Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-15195Heap buffer overflow in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-15196Heap buffer overflow in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.1
- CVE-2020-15197Denial of Service in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.1
- CVE-2020-15198Heap buffer overflow in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.1
- CVE-2020-15199Denial of Service in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.1
- CVE-2020-15200Segfault in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 2.3.1
- CVE-2020-15190Segfault in TensorflowPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.15.4, 2.0.3, 2.1.2 and more
- CVE-2020-14365A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packagPyPI · ansible · fixed in 2.8.16rc1, 2.9.14rc1, 2.8.15 and more
- CVE-2020-7734Cross-site Scripting (XSS)PyPI · cabot
- CVE-2020-25489A heap overflow in Sqreen PyMiniRacer (aka Python Mini Racer) before 0.3.0 allows remote attackers to potentially exploit heap corruption.PyPI · py-mini-racer · fixed in 0.3.0
- CVE-2020-13944In Apache Airflow < 1.10.12, the "origin" parameter passed to some of the endpoints like '/trigger' was vulnerable to XSS exploit.PyPI · apache-airflow · fixed in 1.10.12
- CVE-2020-13948While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templPyPI · apache-superset · fixed in 0.37.1
- CVE-2020-8927Buffer overflow in Brotli libraryPyPI · brotli · fixed in 1.0.8
- CVE-2020-14332A flaw was found in the Ansible Engine when using module_args.PyPI · ansible · fixed in 2.8.14, 2.9.12, 2.10.1rc2
- CVE-2020-14330An Improper Output Neutralization for Logs flaw was found in Ansible when using the uri module, where sensitive data is exposed to content aPyPI · ansible · fixed in 2.10.0
- CVE-2020-15163Invalid root may become trusted root in The Update Framework (TUF)PyPI · tuf · fixed in 0.12.0
- CVE-2019-20916The pip package before 19.2 for Python allows Directory Traversal when a URL is given in an install command, because a Content-Disposition hPyPI · pip · fixed in 19.2
- CVE-2020-24584An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).PyPI · django · fixed in 2.2.16, 3.0.10, 3.1.1
- CVE-2020-24583An issue was discovered in Django 2.2 before 2.2.16, 3.0 before 3.0.10, and 3.1 before 3.1.1 (when Python 3.7+ is used).PyPI · django · fixed in 2.2.16, 3.0.10, 3.1.1
- CVE-2020-25032An issue was discovered in Flask-CORS (aka CORS Middleware for Flask) before 3.0.9.PyPI · flask-cors · fixed in 3.0.9
- CVE-2020-24715The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, native Python code is used that lacks PyPI · scalyr-agent-2 · fixed in 2.1.10
- CVE-2020-24714The Scalyr Agent before 2.1.10 has Missing SSL Certificate Validation because, in some circumstances, the openssl binary is called without tPyPI · scalyr-agent-2 · fixed in 2.1.10
- CVE-2020-17376An issue was discovered in Guest.migrate in virt/libvirt/guest.py in OpenStack Nova before 19.3.1, 20.x before 20.3.1, and 21.0.0.PyPI · nova · fixed in 19.3.1, 20.3.1, 21.1.0
- CVE-2019-14904A flaw was found in the solaris_zone module from the Ansible Community modules.PyPI · ansible · fixed in 2.7.16, 2.8.8, 2.9.3 and more
- CVE-2020-15147Remote Code Execution in Red Discord BotPyPI · red-discordbot · fixed in 3.3.12
- CVE-2020-15140Remote Code Execution in Red Discord BotPyPI · red-discordbot · fixed in 3.3.11
- CVE-2020-15141Path Traversal in openapi-python-clientPyPI · openapi-python-client · fixed in 0.5.3
- CVE-2020-15142Arbitrary Code GenerationPyPI · openapi-python-client · fixed in 0.5.3
- CVE-2020-17446asyncpg before 0.21.0 allows a malicious PostgreSQL server to trigger a crash or execute arbitrary code (on a database client) via a craftedPyPI · asyncpg · fixed in 0.21.0
- CVE-2020-17495django-celery-results through 1.2.1 stores task results in the database.PyPI · django-celery-results · fixed in 2.4.0, 2.0.0