Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-21490This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.npm · angular
- CVE-2024-24828Local Privilege Escalation in execuatables bundled by pkgnpm · pkg
- CVE-2023-42282The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally rnpm · ip · fixed in 2.0.1, 1.1.9
- CVE-2024-24816Cross-site scripting (XSS) vulnerability in samples with enabled the preview featurenpm · ckeditor4 · fixed in 4.24.0-lts
- CVE-2024-24815CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detectionnpm · ckeditor4 · fixed in 4.24.0-lts
- CVE-2024-24398Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarynpm · stimulsoft-dashboards-js · fixed in 2024.1.3
- CVE-2024-24396Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarnpm · stimulsoft-dashboards-js · fixed in 2024.1.2
- CVE-2024-24397Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarnpm · stimulsoft-dashboards-js · fixed in 2024.1.2
- CVE-2021-4435Yarn: untrusted search pathnpm · yarn · fixed in 1.22.13
- CVE-2024-21485Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packanpm · dash-core-components, dash-html-components · fixed in 2.13.0, 2.0.16
- CVE-2023-51838Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.npm · meshcentral
- CVE-2024-24566Lobe Chat unauthorized access to pluginsnpm · @lobehub/chat · fixed in 0.122.4
- CVE-2024-24558react-query-streamed-hydration xssnpm · @tanstack/react-query-next-experimental · fixed in 5.18.0
- CVE-2024-24556XSS in @urql/nextnpm · @urql/next · fixed in 1.1.1
- CVE-2024-23841XSS in @apollo/experimental-nextjs-app-supportnpm · @apollo/experimental-nextjs-app-support · fixed in 0.7.0
- CVE-2024-21488Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function witnpm · network · fixed in 0.7.0
- CVE-2023-51837Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.npm · meshcentral
- CVE-2023-51839DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.npm · @devicefarmer/stf
- CVE-2023-51842An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.npm · meshcentral · fixed in 1.1.17
- CVE-2024-23641Sending a GET or HEAD request with a body crashes SvelteKitnpm · @sveltejs/adapter-node, @sveltejs/kit · fixed in 2.1.2, 3.0.3, 4.0.1 and more
- CVE-2024-23340@hono/node-server can't handle "double dots" in URLnpm · @hono/node-server · fixed in 1.4.1
- CVE-2024-23339hoolock does not block Prototype pollution with object-path related utilitiesnpm · hoolock · fixed in 2.2.1
- CVE-2024-21484Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process.npm · jsrsasign · fixed in 11.0.0
- CVE-2024-23725Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js.npm · ghost · fixed in 5.76.0
- CVE-2024-23331Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystemnpm · vite · fixed in 2.9.17, 3.2.8, 4.5.2 and more
- CVE-2024-22207Default swagger-ui configuration exposes all files in the modulenpm · @fastify/swagger-ui · fixed in 2.1.0
- CVE-2023-46942Lack of authentication in NPM's package @evershop/evershop before version 1.0.0-rc.8, allows remote attackers to obtain sensitive informationpm · @evershop/evershop · fixed in 1.0.0-rc.9
- CVE-2023-46943An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8.npm · @evershop/evershop · fixed in 1.0.0-rc.9
- CVE-2024-22206@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)npm · @clerk/nextjs · fixed in 4.29.3
- CVE-2024-21668Insertion of Sensitive Information into Log File in react-native-mmkvnpm · react-native-mmkv · fixed in 2.11.0