Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-43368Trix has a Cross-Site Scripting (XSS) vulnerability on copy & pastenpm · trix · fixed in 2.1.4
- CVE-2024-38989izatop bunt v0.29.19 was discovered to contain a prototype pollution via the component /esm/qs.js.npm · @bunt/app · fixed in 0.29.26
- CVE-2024-39338axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative URLs.npm · axios · fixed in 1.7.4
- CVE-2024-41677Cross-site Scripting (XSS) vulnerability due to improper HTML escaping in qwiknpm · @builder.io/qwik · fixed in 1.7.3
- CVE-2024-42347URL preview setting for a room is controllable by the homeserver in matrix-react-sdknpm · matrix-react-sdk · fixed in 3.105.1
- CVE-2024-42352Server-Side Request Forgery (SSRF) in nuxt-iconnpm · @nuxt/icon · fixed in 1.4.5
- CVE-2024-34344Remote code execution via the browser when running the test locally in nuxtnpm · nuxt · fixed in 3.12.4
- CVE-2024-34343Cross-site Scripting (XSS) in navigateTo if used after SSR in nuxtnpm · nuxt · fixed in 3.12.4
- CVE-2024-23657Path Traversal: '../filedir' in Nuxt Devtoolsnpm · @nuxt/devtools · fixed in 1.3.9
- CVE-2024-39713A Server-Side Request Forgery (SSRF) affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1.npm · rocket.chat · fixed in 6.10.1
- CVE-2024-42459In the Elliptic package 6.5.6 for Node.js, EDDSA signature malleability occurs because there is a missing signature length check, and thus znpm · elliptic · fixed in 6.5.7
- CVE-2024-42460In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because there is a missing check for whether the leading bit npm · elliptic · fixed in 6.5.7
- CVE-2024-42461In the Elliptic package 6.5.6 for Node.js, ECDSA signature malleability occurs because BER-encoded signatures are allowed.npm · elliptic · fixed in 6.5.7
- CVE-2024-41962Bostr Improper Authorizationnpm · bostr · fixed in 3.0.10
- CVE-2024-41945The fuels-ts typescript SDK has no awareness of to-be-spent transactionsnpm · @fuel-ts/account · fixed in 0.93.0
- CVE-2024-38986Prototype Pollution in 75lb deep-merge 1.1.1 allows attackers to execute arbitrary code or cause a Denial of Service (DoS) and cause other inpm · @75lb/deep-merge · fixed in 1.1.2
- CVE-2024-41818ReDOS at currency parsing fast-xml-parsernpm · fast-xml-parser · fixed in 4.4.1
- CVE-2024-6783Vue client-side XSS via prototype pollutionnpm · vue-template-compiler
- CVE-2024-41655TF2 Item Format Regular Expression Denial of Service vulnerabilitynpm · tf2-item-format · fixed in 5.9.14
- CVE-2024-6833Zowe CLI Auto-Init Leaks Credentials Locallynpm · @zowe/cli · fixed in 7.23.5
- CVE-2024-39919Capture screenshot of localhost web services (unauthenticated pages) in @jmondi/url-to-pngnpm · @jmondi/url-to-png · fixed in 2.1.2
- CVE-2024-39918Path Traveral in @jmondi/url-to-pngnpm · @jmondi/url-to-png · fixed in 2.1.2
- CVE-2024-40631Cross-site Scripting (XSS) in media embed element when using custom URL parsers in plate medianpm · @udecode/plate-media · fixed in 36.0.10
- CVE-2024-6485XSS in Bootstrap button componentnpm · bootstrap
- CVE-2024-39693Next.js Denial of Service (DoS) conditionnpm · next · fixed in 13.5.0
- CVE-2024-21521All versions of the package @discordjs/opus are vulnerable to Denial of Service (DoS) due to providing an input object with a property toStrnpm · @discordjs/opus
- CVE-2024-21524All versions of the package node-stringbuilder are vulnerable to Out-of-bounds Read due to incorrect memory length calculation, by calling Tnpm · node-stringbuilder
- CVE-2024-21526All versions of the package speaker are vulnerable to Denial of Service (DoS) when providing unexpected input types to the channels propertynpm · speaker
- CVE-2024-21522All versions of the package audify are vulnerable to Improper Validation of Array Index when frameSize is provided to the new OpusDecoder().npm · audify
- CVE-2024-21525All versions of the package node-twain are vulnerable to Improper Check or Handling of Exceptional Conditions due to the length of the sourcnpm · node-twain