Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-45596Directus's session is cached for OpenID and OAuth2 if `redirect` is not usednpm · @directus/api, directus · fixed in 21.0.1, 22.2.0, 10.13.3 and more
- CVE-2024-45590body-parser vulnerable to denial of service when url encoding is enablednpm · body-parser · fixed in 1.20.3
- CVE-2024-43800serve-static affected by template injection that can lead to XSSnpm · serve-static · fixed in 1.16.0, 2.1.0
- CVE-2024-43799send vulnerable to template injection that can lead to XSSnpm · send · fixed in 0.19.0
- CVE-2024-43796express vulnerable to XSS via response.redirect()npm · express · fixed in 4.20.0, 5.0.0
- CVE-2024-21528All versions of the package node-gettext are vulnerable to Prototype Pollution via the addTranslations() function in gettext.js due to impronpm · node-gettext
- CVE-2024-45296path-to-regexp outputs backtracking regular expressionsnpm · path-to-regexp · fixed in 1.9.0, 0.1.10, 8.0.0 and more
- CVE-2024-8373AngularJS improper sanitization in '<source>' elementnpm · angular
- CVE-2024-8372AngularJS improper sanitization in 'srcset' attributenpm · angular
- CVE-2024-45391Tina search token leak via lock file in TinaCMSnpm · @tinacms/cli · fixed in 1.6.2
- CVE-2024-45390@blakeembrey/template vulnerable to code injection when attacker controls template inputnpm · @blakeembrey/template · fixed in 1.2.0
- CVE-2024-45389Pagefind DOM clobbering could escalate to Cross-site Scripting (XSS)npm · @pagefind/default-ui, @pagefind/modular-ui +1 · fixed in 1.1.1
- CVE-2024-42471Arbitrary File Write via artifact extraction in actions/artifactnpm · @actions/artifact · fixed in 2.1.2
- CVE-2020-36830nescalante urlregex Backtracking index.js redosnpm · urlregex · fixed in 0.5.1
- CVE-2024-45047Potential mXSS vulnerability due to improper HTML escaping in sveltenpm · svelte · fixed in 4.2.19
- CVE-2024-45037AWS CDK RestApi not generating authorizationScope correctly in resultant CFN templatenpm · aws-cdk · fixed in 2.148.1
- CVE-2024-43414Apollo Query Planner and Apollo Gateway may infinitely loop on sufficiently complex queriesnpm · @apollo/gateway, @apollo/query-planner · fixed in 2.8.5
- CVE-2024-43788DOM Clobbering Gadget found in Webpack's AutoPublicPathRuntimeModule that leads to Cross-site Scripting (XSS)npm · webpack · fixed in 5.94.0
- CVE-2024-8181Flowise Authentication Bypassnpm · flowise
- CVE-2024-8182Flowise Denial of Servicenpm · flowise
- CVE-2024-43787Hono CSRF middleware can be bypassed using crafted Content-Type headernpm · hono · fixed in 4.5.8
- CVE-2024-43411CKEditor4 has a low risk cross-site scripting (XSS) vulnerability from domain takeovernpm · ckeditor4 · fixed in 4.25.0
- CVE-2024-43407Code Snippet GeSHi plugin has reflected cross-site scripting (XSS) vulnerabilitynpm · ckeditor4 · fixed in 4.25.0
- CVE-2024-40453squirrellyjs squirrelly v9.0.0 and fixed in v.9.0.1 was discovered to contain a code injection vulnerability via the component options.varNanpm · squirrelly · fixed in 9.1.0
- CVE-2024-43409Ghost's improper authentication allows access to member information and actionsnpm · @tryghost/portal, ghost · fixed in 2.39.0, 5.89.5
- CVE-2024-42369A room with itself as a its predecessor will freeze matrix-js-sdknpm · matrix-js-sdk · fixed in 34.3.1
- CVE-2024-43370gettext.js vulnerable to cross-site scripting (XSS)npm · gettext.js · fixed in 2.0.3
- CVE-2024-43373webcrack has an Arbitrary File Write Vulnerability on Windows when Parsing and Saving a Malicious Bundlenpm · webcrack · fixed in 2.14.1
- CVE-2024-6534Directus 10.13.0 - Insecure object reference via PATH presetsnpm · directus · fixed in 10.13.2
- CVE-2024-6533Directus 10.13.0 - DOM-Based cross-site scripting (XSS) via layout_optionsnpm · directus · fixed in 11.3.3