Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-6538Openshift-console: openshift console: server-side request forgeryGo · github.com/openshift/console
- CVE-2024-52787An issue in the upload_documents method of libre-chat v0.0.6 allows attackers to execute a path traversal via supplying a crafted filename iPyPI · libre-chat
- CVE-2024-28892An OS command injection vulnerability exists in the name parameter of GoCast 1.1.3.Go · github.com/mayuresh82/gocast
- CVE-2024-53425A heap-buffer-overflow vulnerability was discovered in the SkipSpacesAndLineEnd function in Assimp v5.4.3.PyPI · pyassimp
- CVE-2024-9526Stored XSS in Kubeflow Pipeline ViewGo · github.com/kubeflow/pipelines
- CVE-2024-1240Open Redirection in pyload/pyloadPyPI · pyload-ng
- CVE-2024-24425Magma v1.8.0 and OAI EPC Federation v1.20 were discovered to contain an out-of-bounds read in the amf_as_establish_req function at /tasks/amGo · github.com/magma/magma
- CVE-2024-24426Reachable assertions in the NGAP_FIND_PROTOCOLIE_BY_ID function of OpenAirInterface Magma v1.8.0 and OAI EPC Federation v1.2.0 allow attackeGo · github.com/magma/magma
- CVE-2024-51093Stored Cross-Site Scripting (XSS) vulnerability in Snipe-IT - v7.0.13 allows an attacker to upload a malicious XML file containing JavaScripPackagist · snipe/snipe-it
- CVE-2024-51135An XML External Entity (XXE) vulnerability in the component DocumentBuilderFactory of powertac-server v1.9.0 allows attackers to access sensMaven · org.powertac:server-interface
- CVE-2024-27527wasm3 139076a is vulnerable to Denial of Service (DoS).PyPI · pywasm3
- CVE-2024-27528wasm3 139076a suffers from Invalid Memory Read, leading to DoS and potential Code Execution.PyPI · pywasm3
- CVE-2024-27529wasm3 139076a contains memory leaks in Read_utf8.PyPI · pywasm3
- CVE-2024-27530wasm3 139076a contains a Use-After-Free in ForEachModule.PyPI · pywasm3
- CVE-2024-51434Inconsistent <plaintext> tag parsing allows for XSS in Froala WYSIWYG editor 4.3.0 and earlier.npm · froala-editor
- CVE-2024-51735Stored Cross-site Scripting to RCE on Osmedeus Web ServerGo · github.com/j3ssie/osmedeus
- CVE-2024-48052In gradio <=4.42.0, the gr.DownloadButton function has a hidden server-side request forgery (SSRF) vulnerability.PyPI · gradio
- CVE-2024-48057localai <=2.20.1 is vulnerable to Cross Site Scripting (XSS).Go · github.com/mudler/localai
- CVE-2024-48061langflow <=1.0.18 is vulnerable to Remote Code Execution (RCE) as any component provided the code functionality and the components run on thPyPI · langflow
- CVE-2024-51127An issue in the createTempFile method of hornetq v2.4.9 allows attackers to arbitrarily overwrite files or access sensitive information.Maven · org.hornetq:hornetq-core-client
- CVE-2024-49770oak's path traversal allows transfer of hidden files within the served root directorynpm · @oakserver/oak
- CVE-2024-42515Glossarizer through 1.5.2 improperly tries to convert text into HTML.npm · glossarizer
- CVE-2024-42835langflow v1.0.12 was discovered to contain a remote code execution (RCE) vulnerability via the PythonCodeTool component.PyPI · langflow
- CVE-2024-48307JeecgBoot v3.7.1 was discovered to contain a SQL injection vulnerability via the component /onlDragDatasetHead/getTotalData.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2024-48112A deserialization vulnerability in the component \controller\Index.php of Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary coPackagist · topthink/thinkphp
- CVE-2024-10452Organization admins can delete pending invites created in an organization they are not part of.Go · github.com/grafana/grafana
- CVE-2024-8143Unauthorized Access to User Chat History in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6581Remote Code Execution due to Stored XSS in parisneo/lollmsPyPI · lollms
- CVE-2024-7807Denial of Service (DOS) in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-7962Arbitrary File Read via Insufficient Validation in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt