SQLAlchemy — CVE history (PyPI)
SQLAlchemy
3 CVEs affect the SQLAlchemy PyPI package (highest CVSS 9.8). Latest disclosed: 2019-02-20. Full CVE history sourced from NVD.
Summary
- Package
SQLAlchemy(PyPI)- Total CVEs
3- Actively exploited (CISA KEV)
- 0
- Highest CVSS
9.8- Latest disclosed
- 2019-02-20
Recent CVEs (top 3)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2019-7164 | Critical | 9.8 | — | 2019-02-20 | SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. |
CVE-2019-7548 | High | 7.8 | — | 2019-02-06 | SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. |
CVE-2012-0805 | — | — | — | 2012-06-05 | Multiple SQL injection vulnerabilities in SQLAlchemy before 0.7.0b4, as used in Keystone, allow remote attackers to execute arbitrary SQL commands via the (1) limit or (2) offset keyword to the select function, or unspecified vectors to th… |
All-time worst (top 2 by CVSS)
| CVE | Severity | CVSS | KEV | Published | Summary |
|---|---|---|---|---|---|
CVE-2019-7164 | Critical | 9.8 | — | 2019-02-20 | SQLAlchemy through 1.2.17 and 1.3.x through 1.3.0b2 allows SQL Injection via the order_by parameter. |
CVE-2019-7548 | High | 7.8 | — | 2019-02-06 | SQLAlchemy 1.2.17 has SQL Injection when the group_by parameter can be controlled. |