflected XSS in Error PagePyPI · shuup · fixed in 2.11.0
- CVE-2021-25962Shuup - Formula Injection in Checkout AddressesPyPI · shuup · fixed in 2.11.0
- CVE-2021-41104web_server allows OTA update without checking user defined basic auth username & passwordPyPI · esphome · fixed in 2021.9.2
- CVE-2021-3828Inefficient Regular Expression Complexity in nltk/nltkPyPI · nltk · fixed in 3.6.4
- CVE-2021-31605furlongm openvpn-monitor through 1.1.3 allows %0a command injection via the OpenVPN management interface socket.PyPI · openvpn-monitor