Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2019-13611An issue was discovered in python-engineio through 3.8.2.PyPI · python-engineio · fixed in 3.9.0
- CVE-2019-1010017libnmap < v0.6.3 is affected by: XML Injection.PyPI · python-libnmap · fixed in 0.6.3, 0.7.2
- CVE-2019-13594In Mirumee Saleor 2.7.0 (fixed in 2.8.0), CSRF protection middleware was accidentally disabled, which allowed attackers to send a POST requePyPI · saleor · fixed in 2.8.0
- CVE-2019-13177verification.py in django-rest-registration (aka Django REST Registration library) before 0.5.0 relies on a static string for signatures (i.PyPI · django-rest-registration · fixed in 0.5.0
- CVE-2019-12781An issue was discovered in Django 1.11 before 1.11.22, 2.1 before 2.1.10, and 2.2 before 2.2.3.PyPI · django · fixed in 2.1.10, 2.2.3, 1.11.22
- CVE-2019-13114http.c in Exiv2 through 0.27.1 allows a malicious http server to cause a denial of service (crash due to a NULL pointer dereference) by retuPyPI · exiv2
- CVE-2019-12887KeyIdentity LinOTP before 2.10.5.3 has Incorrect Access Control (issue 1 of 2).PyPI · linotp · fixed in 2.11.1
- CVE-2016-7404OpenStack Magnum passes OpenStack credentials into the Heat templates creating its instances.PyPI · openstack-magnum · fixed in 5.0.0
- CVE-2019-12855In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attaPyPI · twisted · fixed in 19.7.0rc1
- CVE-2019-12387In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters sPyPI · twisted · fixed in 19.2.1
- CVE-2018-19800aubio v0.4.0 to v0.4.8 has a Buffer Overflow in new_aubio_tempo.PyPI · aubio · fixed in 0.4.9
- CVE-2018-19801aubio v0.4.0 to v0.4.8 has a NULL pointer dereference in new_aubio_filterbank via invalid n_filters.PyPI · aubio · fixed in 0.4.9
- CVE-2018-19802aubio v0.4.0 to v0.4.8 has a new_aubio_onset NULL pointer dereference.PyPI · aubio · fixed in 0.4.9
- CVE-2019-12761A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu fPyPI · pyxdg · fixed in 0.26
- CVE-2019-12760A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache.PyPI · parso · fixed in 0.5.0
- CVE-2019-3895An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director.PyPI · octavia · fixed in 0.9.0
- CVE-2019-12308An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2.PyPI · django · fixed in 1.11.21, 2.1.9, 2.2.2
- CVE-2019-10047A stored XSS vulnerability exists in the web application of Pydio through 8.2.2 that can be exploited by levering the file upload and file pPyPI · pydio
- CVE-2019-12300Buildbot before 1.8.2 and 2.x before 2.3.1 accepts a user-submitted authorization token from OAuth and uses it to authenticate a user.PyPI · buildbot · fixed in 1.8.2, 2.3.1
- CVE-2016-7151Capstone 3.0.4 has an out-of-bounds vulnerability (SEGV caused by a read memory access) in X86_insn_reg_intel in arch/X86/X86Mapping.c.PyPI · capstone · fixed in 4.0.0
- CVE-2019-11842An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1.PyPI · matrix-sydent, matrix-synapse · fixed in 1.0.3, 0.99.3.1
- CVE-2018-7575Google TensorFlow 1.7.x and earlier is affected by a Buffer Overflow vulnerability.PyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.7.1
- CVE-2019-9635NULL pointer dereference in Google TensorFlow before 1.12.2 could cause a denial of service via an invalid GIF file.PyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.12.1, 1.12.2
- CVE-2018-10055Invalid memory access and/or a heap buffer overflow in the TensorFlow XLA compiler in Google TensorFlow before 1.7.1 could cause a crash or PyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.7.1
- CVE-2018-7577Memcpy parameter overlap in Google Snappy library 1.1.4, as used in Google TensorFlow before 1.7.1, could result in a crash or read from othPyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.7.1
- CVE-2018-8825Google TensorFlow 1.7 and below is affected by: Buffer Overflow.PyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.7.1
- CVE-2018-7576Google TensorFlow 1.6.x and earlier is affected by: Null Pointer Dereference.PyPI · tensorflow, tensorflow-cpu +1 · fixed in 1.7.0rc0, 1.6.0
- CVE-2015-1326python-dbusmock arbitrary code execution or file overwrite when templates are loaded from /tmpPyPI · python-dbusmock · fixed in 0.15.1
- CVE-2011-3147qcow format could expose host filesystem informationPyPI · nova · fixed in 12.0.0a0
- CVE-2019-3902A flaw was found in Mercurial before 4.9.PyPI · mercurial · fixed in 4.9