Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-37055Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.24.0 or newer, enabling a maliciously uploaPyPI · mlflow
- CVE-2024-37054Deserialization of untrusted data can occur in versions of the MLflow platform running version 0.9.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-37053Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-37052Deserialization of untrusted data can occur in versions of the MLflow platform running version 1.1.0 or newer, enabling a maliciously uploadPyPI · mlflow
- CVE-2024-5565Prompt Injection in "ask" API with visualization leads to RCEPyPI · vanna
- CVE-2024-4330Path Traversal in parisneo/lollms-webuiPyPI · lollms
- CVE-2024-29415The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, npm · ip
- CVE-2024-5273Jenkins Report Info Plugin 1.2 and earlier does not perform path validation of the workspace directory while serving report files, allowing Maven · org.jenkins-ci.plugins:report-info
- CVE-2024-5315Multiple vulnerabilities in DOLIBARR's ERP CMSPackagist · dolibarr/dolibarr
- CVE-2024-5314Multiple vulnerabilities in DOLIBARR's ERP CMSPackagist · dolibarr/dolibarr
- CVE-2024-29392Silverpeas Core 6.3 is vulnerable to Cross Site Scripting (XSS) via ClipboardSessionController.Maven · org.silverpeas.core:silverpeas-core
- CVE-2024-35056NASA AIT-Core v2.5.2 was discovered to contain multiple SQL injection vulnerabilities via the query_packets and insert functions.PyPI · ait-core
- CVE-2024-35057An issue in NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via a crafted packet.PyPI · ait-core
- CVE-2024-35058An issue in the API wait function of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary code via supplying a crafted string.PyPI · ait-core
- CVE-2024-35059An issue in the Pickle Python library of NASA AIT-Core v2.5.2 allows attackers to execute arbitrary commands.PyPI · ait-core
- CVE-2024-35061NASA AIT-Core v2.5.2 was discovered to use unencrypted channels to exchange data over the network, allowing attackers to execute a man-in-thPyPI · ait-core
- CVE-2024-34710Wiki.js Stored XSS through Client Side Template Injection Go · github.com/requarks/wiki
- CVE-2024-24293A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argumennpm · @bit/loader
- CVE-2024-4264Remote Code Execution in berriai/litellmPyPI · litellm
- CVE-2024-4321Local File Inclusion (LFI) in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2023-40297Stakater Forecastle 1.0.139 and before allows %5C../ directory traversal in the website component.Go · github.com/stakater/forecastle
- CVE-2020-26312GHSL-2020-254: Arbitrary file read and/or write in dotmeshGo · github.com/dotmesh-io/dotmesh
- CVE-2024-31556An issue in Reportico Web before v.8.1.0 allows a local attacker to execute arbitrary code and obtain sensitive information via the sessioniPackagist · reportico-web/reportico
- CVE-2024-30054Microsoft Power BI Client JavaScript SDK Information Disclosure VulnerabilityNuGet · microsoft.powerbi.javascript
- CVE-2024-34243Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter.npm · kongadmin
- CVE-2024-3462Authorization bypass in Ant Media ServerMaven · io.antmedia:ant-media-server
- CVE-2024-34365Apache Karaf Cave: Cave SSRF and arbitrary file accessMaven · org.apache.karaf:cave
- CVE-2024-33748Cross-site scripting (XSS) vulnerability in the search function in Maven net.mingsoft MS Basic 2.1.13.4 and earlier.Maven · net.mingsoft:ms-basic
- CVE-2024-34246wasm3 v0.5.0 was discovered to contain an out-of-bound memory read which leads to segmentation fault via the function "main" in wasm3/platfoPyPI · pywasm3
- CVE-2024-34249wasm3 v0.5.0 was discovered to contain a heap buffer overflow which leads to segmentation fault via the function "DeallocateSlot" in wasm3/sPyPI · pywasm3