Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-48963The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted PHP project.npm · snyk-php-plugin · fixed in 1.10.0
- CVE-2024-48964The package Snyk CLI before 1.1294.0 is vulnerable to Code Injection when scanning an untrusted Gradle project.npm · snyk-gradle-plugin · fixed in 4.5.0
- CVE-2024-47819Umbraco CMS vulnerable to stored Cross-site Scripting in the "dictionary name" on Dictionary sectionnpm · @umbraco-cms/backoffice · fixed in 14.3.1
- CVE-2024-48930secp256k1-node vulnerable to private key extraction over ECDHnpm · secp256k1 · fixed in 5.0.1, 4.0.4, 3.8.1
- CVE-2024-21536Versions of the package http-proxy-middleware before 2.0.7, from 3.0.0 and before 3.0.3 are vulnerable to Denial of Service (DoS) due to an npm · http-proxy-middleware · fixed in 2.0.7, 3.0.3
- CVE-2024-48914Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategynpm · @vendure/asset-server-plugin · fixed in 2.3.3, 3.0.5
- CVE-2024-48913Hono vulnerable to bypass of CSRF Middleware by a request without Content-Type header.npm · hono · fixed in 4.6.5
- CVE-2024-47824Malicious homeservers can steal message keys when the matrix-react-sdk user invites another user to a roomnpm · matrix-react-sdk · fixed in 3.102.0
- CVE-2024-9506Regular Expression Denial of Service (ReDoS)npm · vue · fixed in 3.0.0-alpha.0
- CVE-2024-47080matrix-js-sdk keys sent via `sendSharedHistoryKeys` vulnerable to interception by malicious homeservernpm · matrix-js-sdk · fixed in 34.8.0
- CVE-2024-21535Versions of the package markdown-to-jsx before 7.4.0 are vulnerable to Cross-site Scripting (XSS) via the src property due to improper inputnpm · markdown-to-jsx · fixed in 7.4.0
- CVE-2024-48948The Elliptic package 6.5.7 for Node.js, in its for ECDSA implementation, does not correctly verify valid signatures if the hash contains at npm · elliptic · fixed in 6.6.0
- CVE-2024-47885astro's client-side router has DOM Clobbering Gadget that leads to XSSnpm · astro · fixed in 4.16.1
- CVE-2024-47831Next.js image optimization has Denial of Service conditionnpm · next · fixed in 14.2.7
- CVE-2024-47875DOMPurify nesting-based mXSSnpm · dompurify · fixed in 2.5.0, 3.1.3
- CVE-2024-21534All versions of the package jsonpath-plus are vulnerable to Remote Code Execution (RCE) due to improper input sanitization.npm · jsonpath-plus · fixed in 10.2.0
- CVE-2024-42640angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php.npm · angular-base64-upload · fixed in 0.1.21
- CVE-2024-48949The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) ||npm · elliptic · fixed in 6.5.6
- CVE-2024-47822Directus inserts access token from query string into logsnpm · @directus/api · fixed in 21.0.0
- CVE-2024-21533All versions of the package ggit are vulnerable to Arbitrary Argument Injection via the clone() API, which allows specifying the remote URL npm · ggit
- CVE-2024-21532All versions of the package ggit are vulnerable to Command Injection via the fetchTags(branch) API, which allows user input to specify the bnpm · ggit
- CVE-2024-45277Prototype Pollution vulnerability in SAP HANA Clientnpm · @sap/hana-client · fixed in 2.21.31
- CVE-2024-47818Logged-in users with any role can delete arbitrary files in @saltcorn/servernpm · @saltcorn/server · fixed in 1.0.0-beta.16
- CVE-2024-47764cookie accepts cookie name, path, and domain with out of bounds charactersnpm · cookie · fixed in 0.7.0
- CVE-2024-47183Parse Server's custom object ID allows to acquire role privilegesnpm · parse-server · fixed in 6.5.9, 7.3.0
- CVE-2024-9266Open Redirectnpm · express · fixed in 4.0.0-rc1
- CVE-2024-47762Unexpected visibility of environment variable configurations in @backstage/plugin-app-backendnpm · @backstage/plugin-app-backend · fixed in 0.3.75
- CVE-2024-47529OpenC3 COSMOS uses clear text storage of password/token (`GHSL-2024-129`)npm · @openc3/tool-common · fixed in 5.19.0
- CVE-2024-43795OpenC3 COSMOS vulnerable to cross-site scripting in Login functionality (`GHSL-2024-128`)npm · @openc3/tool-common · fixed in 5.19.0
- CVE-2024-9440Slim Select 2.0 createOption "text" XSSnpm · slim-select · fixed in 2.9.2