Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-13596An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7.PyPI · django · fixed in 2.2.13, 3.0.7
- CVE-2020-13254An issue was discovered in Django 2.2 before 2.2.13 and 3.0 before 3.0.7.PyPI · django · fixed in 2.2.13, 3.0.7
- CVE-2020-12607An issue was discovered in fastecdsa before 2.1.2.PyPI · fastecdsa · fixed in 2.1.2
- CVE-2020-13757Python-RSA before 4.1 ignores leading '\0' bytes during decryption of ciphertext.PyPI · rsa · fixed in 4.1
- CVE-2020-13388An exploitable vulnerability exists in the configuration-loading functionality of the jw.util package before 2.3 for Python.PyPI · jw-util · fixed in 2.3
- CVE-2020-7658meinheld prior to 1.0.2 is vulnerable to HTTP Request Smuggling.PyPI · meinheld · fixed in 1.0.2
- CVE-2020-13258Contentful through 2020-05-21 for Python allows reflected XSS, as demonstrated by the api parameter to the-example-app.py.PyPI · contentful · fixed in 1.12.4
- CVE-2020-7655netius prior to 1.17.58 is vulnerable to HTTP Request Smuggling.PyPI · netius · fixed in 1.17.58
- CVE-2020-11078CRLF injection in httplib2PyPI · httplib2 · fixed in 0.18.0
- CVE-2020-13091pandas through 1.0.3 can unserialize and execute commands from an untrusted file that is passed to the read_pickle() function, if __reduce__PyPI · pandas · fixed in 1.0.4
- CVE-2020-13092scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute commands from an untrusted file that is passed to the joblib.load() fuPyPI · scikit-learn · fixed in 0.23.1
- CVE-2020-12889MISP MISP-maltego 1.4.4 incorrectly shares a MISP connection across users in a remote-transform use case.PyPI · misp-maltego · fixed in 1.4.5
- CVE-2020-10744An incomplete fix was found for the fix of the flaw CVE-2020-1733 ansible: insecure temporary directory when running become_user from becomePyPI · ansible · fixed in 2.8.0a1, 2.8.13, 2.9.10 and more
- CVE-2020-1746A flaw was found in the Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 PyPI · ansible · fixed in 2.7.17, 2.8.11, 2.9.7
- CVE-2020-10685A flaw was found in Ansible Engine affecting Ansible Engine versions 2.7.x before 2.7.17 and 2.8.x before 2.8.11 and 2.9.x before 2.9.7 as wPyPI · ansible · fixed in 2.7.17, 2.8.11, 2.9.7
- CVE-2020-11054Incorrect Provision of Specified Functionality in qutebrowserPyPI · qutebrowser · fixed in 1.11.1, 1.11.0
- CVE-2020-12689An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.PyPI · keystone · fixed in 15.0.1, 16.0.1
- CVE-2020-12690An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.PyPI · keystone · fixed in 15.0.1, 16.0.0
- CVE-2020-12691An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.PyPI · keystone · fixed in 15.0.1, 16.0.1
- CVE-2020-12692An issue was discovered in OpenStack Keystone before 15.0.1, and 16.0.0.PyPI · keystone · fixed in 16.0.0, 15.0.1
- CVE-2018-21233TensorFlow before 1.7.0 has an integer overflow that causes an out-of-bounds read, possibly causing disclosure of the contents of process mePyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.7.0
- CVE-2020-11037Potential Observable Timing Discrepancy in WagtailPyPI · wagtail · fixed in 2.7.3, 2.8.2, 2.9
- CVE-2020-11652An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.PyPI · salt · fixed in 2019.2.4, 3000.2
- CVE-2020-11651An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2.PyPI · salt · fixed in 2019.2.4, 3000.2
- CVE-2020-10691An archive traversal flaw was found in all ansible-engine versions 2.9.x prior to 2.9.7, when running ansible-galaxy collection install.PyPI · ansible · fixed in 2.9.7
- CVE-2020-11010SQL injection in Tortoise ORMPyPI · tortoise-orm · fixed in 0.15.23, 0.16.6
- CVE-2020-11888python-markdown2 through 2.3.8 allows XSS because element names are mishandled unless a \w+ match succeeds.PyPI · markdown2 · fixed in 2.3.9
- CVE-2020-11001Possible XSS attack in WagtailPyPI · wagtail · fixed in 2.7.2, 2.8.1
- CVE-2019-14905A vulnerability was found in Ansible Engine versions 2.9.x before 2.9.3, 2.8.x before 2.8.8, 2.7.x before 2.7.16 and earlier, where in AnsibPyPI · ansible · fixed in 2.7.16, 2.8.8, 2.9.3
- CVE-2019-15796python-apt downloads from untrusted sourcesPyPI · python-apt · fixed in 1.9.5