Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-25951XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service.PyPI · xml2dict
- CVE-2021-35959In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tPyPI · plone · fixed in 5.2.5
- CVE-2021-33503An issue was discovered in urllib3 before 1.26.5.PyPI · urllib3 · fixed in 1.26.5
- CVE-2021-29063A Regular Expression Denial of Service (ReDOS) vulnerability was discovered in Mpmath v1.0.0 through v1.2.1 when the mpmathify function is cPyPI · mpmath · fixed in 1.3.0
- CVE-2021-32681Improper escaping of HTML ('Cross-site Scripting') in Wagtail StreamField blocksPyPI · wagtail · fixed in 2.11.8, 2.12.5, 2.13.2
- CVE-2021-23393Open RedirectPyPI · flask-unchained · fixed in 0.9.0
- CVE-2021-34363The thefuck (aka The Fuck) package before 3.31 for Python allows Path Traversal that leads to arbitrary file deletion via the "undo archive PyPI · thefuck · fixed in 3.31
- CVE-2021-32677Cross-Site Request Forgery (CSRF) in FastAPIPyPI · fastapi · fixed in 0.65.2
- CVE-2021-33203Django before 2.2.24, 3.x before 3.1.12, and 3.2.x before 3.2.4 has a potential directory traversal via django.contrib.admindocs.PyPI · django · fixed in 2.2.24, 3.1.12, 3.2.4
- CVE-2021-32674Remote Code Execution via traversal in TAL expressionsPyPI · zope · fixed in 4.6.1, 5.2.1
- CVE-2021-33571In Django 2.2 before 2.2.24, 3.x before 3.1.12, and 3.2 before 3.2.4, URLValidator, validate_ipv4_address, and validate_ipv46_address do notPyPI · django · fixed in 2.2.24, 3.1.12, 3.2.4
- CVE-2021-32670Reflected cross-site scripting issue in DatasettePyPI · datasette · fixed in 0.56.1
- CVE-2021-29621Observable Response Discrepancy in Flask-AppBuilderPyPI · flask-appbuilder · fixed in 3.3.0
- CVE-2021-33880The aaugustin websockets library before 9.1 for Python has an Observable Timing Discrepancy on servers when HTTP Basic Authentication is enaPyPI · websockets · fixed in 9.1
- CVE-2021-28677An issue was discovered in Pillow before 8.2.0.PyPI · pillow · fixed in 8.2.0
- CVE-2021-28678An issue was discovered in Pillow before 8.2.0.PyPI · pillow · fixed in 8.2.0
- CVE-2021-25288An issue was discovered in Pillow before 8.2.0.PyPI · pillow · fixed in 8.2.0
- CVE-2021-25287An issue was discovered in Pillow before 8.2.0.PyPI · pillow · fixed in 8.2.0
- CVE-2021-28675An issue was discovered in Pillow before 8.2.0.PyPI · pillow · fixed in 8.2.0
- CVE-2017-8761In OpenStack Swift through 2.10.1, 2.11.0 through 2.13.0, and 2.14.0, the proxy-server logs full tempurl paths, potentially leaking reusablePyPI · swift · fixed in 2.15.2
- CVE-2021-28676An issue was discovered in Pillow before 8.2.0.PyPI · pillow · fixed in 8.2.0
- CVE-2021-20267A flaw was found in openstack-neutron's default Open vSwitch firewall rules.PyPI · neutron · fixed in 16.3.1, 15.3.3, 17.1.1
- CVE-2020-10729A flaw was found in the use of insufficiently random values in Ansible.PyPI · ansible · fixed in 2.9.6
- CVE-2021-33038An issue was discovered in management/commands/hyperkitty_import.py in HyperKitty through 1.3.4.PyPI · hyperkitty · fixed in 1.3.5
- CVE-2021-20178A flaw was found in ansible module where credentials are disclosed in the console log by default and not protected by the security feature wPyPI · ansible · fixed in 2.9.18
- CVE-2021-20191A flaw was found in ansible.PyPI · ansible · fixed in 2.9.18rc1, 2.8.19rc1, 2.10.7 and more
- CVE-2021-32629Memory access due to code generation flaw in Cranelift modulePyPI · wasmtime · fixed in 0.27.0
- CVE-2021-33507Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow PyPI · plone, products-cmfcore +1 · fixed in 5.2.5, 2.5.1, 2.6.2
- CVE-2021-33508Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.PyPI · plone · fixed in 5.2.5
- CVE-2021-33509Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transformPyPI · plone · fixed in 5.2.5