Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-39159Remote code execution in BinderhubPyPI · binderhub · fixed in 0.2.0, 0.2.0-n653
- CVE-2021-39160Code injection in nbgitpullerPyPI · nbgitpuller · fixed in 0.10.2
- CVE-2021-38598OpenStack Neutron before 16.4.1, 17.x before 17.1.3, and 18.0.0 allows hardware address impersonation when the linuxbridge driver with ebtabPyPI · neutron · fixed in 16.4.1, 17.1.3, 18.1.0
- CVE-2021-39371An XML external entity (XXE) injection in PyWPS before 4.4.5 allows an attacker to view files on the application server filesystem by assignPyPI · pywps · fixed in 4.5.0
- CVE-2020-18899An uncontrolled memory allocation in DataBufdata(subBox.length-sizeof(box)) function of Exiv2 0.27 allows attackers to cause a denial of serPyPI · exiv2
- CVE-2021-39286Webrecorder pywb before 2.6.0 allows XSS because it does not ensure that Jinja2 templates are autoescaped.PyPI · pywb · fixed in 2.6.0
- CVE-2020-18705XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.PyPI · quokka
- CVE-2020-18704Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widPyPI · django-widgy · fixed in 0.9.0
- CVE-2020-18703XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'.PyPI · quokka
- CVE-2020-18702Cross Site Scripting (XSS) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component PyPI · quokka
- CVE-2020-18701Incorrect Access Control in Lin-CMS-Flask v0.1.1 allows remote attackers to obtain sensitive information and/or gain privileges due to the aPyPI · lin-cms
- CVE-2020-18699Cross Site Scripting (XSS) in Lin-CMS-Flask v0.1.1 allows remote attackers to execute arbitrary code by entering scripts in the the 'UsernamPyPI · lin-cms
- CVE-2020-18698Improper Authentication in Lin-CMS-Flask v0.1.1 allows remote attackers to launch brute force login attempts without restriction via the 'loPyPI · lin-cms
- CVE-2021-23422Arbitrary Code InjectionPyPI · bikeshed · fixed in 3.0.0
- CVE-2021-23423Directory TraversalPyPI · bikeshed · fixed in 3.0.0
- CVE-2021-35936No Authentication on Logging ServerPyPI · apache-airflow · fixed in 2.1.2
- CVE-2021-37705Improper Authorization and Origin Validation Error in OneFuzzPyPI · onefuzz · fixed in 2.31.0
- CVE-2021-37690Use after free and segfault in shape inference functions in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37678Arbitrary code execution due to YAML deserializationPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37692Segfault on strings tensors with mistmatched dimensions in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37669Crash in NMS ops caused by integer conversion to unsigned in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37673`CHECK`-fail in `MapStage` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37663Incomplete validation in `QuantizeV2` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37682Use of unitialized value in TensorFlow LitePyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37674Incomplete validation in `MaxPoolGrad` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37665Incomplete validation in MKL requantization in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37677Missing validation in shape inference for `Dequantize` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37683Division by zero in TensorFlow Lite division operationsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37684Division by zero in TensorFlow Lite pooling operationsPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37668Division by zero in TensorFlow Lite `tf.raw_ops.UnravelIndex`PyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1