Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-21523All versions of the package images are vulnerable to Denial of Service (DoS) due to providing unexpected input types to several different funpm · images
- CVE-2024-39698Code Signing Bypass on Windows in electron-updater < 6.3.0-alpha.6npm · electron-updater · fixed in 6.3.0-alpha.6
- CVE-2024-38372Undici vulnerable to data leak when using response.arrayBuffer()npm · undici · fixed in 6.19.2
- CVE-2024-39896Directus allows SSO User Enumerationnpm · directus · fixed in 10.13.0
- CVE-2024-39895Directus GraphQL Field Duplication Denial of Service (DoS)npm · @directus/env · fixed in 1.1.6
- CVE-2024-39701Directus Incorrectly handles _in` filternpm · directus · fixed in 10.6.0
- CVE-2024-39699Directus has a Blind SSRF On File Importnpm · @directus/api · fixed in 17.1.0
- CVE-2024-39691Malicious Matrix homeserver can leak truncated message content of messages it shouldn't have access tonpm · matrix-appservice-irc · fixed in 2.0.1
- CVE-2024-39687Fedify vulnerable to allowing access to internal network resourcesnpm · @fedify/fedify · fixed in 0.9.2, 0.10.2, 0.11.2
- CVE-2024-39943rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if npm · hfs · fixed in 0.52.10
- CVE-2024-39309ZDI-CAN-23894: Parse Server literalizeRegexPart SQL Injection Authentication Bypass Vulnerabilitynpm · parse-server · fixed in 6.5.7, 7.1.0
- CVE-2024-37146GHSL-2023-248: Flowise xss in /api/v1/credentials/idnpm · flowise
- CVE-2024-37145GHSL-2023-247: Flowise xss in /api/v1/chatflows-streaming/idnpm · flowise
- CVE-2024-36423GHSL-2023-246: Flowise xss in /api/v1/public-chatflows/idnpm · flowise
- CVE-2024-36422GHSL-2023-245: Flowise xss in api/v1/chatflows/idnpm · flowise
- CVE-2024-36421GHSL-2023-234: Flowise Cors Misconfiguration in packages/server/src/index.tsnpm · flowise
- CVE-2024-36420GHSL-2023-232: Flowise Path Injection at /api/v1/openai-assistants-filenpm · flowise
- CVE-2024-6376ejson shell parser in MongoDB Compass maybe bypassednpm · @mongodb-js/connection-form · fixed in 1.20.1
- CVE-2024-38987aofl cli-lib v3.14.0 was discovered to contain a prototype pollution via the component defaultsDeep.npm · @aofl/cli-lib
- CVE-2024-38991akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto.npm · @akbr/patch-into
- CVE-2024-38992airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView.npm · @airvertco/frappejs
- CVE-2024-38994amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend.npm · @amoy/common
- CVE-2024-38996ag-grid-community v31.3.2 and ag-grid-enterprise v31.3.2 were discovered to contain a prototype pollution via the _.mergeDeep function.npm · ag-grid-community, ag-grid-enterprise · fixed in 31.3.4
- CVE-2024-38997adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults.npm · @adolph_dudu/ratio-swiper
- CVE-2024-38999jrburke requirejs v2.3.6 was discovered to contain a prototype pollution via the function s.contexts._.configure.npm · requirejs · fixed in 2.3.7
- CVE-2024-39001ag-grid-enterprise v31.3.2 was discovered to contain a prototype pollution via the component _ModuleSupport.jsonApply.npm · @ag-grid-enterprise/charts, ag-grid-community +1 · fixed in 32.0.1, 31.3.4
- CVE-2024-39008robinweser fast-loops v1.1.3 was discovered to contain a prototype pollution via the function objectMergeDeep.npm · fast-loops · fixed in 1.1.4
- CVE-2024-39018harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query".npm · @cat5th/key-serializer
- CVE-2024-38527Cross-site Scripting in ZenUMLnpm · @zenuml/core · fixed in 3.23.25
- CVE-2024-38375@fastly/js-compute use-after-free in some host call implementationsnpm · @fastly/js-compute · fixed in 3.16.0