Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-31604furlongm openvpn-monitor through 1.1.3 allows CSRF to disconnect an arbitrary client.PyPI · openvpn-monitor
- CVE-2021-31606furlongm openvpn-monitor through 1.1.3 allows Authorization Bypass to disconnect arbitrary clients.PyPI · openvpn-monitor
- CVE-2020-23478Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/PyPI · leo · fixed in 6.3
- CVE-2021-3583A flaw was found in Ansible, where a user's controller is vulnerable to template injection.PyPI · ansible · fixed in 2.9.23, 2.9.23rc1, 2.10.11rc1 and more
- CVE-2021-39229Regular expression deinal of service in apprisePyPI · apprise · fixed in 0.9.5.1
- CVE-2021-32838Regular Expression Denial of Service in flask-restxPyPI · flask-restx · fixed in 0.5.1
- CVE-2021-32839Regular Expression Denial of Service in sqlparsePyPI · sqlparse · fixed in 0.4.2
- CVE-2021-32297An issue was discovered in LIEF through 0.11.4.PyPI · lief · fixed in 0.11.5, 0.11.0
- CVE-2021-39218Out-of-bounds read/write and invalid free with `externref`s and GC safepoints in WasmtimePyPI · wasmtime · fixed in 0.30.0
- CVE-2021-39219Wrong type for `Linker`-define functions when used across two `Engine`sPyPI · wasmtime · fixed in 0.30.0
- CVE-2021-39216Use after free passing `externref`s to Wasm in WasmtimePyPI · wasmtime · fixed in 0.30.0
- CVE-2021-39214Lacking Protection against HTTP Request Smuggling in mitmproxyPyPI · mitmproxy · fixed in 7.0.3
- CVE-2021-39207Deserialization of Untrusted Data in parlaiPyPI · parlai · fixed in 1.1.0
- CVE-2021-24040Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicioPyPI · parlai · fixed in 1.1.0
- CVE-2021-40347An issue was discovered in views/list.py in GNU Mailman Postorius before 1.3.5.PyPI · postorius · fixed in 1.3.5
- CVE-2021-40839The rencode package through 1.0.6 for Python allows an infinite loop in typecode decoding (such as via ;\x2f\x7f), enabling a remote attack PyPI · rencode
- CVE-2021-38540Apache Airflow: Variable Import endpoint missed authentication checkPyPI · apache-airflow · fixed in 2.1.3
- CVE-2021-40797An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1.PyPI · neutron · fixed in 16.4.1, 17.2.1, 18.1.1
- CVE-2021-32805URL Redirection to Untrusted Site ('Open Redirect') in Flask-AppBuilderPyPI · flask-appbuilder · fixed in 3.3.2
- CVE-2021-22004An issue was discovered in SaltStack Salt before 3003.3.PyPI · salt · fixed in 3003.3
- CVE-2021-23404Cross-site Request Forgery (CSRF)PyPI · sqlite-web
- CVE-2021-21996An issue was discovered in SaltStack Salt before 3003.3.PyPI · salt · fixed in 3003.3
- CVE-2021-23437Regular Expression Denial of Service (ReDoS)PyPI · pillow · fixed in 8.3.2
- CVE-2021-40494A Hardcoded JWT Secret Key in metadata.py in AdaptiveScale LXDUI through 2.1.3 allows attackers to gain admin access to the host system.PyPI · lxdui
- CVE-2021-40085An issue was discovered in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1.PyPI · neutron · fixed in 16.4.1, 17.2.1, 18.1.1
- CVE-2021-39164Improper authorisation of /members discloses room membership to non-membersPyPI · matrix-synapse · fixed in 1.41.1
- CVE-2021-39163Adding a private/unlisted room to a community exposes room metadata in an unauthorised manner.PyPI · matrix-synapse · fixed in 1.41.1
- CVE-2020-19002Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the 'Description' field of the componenPyPI · mezzanine
- CVE-2020-19000Cross Site Scripting (XSS) in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary code via line 54 of the component 'simiPyPI · simiki · fixed in 1.6.2.2
- CVE-2020-19001Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'siPyPI · simiki · fixed in 1.6.2.2