Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-50974In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json filenpm · appwrite-cli · fixed in 3.0.0
- CVE-2023-51701@fastify-reply-from JSON Content-Type parsing confusionnpm · @fastify/reply-from · fixed in 9.6.0
- CVE-2023-6944Rhdh: catalog-import function leaks credentials to frontendnpm · @backstage/backend-app-api · fixed in 0.5.9-next.1
- CVE-2024-21911Cross-site scripting vulnerability in TinyMCEnpm · tinymce · fixed in 5.6.0
- CVE-2024-21910Cross-site scripting vulnerability in TinyMCE pluginsnpm · tinymce · fixed in 5.10.0
- CVE-2024-21908Cross-site scripting vulnerability in TinyMCEnpm · tinymce · fixed in 5.9.0
- CVE-2023-39655A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0.npm · @perfood/couch-auth
- CVE-2023-46308In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.npm · plotly.js · fixed in 2.25.2
- CVE-2023-26159Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by tnpm · follow-redirects · fixed in 1.15.4
- CVE-2023-50550layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.npm · layui · fixed in 2.7.5
- CVE-2023-7080Arbitrary remote code execution within wrangler dev Workers sandboxnpm · wrangler · fixed in 3.19.0, 2.20.2
- CVE-2023-7079Arbitrary remote file read in Wrangler dev servernpm · wrangler · fixed in 3.19.0
- CVE-2023-7078Server-Side Request Forgery (SSRF) in Miniflarenpm · miniflare · fixed in 3.20231030.2
- CVE-2023-52079Conversion of property names to strings can trigger infinite recursionnpm · msgpackr · fixed in 1.10.1
- CVE-2023-50475An issue was discovered in bcoin-org bcoin version 2.2.0, allows remote attackers to obtain sensitive information via weak hashing algorithmnpm · bsock
- CVE-2023-50481An issue was discovered in blinksocks version 3.3.8, allows remote attackers to obtain sensitive information via weak encryption algorithms npm · blinksocks
- CVE-2023-50249Sentry's Astro SDK vulnerable to ReDoSnpm · @sentry/astro · fixed in 7.87.0
- CVE-2019-25158pedroetb tts-api app.js onSpeechDone os command injectionnpm · tts-api · fixed in 2.2.0
- CVE-2023-50728Unauthenticated Denial of Service in the octokit/webhooks librarynpm · @octokit/app, @octokit/webhooks +2 · fixed in 14.0.2, 9.26.3, 10.9.2 and more
- CVE-2023-50710Hono's named path parameters can be overridden in TrieRouternpm · hono · fixed in 3.11.7
- CVE-2023-48631Denial of Service of regular expression in package @adobe/css-toolsnpm · @adobe/css-tools · fixed in 4.3.2
- CVE-2023-50709Denial of service attack on the cube-api endpointnpm · @cubejs-backend/api-gateway · fixed in 0.34.34
- CVE-2023-47620Scrypted reflected Cross-site Scripting vulnerabilitynpm · @scrypted/server
- CVE-2023-47623Scrypted reflected Cross-site Scripting vulnerabilitynpm · @scrypted/core
- CVE-2023-49583Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)npm · @sap/xssec · fixed in 3.6.0
- CVE-2023-26920fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.npm · fast-xml-parser · fixed in 4.1.2
- CVE-2023-49803@koa/cors has overly permissive origin policynpm · @koa/cors · fixed in 5.0.0
- CVE-2023-49804Uptime Kuma Password Change Vulnerabilitynpm · uptime-kuma · fixed in 1.23.9
- CVE-2023-49799Server-Side Request Forgery in nuxt-api-partynpm · nuxt-api-party · fixed in 0.22.0
- CVE-2023-49800Denial of service by abusing `fetchOptions.retry` in nuxt-api-partynpm · nuxt-api-party · fixed in 0.22.1