Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-34394libxmljs2 namespaces type confusion RCEnpm · libxmljs2
- CVE-2024-34393libxmljs2 attrs type confusion RCEnpm · libxmljs2
- CVE-2024-34392libxmljs namespaces type confusion RCEnpm · libxmljs
- CVE-2024-34391libxmljs attrs type confusion RCEnpm · libxmljs
- CVE-2024-4128CSRF in firebase-tools emulator suitenpm · firebase-tools · fixed in 13.6.0
- CVE-2024-32962XML signature verification bypass due improper verification of signature / signature spoofingnpm · xml-crypto · fixed in 6.0.0
- CVE-2024-25355s3-url-parser 1.0.3 is vulnerable to Denial of service via the regexes component.npm · s3-url-parser
- CVE-2024-31621An issue in FlowiseAI Inc Flowise v.1.6.2 and before allows a remote attacker to execute arbitrary code via a crafted script to the api/v1 cnpm · flowise · fixed in 1.8.1
- CVE-2024-33883The ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.npm · ejs · fixed in 3.1.10
- CVE-2024-33669An issue was discovered in Passbolt Browser Extension before 4.6.2.npm · passbolt-browser-extension · fixed in 4.6.2
- CVE-2024-32866Conform contains Prototype Pollution Vulnerability in `parseWith...` functionnpm · @conform-to/dom, @conform-to/yup +1 · fixed in 1.1.1, 0.9.2
- CVE-2024-32869Hono vulnerable to Restricted Directory Traversal in serveStatic with denonpm · hono · fixed in 4.2.7
- CVE-2024-21511Versions of the package mysql2 before 3.9.7 are vulnerable to Arbitrary Code Injection due to improper sanitization of the timezone parametenpm · mysql2 · fixed in 3.9.7
- CVE-2024-32652@hono/node-server contains Denial of Service risk when receiving Host header that cannot be parsednpm · @hono/node-server · fixed in 1.10.1
- CVE-2024-30564An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted npm · @andrei-tatar/nora-firebase-common · fixed in 1.12.3
- CVE-2024-32472excalidraw vulnerable to a Stored XSS in excalidraw's web embed componentnpm · @excalidraw/excalidraw · fixed in 0.16.4, 0.17.6
- CVE-2024-30253Handling untrusted input can result in a crash, leading to loss of availability / denial of servicenpm · @solana/web3.js · fixed in 1.91.3, 1.90.2, 1.89.2 and more
- CVE-2024-28056Amazon AWS Amplify CLI before 12.10.1 incorrectly configures the role trust policy of IAM roles associated with Amplify projects.npm · @aws-amplify/cli · fixed in 12.10.1
- CVE-2024-32000Truncated content of messages can be leaked from matrix-appservice-ircnpm · matrix-appservice-irc · fixed in 2.0.0
- CVE-2024-21508Versions of the package mysql2 before 3.9.4 are vulnerable to Remote Code Execution (RCE) via the readCodeFor function due to improper validnpm · mysql2 · fixed in 3.9.4
- CVE-2024-31999@fastify/secure-session: Reuse of destroyed secure session cookienpm · @fastify/secure-session · fixed in 7.3.0
- CVE-2024-31995zcap has incomplete expiration checks in capability chains.npm · @digitalbazaar/zcap · fixed in 9.0.1
- CVE-2024-21507Versions of the package mysql2 before 3.9.3 are vulnerable to Improper Input Validation through the keyFromFields function, resulting in cacnpm · mysql2 · fixed in 3.9.3
- CVE-2024-21509Versions of the package mysql2 before 3.9.4 are vulnerable to Prototype Poisoning due to insecure results object creation and improper user npm · mysql2 · fixed in 3.9.4
- CVE-2024-29504Cross Site Scripting vulnerability in Summernote v.0.8.18 and before allows a remote attacker to execute arbtirary code via a crafted payloanpm · summernote
- CVE-2024-31454PsiTransfer file integrity violation vulnerabilitynpm · psitransfer · fixed in 2.2.0
- CVE-2024-31453PsiTransfer vulnerable to violation of the integrity of file distributionnpm · psitransfer · fixed in 2.2.0
- CVE-2021-4438kyivstarteam react-native-sms-user-consent SmsUserConsentModule.kt registerReceiver improper export of android application componentsnpm · @kyivstarteam/react-native-sms-user-consent · fixed in 1.1.5
- CVE-2024-22363SheetJS Community Edition before 0.20.2 is vulnerable.to Regular Expression Denial of Service (ReDoS).npm · xlsx
- CVE-2024-27448MailDev 2 through 2.1.0 allows Remote Code Execution via a crafted Content-ID header for an e-mail attachment, leading to lib/mailserver.js npm · maildev