Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-9070Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentomlPyPI · bentoml
- CVE-2024-10907Denial of Service (DoS) via Multipart Boundary in lm-sys/fastchatPyPI · fschat
- CVE-2024-9159Incorrect Authorization in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-9107Stored XSS in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-9056Denial of Service in bentoml/bentomlPyPI · bentoml
- CVE-2024-10550Denial of Service by ReDOS in h2oai/h2o-3PyPI · h2o
- CVE-2024-12778Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-8061Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-10906Cross-Site Request Forgery (CSRF) in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2025-0317Divide By Zero in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2024-11603Server-Side Request Forgery in lm-sys/fastchatPyPI · fschat
- CVE-2024-10908Open Redirect in lm-sys/fastchatPyPI · fschat
- CVE-2024-6854Arbitrary File Overwrite in h2oai/h2o-3PyPI · h2o
- CVE-2024-10707Local File Inclusion in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6851Arbitrary File Deletion in aimhubio/aimPyPI · aim
- CVE-2024-10190Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovodPyPI · horovod
- CVE-2024-10829Denial of Service (DoS) via Multipart Boundary in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-8438Path Traversal in modelscope/agentscopePyPI · agentscope
- CVE-2025-0315Allocation of Resources Without Limits or Throttling in ollama/ollamaGo · github.com/ollama/ollama
- CVE-2024-10901Arbitrary File Write via DuckDB SQL Injection in eosphoros-ai/db-gptPyPI · dbgpt
- CVE-2024-8502Remote Code Execution via Deserialization in modelscope/agentscopePyPI · agentscope
- CVE-2024-6483Arbitrary File/Directory Deletion in aimhubio/aimPyPI · aim
- CVE-2025-0330Exposure of Sensitive Information in berriai/litellmPyPI · litellm
- CVE-2024-9053Remote Code Execution in vllm-project/vllmPyPI · vllm
- CVE-2024-12216Arbitrary File Write via TarSlip in dmlc/gluon-cvPyPI · gluoncv
- CVE-2024-10572Denial of Service and Arbitrary File Write in h2oai/h2o-3PyPI · h2o
- CVE-2024-8955SSRF in composiohq/composioPyPI · composio-core
- CVE-2024-8020Denial of Service in lightning-ai/pytorch-lightningPyPI · lightning, pytorch-lightning
- CVE-2024-10110Denial of Service in aimhubio/aimPyPI · aim
- CVE-2024-12909SQL Injection to RCE in run-llama/llama_indexPyPI · llama-index-packs-finchat