Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-25283An issue was discovered in through SaltStack Salt before 3002.5.PyPI · salt · fixed in 2015.8.13, 2016.11.5, 2016.11.10 and more
- CVE-2021-25284An issue was discovered in through SaltStack Salt before 3002.5.PyPI · salt · fixed in 2015.8.13, 2016.11.5, 2016.11.10 and more
- CVE-2021-3144In SaltStack Salt before 3002.5, eauth tokens can be used once after expiration.PyPI · salt · fixed in 2015.8.10, 2015.8.13, 2016.3.4 and more
- CVE-2021-3148An issue was discovered in SaltStack Salt before 3002.5.PyPI · salt · fixed in 2015.8.13, 2016.11.5, 2016.11.10 and more
- CVE-2021-3197An issue was discovered in SaltStack Salt before 3002.5.PyPI · salt · fixed in 2015.8.10, 2015.8.13, 2016.3.4 and more
- CVE-2021-21273Open redirects on some federation and push requestsPyPI · matrix-synapse · fixed in 1.25.0
- CVE-2021-21274Denial of service attack via .well-known lookupsPyPI · matrix-synapse · fixed in 1.25.0
- CVE-2021-21330Open redirect vulnerability in aiohttpPyPI · aiohttp · fixed in 3.7.4
- CVE-2020-35681Django Channels 3.x before 3.0.3 allows remote attackers to obtain sensitive information from a different request scope.PyPI · channels · fixed in 3.0.3
- CVE-2020-28463Server-side Request Forgery (SSRF)PyPI · reportlab · fixed in 3.5.55
- CVE-2020-36245GramAddict through 1.2.3 allows remote attackers to execute arbitrary code because of use of UIAutomator2 and ATX-Agent.PyPI · gramaddict · fixed in 1.2.5, 1.2.4
- CVE-2021-26697Apache Airflow: Lineage API endpoint for Experimental API missed authentication checkPyPI · apache-airflow · fixed in 2.0.1, 2.0.1rc1
- CVE-2021-26559CWE-284 Improper Access Control on Configurations Endpoint for the Stable APIPyPI · apache-airflow · fixed in 2.0.1rc1, 2.0.1
- CVE-2020-25340An issue was discovered in NFStream 5.2.0.PyPI · nfstream · fixed in 6.0.0
- CVE-2021-23338Deserialization of Untrusted DataPyPI · pyqlib · fixed in 0.7.0, 0.6.3
- CVE-2020-14343A vulnerability was discovered in the PyYAML library in versions before 5.4, where it is susceptible to arbitrary code execution when it proPyPI · pyyaml · fixed in 5.4
- CVE-2021-21240Regular Expression Denial of Service in httplib2PyPI · httplib2 · fixed in 0.19.0
- CVE-2020-36242In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could resultPyPI · cryptography · fixed in 3.3.2
- CVE-2021-26722LinkedIn Oncall through 1.4.0 allows reflected XSS via /query because of mishandling of the "No results found for" message in the search barPyPI · oncall · fixed in 1.4.1
- CVE-2021-3281In Django 2.2 before 2.2.18, 3.0 before 3.0.12, and 3.1 before 3.1.6, the django.utils.archive.extract method (used by "startapp --template"PyPI · django · fixed in 2.2.18, 3.0.12, 3.1.6
- CVE-2020-28493Regular Expression Denial of Service (ReDoS)PyPI · jinja2 · fixed in 2.11.3
- CVE-2021-21238SAML XML Signature wrappingPyPI · pysaml2 · fixed in 6.5.0
- CVE-2021-21239Open default xmlsec1 key-type preferencePyPI · pysaml2 · fixed in 6.5.0
- CVE-2020-28473Web Cache PoisoningPyPI · bottle · fixed in 0.12.19
- CVE-2021-3028git-big-picture before 1.0.0 mishandles ' characters in a branch name, leading to code execution.PyPI · git-big-picture · fixed in 1.0.0
- CVE-2020-36191JupyterHub 1.1.0 allows CSRF in the admin panel via a request that lacks an _xsrf field, as demonstrated by a /hub/api/user request (to add PyPI · jupyterhub · fixed in 1.2.0b1
- CVE-2021-1725Bot Framework SDK Information Disclosure VulnerabilityPyPI · botframework-connector · fixed in 4.7.2, 4.8.1, 4.9.3 and more
- CVE-2020-35459An issue was discovered in ClusterLabs crmsh through 4.2.1.PyPI · crmsh
- CVE-2020-35655In Pillow before 8.1.0, SGIRleDecode has a 4-byte buffer over-read when decoding crafted SGI RLE image files because offsets and length tablPyPI · pillow · fixed in 8.1.0
- CVE-2020-35654In Pillow before 8.1.0, TiffDecode has a heap-based buffer overflow when decoding crafted YCbCr files because of certain interpretation confPyPI · pillow · fixed in 8.1.0