Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-36536Insecure permissions in fabedge v0.8.1 allows attackers to access sensitive data and escalate privileges by obtaining the service account's Go · github.com/fabedge/fabedge
- CVE-2024-40767In OpenStack Nova before 27.4.1, 28 before 28.2.1, and 29 before 29.1.1, by supplying a raw format image that is actually a crafted QCOW2 imPyPI · nova
- CVE-2024-6783Vue client-side XSS via prototype pollutionnpm · vue-template-compiler
- CVE-2024-6960H2O deserializes ML models without filtering, potentially allowing execution of malicious codeMaven · ai.h2o:h2o-core
- CVE-2024-21583Versions of the package github.com/gitpod-io/gitpod/components/server/go/pkg/lib before main-gha.27122; versions of the package github.com/gGo · github.com/gitpod-io/gitpod, github.com/gitpod-io/gitpod/components/server/go +2
- CVE-2024-39123In janeczku Calibre-Web 0.6.0 to 0.6.21, the edit_book_comments function is vulnerable to Cross Site Scripting (XSS) due to improper sanitizPyPI · calibreweb
- CVE-2024-41597Cross Site Request Forgery vulnerability in ProcessWire v.3.0.229 allows a remote attacker to insert a comment.Packagist · processwire/processwire
- CVE-2024-6485XSS in Bootstrap button componentnpm · bootstrap
- CVE-2024-6035Stored XSS in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6036Denial of Service in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6037Arbitrary Folder Creation in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-21521All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toStrnpm · @discordjs/opus
- CVE-2024-21524All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling Tnpm · node-stringbuilder
- CVE-2024-21526All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertynpm · speaker
- CVE-2024-21522All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().npm · audify
- CVE-2024-21525All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourcnpm · node-twain
- CVE-2024-21523All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different funpm · images
- CVE-2024-39031In Silverpeas Core <= 6.3.5, in Mes Agendas, a user can create new events and add them to their calendar.Maven · org.silverpeas.core:silverpeas-core-rs, org.silverpeas.core:silverpeas-core-web
- CVE-2024-6227Infinite Loop in aimhubio/aimPyPI · aim
- CVE-2024-5753Local File Read (LFI) by Prompt Injection via Postgres SQL in vanna-ai/vannaPyPI · vanna
- CVE-2024-6524ShopXO Uploader.php server-side request forgeryPackagist · shopxo/shopxo
- CVE-2024-32498An issue was discovered in OpenStack Cinder through 24.0.0, Glance before 28.0.2, and Nova before 29.0.3.PyPI · cinder, glance +1
- CVE-2024-39223An authentication bypass in the SSH service of gost v2.11.5 allows attackers to intercept communications via setting the HostKeyCallback funGo · github.com/ginuerzh/gost
- CVE-2024-37146GHSL-2023-248: Flowise xss in /api/v1/credentials/idnpm · flowise
- CVE-2024-37145GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/idnpm · flowise
- CVE-2024-36423GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/idnpm · flowise
- CVE-2024-36422GHSL-2023-245: Flowise xss in api/v1/chatflows/idnpm · flowise
- CVE-2024-36421GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.tsnpm · flowise
- CVE-2024-36420GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-filenpm · flowise
- CVE-2024-38987aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep.npm · @aofl/cli-lib