Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-49798Duplicated execution of subcalls in OpenZeppelin Contractsnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.9.5
- CVE-2023-26158All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute npm · mockjs
- CVE-2023-46493Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via npm · @evershop/evershop · fixed in 1.0.0-rc.8
- CVE-2023-46494Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information vianpm · @evershop/evershop · fixed in 1.0.0-rc.5
- CVE-2023-46495Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information vianpm · @evershop/evershop · fixed in 1.0.0-rc.8
- CVE-2023-46496Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via npm · @evershop/evershop · fixed in 1.0.0-rc.8
- CVE-2023-46497Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via npm · @evershop/evershop · fixed in 1.0.0-rc.8
- CVE-2023-46498An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code vinpm · @evershop/evershop · fixed in 1.0.0-rc.8
- CVE-2023-46499Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information vianpm · @evershop/evershop · fixed in 1.0.0-rc.5
- CVE-2023-47440Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal.npm · gladys
- CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alnpm · pubnub · fixed in 7.4.0
- CVE-2023-49293Cross-site Scripting in `server.transformIndexHtml` via URL payload in vitenpm · vite · fixed in 4.4.12, 4.5.1, 5.0.5
- CVE-2023-6460Information leak in nodejs-firestorenpm · @google-cloud/firestore · fixed in 6.1.0
- CVE-2023-49276Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kumanpm · uptime-kuma · fixed in 1.23.7
- CVE-2023-44402ASAR Integrity bypass via filetype confusion in electronnpm · electron · fixed in 22.3.24, 24.8.3, 25.8.1 and more
- CVE-2023-6293Prototype Pollution in robinbuschmann/sequelize-typescriptnpm · sequelize-typescript · fixed in 2.1.6
- CVE-2023-48711Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browsernpm · google-translate-api-browser · fixed in 4.1.0
- CVE-2023-49210The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and anpm · openssl
- CVE-2023-48309next-auth vulnerable to possible user mocking that bypasses basic authenticationnpm · next-auth · fixed in 4.24.5
- CVE-2023-48223fast-jwt JWT Algorithm Confusionnpm · fast-jwt · fixed in 3.3.2
- CVE-2023-48218Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatablenpm · strapi-plugin-protected-populate · fixed in 1.3.4
- CVE-2023-48238JWT Algorithm Confusion in json-web-token librarynpm · json-web-token · fixed in 4.0.0
- CVE-2023-26364Denial of Service of regular expression in package @adobe/css-toolsnpm · @adobe/css-tools · fixed in 4.3.1
- CVE-2023-4771Cross-Site Scripting vulnerability in CKSource CKEditornpm · ckeditor4 · fixed in 4.24.0-lts
- CVE-2023-48219Special characters in unescaped text nodes can trigger mXSS in TinyMCEnpm · tinymce · fixed in 5.10.9, 6.7.3
- CVE-2023-46729Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpointnpm · @sentry/nextjs · fixed in 7.77.0
- CVE-2023-26156Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary snpm · chromedriver · fixed in 119.0.1
- CVE-2023-45884Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information npm · openmct · fixed in 3.1.1
- CVE-2023-45885Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new comnpm · openmct
- CVE-2023-45857An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-npm · axios · fixed in 1.6.0, 0.28.0