Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-21332Cross-site scripting (XSS) vulnerability in the password reset endpointPyPI · matrix-synapse · fixed in 1.27.0
- CVE-2021-21386Improper Neutralization of Argument Delimiters in a Decompiling Package ProcessPyPI · apkleaks · fixed in 2.0.4
- CVE-2021-29002A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.site_title" parameterPyPI · plone
- CVE-2021-21401Invalid free() call in NanopbPyPI · nanopb · fixed in 0.3.9.8, 0.4.5
- CVE-2021-20270An infinite loop in SMLLexer in Pygments versions 1.5 to 2.7.3 may lead to denial of service when performing syntax highlighting of a StandaPyPI · pygments · fixed in 2.7.4
- CVE-2021-21377Open Redirect in OMERO.webPyPI · omero-web · fixed in 5.9.0
- CVE-2021-21376Information Exposure in OMERO.webPyPI · omero-web · fixed in 5.9.0
- CVE-2021-28957An XSS vulnerability was discovered in python-lxml's clean module versions before 4.6.3.PyPI · lxml · fixed in 4.6.3
- CVE-2021-25293An issue was discovered in Pillow before 8.1.1.PyPI · pillow · fixed in 8.1.1
- CVE-2021-25292An issue was discovered in Pillow before 8.1.1.PyPI · pillow · fixed in 8.1.1
- CVE-2021-25291An issue was discovered in Pillow before 8.1.1.PyPI · pillow · fixed in 8.1.1, 8.2.0
- CVE-2021-25290An issue was discovered in Pillow before 8.1.1.PyPI · pillow · fixed in 8.1.1
- CVE-2021-25289An issue was discovered in Pillow before 8.1.1.PyPI · pillow · fixed in 8.1.1
- CVE-2021-27291In pygments 1.1+, fixed in 2.7.4, the lexers used to parse programming languages rely heavily on regular expressions.PyPI · pygments · fixed in 2.7.4
- CVE-2021-28363The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies.PyPI · urllib3 · fixed in 1.26.4
- CVE-2021-21371Execution of untrusted code through config filePyPI · tenable-jira-cloud · fixed in 1.1.21, 1.1.22
- CVE-2021-21360Exposure of Sensitive Information to an Unauthorized Actor in Products.GenericSetupPyPI · products-genericsetup · fixed in 2.1.1
- CVE-2021-21337URL Redirection to Untrusted Site ('Open Redirect') in Products.PluggableAuthServicePyPI · products-pluggableauthservice · fixed in 2.6.1
- CVE-2021-21336Exposure of Sensitive Information to an Unauthorized Actor in Products.PluggableAuthService ZODBRoleManagerPyPI · products-pluggableauthservice · fixed in 2.6.0
- CVE-2021-27907Apache Superset stored XSS on Dashboard markdownPyPI · apache-superset · fixed in 0.38.1
- CVE-2021-26813markdown2 >=1.0.1.18, fixed in 2.4.0, is affected by a regular expression denial of service vulnerability.PyPI · markdown2 · fixed in 2.4.0
- CVE-2021-25315salt-api unauthenticated remote code executionPyPI · salt · fixed in 3002.2
- CVE-2021-27921Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is notPyPI · pillow · fixed in 8.1.1, 8.1.2
- CVE-2021-27922Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is notPyPI · pillow · fixed in 8.1.2, 8.1.1
- CVE-2021-27923Pillow before 8.1.2 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is notPyPI · pillow · fixed in 8.1.2, 8.1.1
- CVE-2020-28243An issue was discovered in SaltStack Salt before 3002.5.PyPI · salt · fixed in 2015.8.10, 2015.8.13, 2016.3.4 and more
- CVE-2020-28972In SaltStack Salt before 3002.5, authentication to VMware vcenter, vsphere, and esxi servers (in the vmware.py files) does not always validaPyPI · salt · fixed in 2015.8.13, 2016.11.5, 2016.11.10 and more
- CVE-2020-35662In SaltStack Salt before 3002.5, when authenticating to services using certain modules, the SSL certificate is not always validated.PyPI · salt · fixed in 2015.8.10, 2015.8.13, 2016.3.4 and more
- CVE-2021-25281An issue was discovered in through SaltStack Salt before 3002.5.PyPI · salt · fixed in 2015.8.10, 2015.8.13, 2016.3.4 and more
- CVE-2021-25282An issue was discovered in through SaltStack Salt before 3002.5.PyPI · salt · fixed in 2015.8.13, 2016.11.5, 2016.11.10 and more