Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-9622Resteasy-netty4-cdi: resteasy-netty4: resteasy-reactor-netty: http request smuggling leading to client timeouts in resteasy-netty4Maven · org.jboss.resteasy:resteasy-netty4-cdi
- CVE-2024-21533All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL npm · ggit
- CVE-2024-21532All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the bnpm · ggit
- CVE-2024-25885An issue in the getcolor function in utils.py of xhtml2pdf v0.2.13 allows attackers to cause a Regular expression Denial of Service (ReDOS) PyPI · xhtml2pdf
- CVE-2024-45932Krayin CRM v1.3.0 is vulnerable to Cross Site Scripting (XSS) via the organization name field in /admin/contacts/organizations/edit/2.Packagist · krayin/laravel-crm
- CVE-2024-45960Zenario 9.7.61188 allows authenticated admin users to upload PDF files containing malicious code into the target system.Packagist · tribalsystems/zenario
- CVE-2024-45962October 3.6.30 allows an authenticated admin account to upload a PDF file containing malicious JavaScript into the target system.Packagist · october/october
- CVE-2024-45964Zenario 9.7.61188 is vulnerable to Cross Site Scripting (XSS) in the Image library via the "Organizer tags" field.Packagist · tribalsystems/zenario
- CVE-2024-9355Golang-fips: golang fips zeroed bufferGo · github.com/golang-fips/openssl
- CVE-2024-21531All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the pronpm · git-shallow-clone
- CVE-2024-45967Pagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.Packagist · pagekit/pagekit
- CVE-2024-9283RelaxedJS ReLaXed Pug to PDF Converter cross site scriptingnpm · relaxedjs
- CVE-2024-9277Langflow HTTP POST Request utils.py redosPyPI · langflow
- CVE-2024-46632Assimp v5.4.3 is vulnerable to Buffer Overflow via the MD5Importer::LoadMD5MeshFile function.PyPI · pyassimp
- CVE-2024-22892OpenSlides 4.0.15 was discovered to be using a weak hashing algorithm to store passwords.PyPI · openslides
- CVE-2024-22893OpenSlides 4.0.15 verifies passwords by comparing password hashes using a function with content-dependent runtime.PyPI · openslides
- CVE-2024-46489A remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL.npm · @ifnotnowwhen/promptr
- CVE-2024-47218An issue was discovered in vesoft NebulaGraph through 3.8.0.Go · github.com/vesoft-inc/nebula
- CVE-2024-47226A stored cross-site scripting (XSS) vulnerability exists in NetBox 4.1.0 within the "Configuration History" feature of the "Admin" panel viaPyPI · pynetbox
- CVE-2024-47219An issue was discovered in vesoft NebulaGraph through 3.8.0.Go · github.com/vesoft-inc/nebula
- CVE-2024-8375Object deserialization in Reverb leading to RCEPyPI · dm-reverb, dm-reverb-nightly
- CVE-2024-46946langchain_experimental (aka LangChain Experimental) 0.1.17 through 0.3.0 for LangChain allows attackers to execute arbitrary code through syPyPI · langchain-experimental
- CVE-2024-35515Insecure deserialization in sqlitedict up to v2.1.0 allows attackers to execute arbitrary code.PyPI · sqlitedict
- CVE-2024-8948MicroPython objint.c mpz_as_bytes heap-based overflowPyPI · micropython-copy, micropython-io +1
- CVE-2024-8947MicroPython objarray.c use after freePyPI · micropython-copy, micropython-io
- CVE-2024-8946MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflowPyPI · micropython-copy, micropython-io +2
- CVE-2024-8939Vllm: denials of service in vllm json web apiPyPI · vllm
- CVE-2024-7387Openshift/builder: path traversal allows command injection in privileged buildcontainer using docker build strategyGo · github.com/openshift/builder
- CVE-2024-8865composiohq composio api.py path path traversalPyPI · composio-core
- CVE-2024-8864composiohq composio calculator.py Calculator code injectionPyPI · composio-core