Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-8524Directory Traversal in modelscope/agentscopePyPI · agentscope
- CVE-2024-12777Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-11043Denial of Service (DoS) via Large Payload in Board Name Field in invoke-ai/invokeaiPyPI · invokeai
- CVE-2024-8021Open Redirect in gradio-app/gradioPyPI · gradio
- CVE-2024-10648Path Traversal in gradio-app/gradioPyPI · gradio
- CVE-2024-8238Unrestricted Code Execution in aimhubio/aimPyPI · aim
- CVE-2024-12217Path Traversal in gradio-app/gradioPyPI · gradio
- CVE-2024-8062Denial of Service in h2oai/h2o-3PyPI · h2o
- CVE-2024-8966Denial of Service in gradio-app/gradioPyPI · gradio
- CVE-2025-0453Denial of Service through Batched Queries in GraphQL in mlflow/mlflowPyPI · mlflow
- CVE-2024-10955ReDoS (Regular Expression Denial of Service) in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-8537Path Traversal in modelscope/agentscopePyPI · agentscope
- CVE-2024-10912Denial of Service in lm-sys/fastchatPyPI · fschat
- CVE-2024-8952SSRF in composiohq/composioPyPI · composio-core
- CVE-2024-10569Zip Bomb Vulnerability in gradio-app/gradioPyPI · gradio
- CVE-2024-8063Divide by Zero in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2025-0189Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-11602CORS Vulnerability in feast-dev/feastPyPI · feast
- CVE-2025-0312NULL Pointer Dereference in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2024-6829Arbitrary File Overwrite through tarfile-extraction in aimhubio/aimPyPI · aim
- CVE-2024-7768Denial of Service in h2oai/h2o-3PyPI · h2o
- CVE-2025-0191Denial of Service in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-10624Regular Expression Denial of Service (ReDoS) in gradio-app/gradioPyPI · gradio
- CVE-2024-9229Denial of Service (DoS) via Multipart Boundary in stangirard/quivrPyPI · quivr-core
- CVE-2024-11041Remote Code Execution in vllm-project/vllmPyPI · vllm
- CVE-2024-6577Unclaimed S3 Bucket Usage in pytorch/servePyPI · torchserve
- CVE-2024-6863Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3PyPI · h2o
- CVE-2024-12376Server Side Request Forgery in lm-sys/fastchatPyPI · fschat
- CVE-2024-8551Path Traversal in modelscope/agentscopePyPI · agentscope
- CVE-2024-8616Arbitrary File Overwrite in h2oai/h2o-3PyPI · h2o