Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-48460An issue in Eugeny Tabby 1.0.213 allows a remote attacker to obtain sensitive information via the server and sends the SSH username and passnpm · tabby-ssh · fixed in 1.0.214
- CVE-2024-36751An issue in parse-uri v1.0.9 allows attackers to cause a Regular expression Denial of Service (ReDoS) via a crafted URL.npm · parse-uri, parseuri
- CVE-2025-23061Mongoose before 8.9.5 can improperly use a nested $where filter with a populate() match, leading to search injection.npm · mongoose · fixed in 8.9.5, 7.8.4, 6.13.6
- CVE-2024-56332Next.js Vulnerable to Denial of Service (DoS) with Server Actionsnpm · next · fixed in 13.5.8, 14.2.21, 15.1.2
- CVE-2025-21610Trix allows Cross-site Scripting via `javascript:` url in a linknpm · trix · fixed in 2.1.12
- CVE-2024-56198path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerabilitynpm · path-sanitizer · fixed in 3.1.0
- CVE-2024-56734Better Auth has an Open Redirect Vulnerability in Verify Email Endpointnpm · better-auth · fixed in 1.1.6
- CVE-2024-56510Marp Core allows XSS by improper neutralization of HTML sanitizationnpm · @marp-team/marp-core · fixed in 3.9.1, 4.0.1
- CVE-2024-56334Command injection vulnerability in getWindowsIEEE8021x (SSID) function in systeminformationnpm · systeminformation · fixed in 5.23.7
- CVE-2024-56331Local File Inclusion (LFI) via Improper URL Handling in uptime-kuma's `Real-Browser` monitornpm · uptime-kuma · fixed in 1.23.16, 2.0.0-beta.1
- CVE-2024-56159Server source code is exposed to the public if sourcemaps are enablednpm · astro · fixed in 5.0.8, 4.16.18
- CVE-2024-56140Bypass of CSRF Middleware in Astronpm · astro · fixed in 4.16.17
- CVE-2024-21548Versions of the package bun after 0.0.12 and before 1.1.30 are vulnerable to Prototype Pollution due to improper input sanitization.npm · bun · fixed in 1.1.30
- CVE-2024-51479Authorization bypass in Next.jsnpm · next · fixed in 14.2.15
- CVE-2024-53866pnpm vulnerable to no-script global cache poisoning via overrides / `ignore-scripts` evasionnpm · pnpm · fixed in 9.15.0
- CVE-2024-54152Angular Expressions - Remote Code Execution when using localsnpm · angular-expressions · fixed in 1.4.3
- CVE-2024-55500Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the exnpm · whistle
- CVE-2024-54151Directus allows unauthenticated access to WebSocket events and operationsnpm · @directus/api, directus · fixed in 23.2.0, 11.3.0
- CVE-2024-53847Trix vulnerable to Cross-site Scripting on copy & pastenpm · trix · fixed in 2.1.9, 1.3.3
- CVE-2024-53441An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack.npm · cookie-encrypter
- CVE-2024-55565nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.npm · nanoid · fixed in 5.0.9, 3.3.8
- CVE-2024-52798path-to-regexp Unpatched `path-to-regexp` ReDoS in 0.1.xnpm · path-to-regexp · fixed in 0.1.12
- CVE-2024-54128Directus has an HTML Injection in Commentnpm · @directus/app, directus · fixed in 13.3.1, 10.13.4, 11.2.2
- CVE-2024-54134@solana/web3.js modified package published to npm, containing malware that exfiltrates private key materialnpm · @solana/web3.js · fixed in 1.95.8
- CVE-2024-51210Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all contnpm · firepad
- CVE-2024-53900Mongoose before 8.8.3 can improperly use $where in match, leading to search injection.npm · mongoose · fixed in 8.8.3, 7.8.3, 6.13.5 and more
- CVE-2024-53983Server-side request forgery in Backstage Scaffolder pluginnpm · @backstage/plugin-scaffolder-node · fixed in 0.4.12, 0.5.1, 0.6.1
- CVE-2024-52810Prototype Pollution in @intlify/shared >=9.7.0 <= 10.0.4npm · @intlify/shared, @intlify/vue-i18n-core +2 · fixed in 9.14.2, 10.0.5
- CVE-2024-52809Cross-site Scripting vulnerability with prototype pollution in vue-i18nnpm · @intlify/core, @intlify/core-base +3 · fixed in 9.14.2, 10.0.5
- CVE-2024-32965ssrf vulnerability in lobe-chatnpm · @lobehub/chat · fixed in 1.19.13