Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-21531All versions of the package git-shallow-clone are vulnerable to Command injection due to missing sanitization or mitigation flags in the pronpm · git-shallow-clone
- CVE-2024-21489Versions of the package uplot before 1.6.31 are vulnerable to Prototype Pollution via the uplot.assign function due to missing check if the npm · uplot · fixed in 1.6.31
- CVE-2024-47178basic-auth-connect's callback uses time unsafe string comparisonnpm · basic-auth-connect · fixed in 1.1.0
- CVE-2024-9283RelaxedJS ReLaXed Pug to PDF Converter cross site scriptingnpm · relaxedjs
- CVE-2024-47171Agnai vulnerable to Relative Path Traversal in Image Uploadnpm · agnai · fixed in 1.0.330
- CVE-2024-47170Agnai File Disclosure Vulnerability: JSON via Path Traversalnpm · agnai · fixed in 1.0.330
- CVE-2024-47169Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversalnpm · agnai · fixed in 1.0.330
- CVE-2024-47075DOM Clobbering gadgets found in layui that lead to Cross-site Scriptingnpm · layui · fixed in 2.9.17
- CVE-2024-45613CKEditor 5 has Cross-site Scripting vulnerability in the clipboard packagenpm · @ckeditor/ckeditor5-clipboard, ckeditor5 · fixed in 43.1.1
- CVE-2024-46488sqlite-vec v0.1.1 was discovered to contain a heap buffer overflow via the npy_token_next function.npm · sqlite-vec · fixed in 0.1.3
- CVE-2024-46489A remote command execution (RCE) vulnerability in promptr v6.0.7 allows attackers to execute arbitrary commands via a crafted URL.npm · @ifnotnowwhen/promptr
- CVE-2024-9148Flowise Stored Cross-Site Scriptingnpm · flowise, flowise-embed · fixed in 2.1.1, 2.0.0
- CVE-2024-46935Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and earlier is vulnerable to denial of service (DoS).npm · @rocket.chat/message-parser · fixed in 0.31.30
- CVE-2024-47068DOM Clobbering Gadget found in rollup bundled scripts that leads to XSSnpm · rollup · fixed in 3.29.5, 4.22.4, 2.79.2
- CVE-2024-47066Lobe Chat has insufficient fix for GHSA-mxhq-xw3g-rphc (CVE-2024-32964)npm · @lobehub/chat · fixed in 1.19.13
- CVE-2024-47061Arbitrary DOM attributes in element.attributes and leaf.attributes in Platejsnpm · @udecode/plate-core · fixed in 38.0.6, 36.5.9, 21.5.1
- CVE-2024-46990SSRF Loopback IP filter bypass in directusnpm · @directus/api, directus · fixed in 21.0.0, 22.1.1, 10.13.3 and more
- CVE-2024-45813ReDoS vulnerability in multiparametric routes in find-my-waynpm · find-my-way · fixed in 8.2.2, 9.0.1
- CVE-2024-46982Cache Poisoning in next.jsnpm · next · fixed in 13.5.7, 14.2.10
- CVE-2024-45815Prototype pollution in @backstage/plugin-catalog-backendnpm · @backstage/plugin-catalog-backend · fixed in 1.26.0
- CVE-2024-45816Storage bucket Directory Traversal in @backstage/plugin-techdocs-backendnpm · @backstage/plugin-techdocs-backend · fixed in 1.10.13
- CVE-2024-46976Circumvention of cross site scripting Protection in @backstage/plugin-techdocs-backendnpm · @backstage/plugin-techdocs-backend · fixed in 1.10.13
- CVE-2024-45812DOM Clobbering gadget found in vite bundled scripts that leads to XSS in Vitenpm · vite · fixed in 5.4.6, 5.3.6, 5.2.14 and more
- CVE-2024-45811server.fs.deny bypassed when using ?import&raw in vitenpm · vite · fixed in 5.4.6, 5.3.6, 5.2.14 and more
- CVE-2024-45801Tampering by prototype polution in DOMPurifynpm · dompurify · fixed in 2.5.4, 3.1.3
- CVE-2024-45835Insufficient Electron Fuses Configurationnpm · mattermost-desktop · fixed in 5.9.0
- CVE-2024-39772Silent Desktop Screenshot Capturenpm · mattermost-desktop · fixed in 5.9.0
- CVE-2024-39613RCE in desktop app in Windows by local attackernpm · mattermost-desktop · fixed in 5.9.0
- CVE-2024-45607whatsapp-api-js fails to validate message's signaturenpm · whatsapp-api-js · fixed in 4.0.3
- CVE-2024-21529Versions of the package dset before 3.1.4 are vulnerable to Prototype Pollution via the dset function due improper user input sanitization.npm · dset · fixed in 3.1.4