Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-37635Heap out of bounds access in sparse reduction operations in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37664Heap OOB in boosted trees in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37659Out of bounds read via null pointer dereference in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37655Heap OOB in `ResourceScatterUpdate` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37637Null pointer dereference in `CompressElement` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37649Null pointer dereference in `UncompressElement` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37647Null pointer dereference in `SparseTensorSliceDataset` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37643Null pointer dereference in `MatrixDiagPartOp` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37639Null pointer dereference and heap OOB read in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37638Null pointer dereference in `RaggedTensorToTensor` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37660Division by 0 in inplace operations in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37653Division by 0 in `ResourceGather` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37642Division by 0 in `ResourceScatterDiv` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37640Integer division by 0 in sparse reshaping in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-37636Floating point exception in `SparseDenseCwiseDiv` in TensorFlowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.4, 2.4.3, 2.5.1
- CVE-2021-32798Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in notebookPyPI · notebook · fixed in 5.7.11, 6.4.1
- CVE-2021-3830523andMe Yamale before 3.0.8 allows remote attackers to execute arbitrary code via a crafted schema file.PyPI · yamale · fixed in 3.0.8
- CVE-2021-32797JupyterLab: XSS due to lack of sanitization of the action attribute of an html <form>PyPI · jupyterlab, notebook · fixed in 1.2.21, 2.2.10, 2.3.2 and more
- CVE-2021-38155OpenStack Keystone 10.x through 16.x before 16.0.2, 17.x before 17.0.1, 18.x before 18.0.1, and 19.x before 19.0.1 allows information discloPyPI · keystone · fixed in 16.0.2, 17.0.1, 18.0.1 and more
- CVE-2021-32811Remote Code Execution via Script (Python) objects under Python 3PyPI · accesscontrol, zope · fixed in 4.3, 5.2, 4.6.3 and more
- CVE-2021-32806URL Redirection to Untrusted Site ('Open Redirect') in Products.isurlinportalPyPI · products-isurlinportal · fixed in 1.2.0
- CVE-2021-32807Remote Code Execution via unsafe classes in otherwise permitted modulesPyPI · accesscontrol, zope · fixed in 4.3, 5.2
- CVE-2021-23418XML External Entity (XXE) InjectionPyPI · glances · fixed in 3.2.1
- CVE-2021-31292An integer overflow in CrwMap::encode0x1810 of Exiv2 0.27.3 allows attackers to trigger a heap-based buffer overflow and cause a denial of sPyPI · exiv2
- CVE-2019-25050netCDF in GDAL 2.4.2 through 3.0.4 has a stack-based buffer overflow in nc4_get_att (called from nc4_get_att_tc and nc_get_att_text) and in PyPI · gdal · fixed in 3.1.0
- CVE-2021-34552Pillow through 8.2.0 and PIL (aka Python Imaging Library) through 1.1.7 allow an attacker to pass controlled parameters directly into a convPyPI · pillow · fixed in 8.3.0
- CVE-2021-32559An integer overflow exists in pywin32 prior to version b301 when adding an access control entry (ACE) to an access control list (ACL) that wPyPI · pywin32 · fixed in 301
- CVE-2021-23401Open RedirectPyPI · flask-user
- CVE-2021-35042Django 3.1.x before 3.1.13 and 3.2.x before 3.2.5 allows QuerySet.order_by SQL injection if order_by is untrusted input from a client of a wPyPI · django · fixed in 3.1.13, 3.2.5
- CVE-2020-36407libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.PyPI · avif