Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-40347Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowMaven · org.jenkins-ci.plugins:maven-artifact-choicelistprovider
- CVE-2023-38889An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxioMaven · org.alluxio:alluxio-parent
- CVE-2023-39661An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.PyPI · pandasai
- CVE-2023-4321Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpitPackagist · cockpit-hq/cockpit
- CVE-2023-40274An issue was discovered in zola 0.13.0 through 0.17.2.crates.io · zola
- CVE-2020-24922Cross Site Request Forgery (CSRF) vulnerability in xxl-job-admin/user/add in xuxueli xxl-job version 2.2.0, allows remote attackers to execuMaven · com.xuxueli:xxl-job
- CVE-2020-35139An issue was discovered in OFPBundleCtrlMsg in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of servicPyPI · ryu
- CVE-2020-35141An issue was discovered in OFPQueueGetConfigReply in parser.py in Faucet SDN Ryu version 4.34, allows remote attackers to cause a denial of PyPI · ryu
- CVE-2021-27524Cross Site Scripting (XSS) vulnerability in margox braft-editor version 2.3.8, allows remote attackers to execute arbitrary code via the embnpm · braft-editor
- CVE-2021-29057An issue was discovered in StaticPool in SUCHMOKUO node-worker-threads-pool version 1.4.3, allows attackers to cause a denial of service.npm · node-worker-threads-pool
- CVE-2023-35838The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that usesPyPI · wireguard
- CVE-2023-38758Cross Site Scripting vulnerability in wger Project wger Workout Manager v.2.2.0a3 allows a remote attacker to gain privileges via the licensPyPI · wger
- CVE-2023-38759Cross Site Request Forgery (CSRF) vulnerability in wger Project wger Workout Manager 2.2.0a3 allows a remote attacker to gain privileges viaPyPI · wger
- CVE-2023-29689PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw.Packagist · pyrocms/pyrocms
- CVE-2023-26139Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() funcnpm · underscore-keypath
- CVE-2023-37754PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.Maven · tech.powerjob:powerjob-common
- CVE-2023-39013Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.initMaven · no.priv.garshol.duke:duke
- CVE-2023-39015webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloaMaven · us.codecraft:webmagic-core
- CVE-2023-39021wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.SetMaven · com.wix:wix-embedded-mysql
- CVE-2023-39022oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateMaven · opensymphony:oscore
- CVE-2023-39156A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created BaMaven · org.jenkins-ci.plugins:bazaar
- CVE-2023-39155Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe Maven · org.jenkins-ci.plugins:chef-identity
- CVE-2023-37692An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.Packagist · october/october
- CVE-2023-3637Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)PyPI · neutron
- CVE-2023-37903Sandbox Escape in vm2npm · vm2
- CVE-2023-3815y_project RuoYi File Upload uploadFilesPath cross site scriptingMaven · com.ruoyi:ruoyi
- CVE-2023-37602An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary Maven · org.opencms:opencms-core
- CVE-2023-26512Apache EventMesh RabbitMQ-Connector plugin allows RCE through deserialization of untrusted dataMaven · org.apache.eventmesh:eventmesh-connector-rabbitmq
- CVE-2023-37785A cross-site scripting (XSS) vulnerability in ImpressCMS v1.4.5 and before allows attackers to execute arbitrary web scripts or HTML via a cPackagist · impresscms/impresscms
- CVE-2023-37965A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an Maven · org.jenkins-ci.plugins:elasticbox