Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-46942In OpenDaylight Model-Driven Service Abstraction Layer (MD-SAL) through 13.0.1, a controller with a follower role can configure flow entriesMaven · org.opendaylight.mdsal:mdsal-artifacts
- CVE-2024-46943An issue was discovered in OpenDaylight Authentication, Authorization and Accounting (AAA) through 0.19.3.Maven · org.opendaylight.aaa:aaa-artifacts
- CVE-2024-8863aimhubio aim Text Explorer textbox.tsx dangerouslySetInnerHTML cross site scriptingPyPI · aim
- CVE-2024-45856A cross-site scripting (XSS) vulnerability exists in all versions of the MindsDB platform, enabling the execution of a JavaScript payload whPyPI · mindsdb
- CVE-2024-45855Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousPyPI · mindsdb
- CVE-2024-45854Deserialization of untrusted data can occur in versions 23.10.3.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousPyPI · mindsdb
- CVE-2024-45853Deserialization of untrusted data can occur in versions 23.10.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded ‘inhousPyPI · mindsdb
- CVE-2024-45852Deserialization of untrusted data can occur in versions 23.3.2.0 and newer of the MindsDB platform, enabling a maliciously uploaded model toPyPI · mindsdb
- CVE-2024-45857Deserialization of untrusted data can occur in versions 2.4.0 or newer of the Cleanlab project, enabling a maliciously crafted datalab.pkl fPyPI · cleanlab
- CVE-2024-27321An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its multilabPyPI · refuel-autolabel
- CVE-2024-27320An arbitrary code execution vulnerability exists in versions 0.0.8 and newer of the Refuel Autolabel library because of the way its classifiPyPI · refuel-autolabel
- CVE-2024-6091Shell Command Denylist Bypass in significant-gravitas/autogptPyPI · agpt
- CVE-2024-21528All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to impronpm · node-gettext
- CVE-2024-8373AngularJS improper sanitization in '<source>' elementnpm · angular
- CVE-2024-8372AngularJS improper sanitization in 'srcset' attributenpm · angular
- CVE-2024-44902A deserialization vulnerability in Thinkphp v6.1.3 to v8.0.4 allows attackers to execute arbitrary code.Packagist · topthink/framework
- CVE-2024-45758H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command exPyPI · h2o
- CVE-2024-8462Windmill HTTP Request users.rs excessive authenticationGo · github.com/windmill-labs/windmill
- CVE-2024-8296FeehiCMS index.php insert unrestricted uploadPackagist · feehi/cms
- CVE-2024-8295FeehiCMS index.php createBanner unrestricted uploadPackagist · feehi/cms
- CVE-2024-8294FeehiCMS index.php update unrestricted uploadPackagist · feehi/cms
- CVE-2024-8181Flowise Authentication Bypassnpm · flowise
- CVE-2024-8182Flowise Denial of Servicenpm · flowise
- CVE-2024-42816A cross-site scripting (XSS) vulnerability in the Create Product function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary PyPI · fastapi-admin
- CVE-2024-42818A cross-site scripting (XSS) vulnerability in the Config-Create function of fastapi-admin pro v0.1.4 allows attackers to execute arbitrary wPyPI · fastapi-admin
- CVE-2024-45244Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.Go · github.com/hyperledger/fabric
- CVE-2024-45190Mage AI pipeline interaction request remote arbitrary file leakPyPI · mage-ai
- CVE-2024-45189Mage AI git content request remote arbitrary file leakPyPI · mage-ai
- CVE-2024-45188Mage AI file content request remote arbitrary file leakPyPI · mage-ai
- CVE-2024-45187Mage AI allows deleted users to use the terminal server with admin access, leading to remote code executionPyPI · mage-ai