Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-21512Versions of the package mysql2 before 3.9.8 are vulnerable to Prototype Pollution due to improper user input sanitization passed to fields anpm · mysql2 · fixed in 3.9.8
- CVE-2024-29415The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, npm · ip
- CVE-2024-36361Pug through 3.0.2 allows JavaScript code execution if an application accepts untrusted input for the name option of the compileClient, compinpm · pug, pug-code-gen · fixed in 3.0.3
- CVE-2023-1001xuliangzhan vxe-table vxe-textarea textarea.js export cross site scriptingnpm · vxe-table · fixed in 3.7.10
- CVE-2024-34448Ghost before 5.82.0 allows CSV Injection during a member CSV export.npm · @tryghost/members-csv · fixed in 5.82.0
- CVE-2024-35220@fastify/session reuses destroyed session cookienpm · @fastify/session · fixed in 10.9.0
- CVE-2024-24293A Prototype Pollution issue in MiguelCastillo @bit/loader v.10.0.3 allows an attacker to execute arbitrary code via the M function e argumennpm · @bit/loader
- CVE-2024-29651A Prototype Pollution issue in API Dev Tools json-schema-ref-parser v.11.0.0 and v.11.1.0 allows a remote attacker to execute arbitrary codenpm · @apidevtools/json-schema-ref-parser · fixed in 11.2.0
- CVE-2024-24294A Prototype Pollution issue in Blackprint @blackprint/engine v.0.9.0 allows an attacker to execute arbitrary code via the _utils.setDeepPropnpm · @blackprint/engine · fixed in 0.9.2
- CVE-2024-34273njwt up to v0.4.0 was discovered to contain a prototype pollution in the Parser.prototype.parse method.npm · njwt · fixed in 2.0.1
- CVE-2024-4367A type check was missing when handling fonts in PDF.js, which would allow arbitrary JavaScript execution in the PDF.js context.npm · pdfjs-dist · fixed in 4.2.67
- CVE-2024-34243Konga v0.14.9 is vulnerable to Cross Site Scripting (XSS) via the username parameter.npm · kongadmin
- CVE-2024-34712Oceanic allows unsanitized user input to lead to path traversal in URLsnpm · oceanic.js · fixed in 1.10.4
- CVE-2024-34709Directus Lacks Session Tokens Invalidationnpm · directus · fixed in 10.11.0
- CVE-2024-34708Directus allows redacted data extraction on the API through "alias"npm · directus · fixed in 10.11.0
- CVE-2023-49781NocoDB Vulnerable to Stored Cross-Site Scripting in Formula.vuenpm · nocodb · fixed in 0.202.9
- CVE-2023-50718NocoDB SQL Injection vulnerabilitynpm · nocodb · fixed in 0.202.10
- CVE-2023-50717NocoDB Allows Preview of File with Dangerous Contentnpm · nocodb · fixed in 0.202.10
- CVE-2024-34706@valtimo/components exposes access token to form.ionpm · @valtimo/components · fixed in 10.8.4, 11.1.6, 11.2.2
- CVE-2024-4068Memory Exhaustion in bracesnpm · braces · fixed in 3.0.3
- CVE-2024-4067Regular Expression Denial of Service in micromatchnpm · micromatch · fixed in 4.0.8
- CVE-2024-32964lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerabilitynpm · @lobehub/chat · fixed in 0.150.6
- CVE-2024-34351Next.js Server-Side Request Forgery in Server Actionsnpm · next · fixed in 14.1.1
- CVE-2024-34350Next.js Vulnerable to HTTP Request Smugglingnpm · next · fixed in 13.5.1
- CVE-2024-34345@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerabilitynpm · @cyclonedx/cyclonedx-library · fixed in 6.7.1
- CVE-2024-34347@hoppscotch/cli affected by Sandbox Escape in @hoppscotch/js-sandbox leads to RCEnpm · @hoppscotch/cli · fixed in 0.8.0
- CVE-2024-34341The Trix Editor Contains an Arbitrary Code Execution Vulnerabilitynpm · trix · fixed in 2.1.1, 1.3.2
- CVE-2024-34342react-pdf's PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFnpm · react-pdf · fixed in 7.7.3, 8.0.2
- CVE-2024-34075kurwov vulnerable to Denial of Service due to improper data sanitizationnpm · kurwov · fixed in 3.2.5
- CVE-2024-34449Vditor 3.10.3 allows XSS via an attribute of an A element.npm · vditor