Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-36581A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.npm · @abw/badger-database
- CVE-2024-36582alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)npm · @alexbinary/object-deep-assign
- CVE-2024-36586An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary.Go · github.com/adguardteam/adguardhome
- CVE-2024-36760A stack overflow vulnerability was found in version 1.18.0 of rhai.crates.io · rhai
- CVE-2024-36265Apache Submarine Server Core: authorization bypassPyPI · apache-submarine
- CVE-2024-36264Apache Submarine Commons Utils: default secretPyPI · apache-submarine
- CVE-2024-36263Apache Submarine Server Core: SQL injectionMaven · org.apache.submarine:submarine-server-core
- CVE-2024-37629SummerNote v0.9.1 is vulnerable to Cross Site Scripting (XSS) via the Code View Function.npm · summernote
- CVE-2024-36528nukeviet v.4.5 and before and nukeviet-egov v.1.2.02 and before have a Deserialization vulnerability which results in code execution via /adPackagist · nukeviet/nukeviet
- CVE-2024-4680Insufficient Session Expiration in zenml-io/zenmlPyPI · zenml
- CVE-2024-36823The encrypt() function of Ninja Core v7.0.0 was discovered to use a weak cryptographic algorithm, leading to a possible leakage of sensitiveMaven · org.ninjaframework:ninja-core
- CVE-2024-37154Evmos allows unvested token delegationsGo · github.com/evmos/evmos, github.com/evmos/evmos/v10 +16
- CVE-2024-3408Authentication Bypass and RCE in man-group/dtalePyPI · dtale
- CVE-2024-4890Blind SQL Injection in berriai/litellmPyPI · litellm
- CVE-2024-5550Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3PyPI · h2o
- CVE-2024-4325Server-Side Request Forgery (SSRF) in gradio-app/gradioPyPI · gradio
- CVE-2024-5037Openshift/telemeter: iss check during jwt authentication can be bypassedGo · github.com/openshift/telemeter
- CVE-2024-37273An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code vianpm · @janhq/core
- CVE-2024-36858An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via npm · @janhq/core
- CVE-2024-36857Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.npm · @janhq/core
- CVE-2024-37065Deserialization of untrusted data can occur in versions 0.6 or newer of the skops python library, enabling a maliciously crafted model to ruPyPI · skops
- CVE-2024-37064Deseriliazation of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a maliciouslPyPI · ydata-profiling
- CVE-2024-37063A cross-site scripting (XSS) vulnerability in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library allows for payloads to PyPI · ydata-profiling
- CVE-2024-37062Deserialization of untrusted data can occur in versions 3.7.0 or newer of Ydata's ydata-profiling open-source library, enabling a malicouslyPyPI · ydata-profiling
- CVE-2024-37061Remote Code Execution can occur in versions of the MLflow platform running version 1.11.0 or newer, enabling a maliciously crafted MLprojectPyPI · mlflow
- CVE-2024-37060Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.27.0 or newer, enabling a maliciously craftPyPI · mlflow
- CVE-2024-37059Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.5.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-37058Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.5.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-37057Deserialization of untrusted data can occur in versions of the MLflow platform running version 2.0.0rc0 or newer, enabling a maliciously uplPyPI · mlflow
- CVE-2024-37056Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.23.0 or newer, enabling a maliciously uploaPyPI · mlflow