Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-1594Local File Read via Path Traversal in mlflow/mlflowPyPI · mlflow
- CVE-2024-1593Path Traversal via Parameter Smuggling in mlflow/mlflowPyPI · mlflow
- CVE-2024-3575Cross-site Scripting (XSS) - Stored in mindsdb/mindsdbPyPI · mindsdb
- CVE-2024-1560Path Traversal Vulnerability in mlflow/mlflowPyPI · mlflow
- CVE-2024-31503Incorrect access control in Dolibarr ERP CRM versions 19.0.0 and before, allows authenticated attackers to steal victim users' session cookiPackagist · dolibarr/dolibarr
- CVE-2024-31839Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandlerGo · github.com/tiagorlampert/chaos
- CVE-2023-48865An issue discovered in Reportico Till 8.1.0 allows attackers to obtain sensitive information via execute_mode parameter of the URL.Packagist · reportico-web/reportico
- CVE-2024-2195Remote Code Execution in aimhubio/aimPyPI · aim
- CVE-2024-2196CSRF Vulnerability in aimhubio/aimPyPI · aim
- CVE-2024-2217Improper Access Control in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-29504Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payloanpm · summernote
- CVE-2024-3046In Eclipse Kura LogServlet component included in versions 5.0.0 to 5.4.1, a specifically crafted request to the servlet can allow an unautheMaven · org.eclipse.kura:org.eclipse.kura.web2
- CVE-2021-28656Apache Zeppelin: CSRF vulnerability in the Credentials pageMaven · org.apache.zeppelin:zeppelin-web
- CVE-2024-1233Eap: wildfly-elytron has a ssrf security issueMaven · org.wildfly.security:wildfly-elytron-realm-token
- CVE-2024-28732An issue was discovered in OFPMatch in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of service (DoS) PyPI · ryu
- CVE-2024-0406Mholt/archiver: path traversal vulnerabilityGo · github.com/mholt/archiver, github.com/mholt/archiver/v3
- CVE-2024-3366Xuxueli xxl-job Template JdkSerializeTool.java deserialize injectionMaven · com.xuxueli:xxl-job-core
- CVE-2024-0081 NVIDIA NeMo framework for Ubuntu contains a vulnerability in tools/asr_webapp where an attacker may cause an allocation of resources withouPyPI · nemo-asr
- CVE-2024-22363SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).npm · xlsx
- CVE-2024-27448MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js npm · maildev
- CVE-2024-31420Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashesGo · kubevirt.io/kubevirt
- CVE-2021-27312Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive Packagist · gleez/cms
- CVE-2024-29477Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the netPackagist · dolibarr/dolibarr
- CVE-2024-3137Improper Privilege Management in uvdesk/community-skeletonPackagist · uvdesk/core-framework
- CVE-2024-22780Cross Site Scripting vulnerability in CA17 TeamsACS v.1.0.1 allows a remote attacker to execute arbitrary code via a crafted script to the eGo · github.com/ca17/teamsacs
- CVE-2024-3138francoisjacquet RosarioSIS Add Portal Note cross site scriptingPackagist · francoisjacquet/rosariosis
- CVE-2024-3135Cross-Site Request Forgery (CSRF) Vulnerability in mudler/localaiGo · github.com/go-skynet/localai
- CVE-2024-29640An issue in aliyundrive-webdav v.2.3.3 and before allows a remote attacker to execute arbitrary code via a crafted payload to the sid paramePyPI · aliyundrive-webdav
- CVE-2024-29686Server-side Template Injection (SSTI) vulnerability in Winter CMS v.1.2.3 allows a remote attacker to execute arbitrary code via a crafted pPackagist · wintercms/winter
- CVE-2023-47438SQL Injection vulnerability in Reportico Till 8.1.0 allows attackers to obtain sensitive information or other system information via the proPackagist · reportico-web/reportico