Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-37818Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.npm · @strapi/strapi
- CVE-2024-38357TinyMCE Cross-Site Scripting (XSS) vulnerability using noscript elementsnpm · tinymce · fixed in 5.11.0, 6.8.4, 7.2.0
- CVE-2024-38356TinyMCE Cross-Site Scripting (XSS) vulnerability using noneditable_regexp optionnpm · tinymce · fixed in 5.11.0, 6.8.4, 7.2.0
- CVE-2024-38355Unhandled 'error' event in socket.ionpm · socket.io · fixed in 2.5.1, 4.6.2
- CVE-2024-37895API Key Leak in lobe-chatnpm · @lobehub/chat · fixed in 0.162.25
- CVE-2024-37890Denial of service when handling a request with many HTTP headers in wsnpm · ws · fixed in 5.2.4, 6.2.3, 7.5.10 and more
- CVE-2024-36573almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@alnpm · @almela/obx · fixed in 0.0.4
- CVE-2024-36574A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-jsonpm · @allanlancioni/flatten-json
- CVE-2024-36577apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.npm · @apphp/object-resolver · fixed in 3.1.1
- CVE-2024-36578akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.npm · @akbr/update
- CVE-2024-36580A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.npm · @cdr0/sg
- CVE-2024-36581A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.npm · @abw/badger-database
- CVE-2024-36582alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)npm · @alexbinary/object-deep-assign
- CVE-2024-37182Lack of permissions prompting when opening external URLsnpm · mattermost-desktop · fixed in 5.8.0
- CVE-2024-36287Bypass of TCC restrictions on macOSnpm · mattermost-desktop · fixed in 5.8.0
- CVE-2024-34065@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypassnpm · @strapi/plugin-users-permissions · fixed in 4.24.2
- CVE-2024-31217@strapi/plugin-upload has a Denial-of-Service via Improper Exception Handlingnpm · @strapi/plugin-upload · fixed in 4.22.0
- CVE-2024-29181@strapi/plugin-content-manager leaks data via relations via the Admin Panelnpm · @strapi/plugin-content-manager · fixed in 4.19.1
- CVE-2024-37629SummerNote v0.9.1 is vulnerable to Cross Site Scripting (XSS) via the Code View Function.npm · summernote
- CVE-2024-35255Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerabilitynpm · @azure/identity, @azure/msal-node · fixed in 4.2.1, 2.9.2
- CVE-2024-37169@jmondi/url-to-png arbitrary file read via Playwright's screenshot feature exploiting file wrappernpm · @jmondi/url-to-png · fixed in 2.0.3
- CVE-2024-37168@grpc/grpc-js can allocate memory for incoming messages well above configured limitsnpm · @grpc/grpc-js · fixed in 1.10.9, 1.9.15, 1.8.22
- CVE-2024-37166ghtml Cross-Site Scripting (XSS) vulnerabilitynpm · ghtml · fixed in 2.0.0
- CVE-2024-37162zsa Generates Error Messages Containing Sensitive Informationnpm · zsa · fixed in 0.3.3
- CVE-2024-37273An arbitrary file upload vulnerability in the /v1/app/appendFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code vianpm · @janhq/core
- CVE-2024-36858An arbitrary file upload vulnerability in the /v1/app/writeFileSync interface of Jan v0.4.12 allows attackers to execute arbitrary code via npm · @janhq/core
- CVE-2024-36857Jan v0.4.12 was discovered to contain an arbitrary file read vulnerability via the /v1/app/readFileSync interface.npm · @janhq/core
- CVE-2024-36128Directus is soft-locked by providing a string value to random string utilnpm · directus · fixed in 10.11.2
- CVE-2024-36120javascript-deobfuscator crafted payload can lead to code executionnpm · js-deobfuscator · fixed in 1.1.0
- CVE-2022-25037An issue in wanEditor v4.7.11 and fixed in v.4.7.12 and v.5 was discovered to contain a cross-site scripting (XSS) vulnerability via the imanpm · @wangeditor/editor · fixed in 4.7.12