Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-24828Local Privilege Escalation in execuatables bundled by pkgnpm · pkg
- CVE-2023-31506A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary wePackagist · getgrav/grav
- CVE-2023-25365Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3Packagist · october/october
- CVE-2024-24113xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.Maven · com.xuxueli:xxl-job
- CVE-2024-24595Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server leaPyPI · clearml
- CVE-2023-50781M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657PyPI · m2crypto
- CVE-2024-22567File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.Maven · net.mingsoft:ms-mcms
- CVE-2023-51838Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.npm · meshcentral
- CVE-2023-51837Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.npm · meshcentral
- CVE-2023-51839DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.npm · @devicefarmer/stf
- CVE-2024-0960flink-extended ai-flow workflow_command.py cloudpickle.loads deserializationPyPI · ai-flow
- CVE-2024-0937van_der_Schaar LAB synthcity PKL File load_from_file deserializationPyPI · synthcity
- CVE-2024-0936van_der_Schaar LAB TemporAI PKL File load_from_file deserializationPyPI · temporai
- CVE-2024-23904Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a fMaven · org.jenkins-ci.plugins:log-command
- CVE-2023-24676An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url paramePackagist · processwire/processwire
- CVE-2024-22490Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter.Maven · com.ibeetl:beetl
- CVE-2024-22496Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.Maven · com.jfinal:jfinal
- CVE-2024-22497Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crMaven · com.jfinal:jfinal
- CVE-2024-23342python-ecdsa vulnerable to Minerva attack on P-256PyPI · ecdsa
- CVE-2024-23752GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrarPyPI · pandasai
- CVE-2024-23332Client configured with permissive trust policies susceptible to rollback attack in Notary ProjectGo · github.com/notaryproject/notation
- CVE-2024-21670CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credentialcrates.io · anoncreds-clsignatures, ursa
- CVE-2022-31021Unlinkability broken in ursa when verifiers use malicious keyscrates.io · anoncreds-clsignatures, ursa
- CVE-2024-22362Drupal contains a vulnerability with improper handling of structural elements.Packagist · drupal/core
- CVE-2023-51282An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.Maven · net.mingsoft:ms-mcms
- CVE-2024-22491A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parameteMaven · com.ibeetl:beetl
- CVE-2023-52288An issue was discovered in the flaskcode package through 0.0.8 for Python.PyPI · flaskcode
- CVE-2023-52289An issue was discovered in the flaskcode package through 0.0.8 for Python.PyPI · flaskcode
- CVE-2024-22492A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbiMaven · com.jfinal:jfinal
- CVE-2024-22493A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbiMaven · com.jfinal:jfinal