Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-46998Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted npm · bootbox
- CVE-2023-39345Unauthorized Access to Private Fields in User Registration API in strapinpm · @strapi/plugin-users-permissions, @strapi/strapi · fixed in 4.13.1
- CVE-2023-45827Prototype Pollution vulnerability in @clickbar/dot-divernpm · @clickbar/dot-diver · fixed in 1.0.2
- CVE-2015-20110JHipster generator-jhipster before 2.23.0 allows a timing attack against validateToken due to a string comparison that stops at the first chnpm · generator-jhipster · fixed in 2.23.0
- CVE-2019-25155DOMPurify before 1.0.11 allows reverse tabnabbing in demos/hooks-target-blank-demo.html because links lack a 'rel="noopener noreferrer"' attnpm · dompurify · fixed in 1.0.11
- CVE-2023-46234browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attacknpm · browserify-sign · fixed in 4.2.2
- CVE-2023-46233crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardnpm · crypto-js · fixed in 4.2.0
- CVE-2023-46133crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardnpm · crypto-es · fixed in 2.1.0
- CVE-2023-46119Parse Server may crash when uploading file without extensionnpm · parse-server · fixed in 5.5.6, 6.3.1
- CVE-2023-39619ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component.npm · node-email-check
- CVE-2023-46298Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a npm · next · fixed in 13.4.20-canary.13
- CVE-2023-46115Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-clinpm · @tauri-apps/cli · fixed in 2.0.0-alpha.16, 1.5.6
- CVE-2023-45818Cross-site Scripting vulnerability in TinyMCE undo/redo, getContent API, resetContent API, and Autosave pluginnpm · tinymce · fixed in 6.7.1, 5.10.8
- CVE-2023-45819Cross-site Scripting vulnerability in TinyMCE notificationManager.open APInpm · tinymce · fixed in 6.7.1, 5.10.8
- CVE-2023-45820Directus crashes on invalid WebSocket messagenpm · directus · fixed in 10.6.2
- CVE-2023-5654The React Developer Tools extension registers a message listener with window.addEventListener('message', <listener>) in a content script thanpm · react-devtools-core · fixed in 4.28.4
- CVE-2023-45811Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscatornpm · deobfuscator · fixed in 2.4.4
- CVE-2023-43794SQL Injection in nocodbnpm · nocodb · fixed in 0.111.0
- CVE-2023-26155All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize npm · node-qpdf
- CVE-2023-5573Allocation of Resources Without Limits or Throttling in vriteio/vritenpm · @vrite/sdk · fixed in 0.3.0
- CVE-2023-5572Server-Side Request Forgery (SSRF) in vriteio/vritenpm · @vrite/sdk · fixed in 0.3.0
- CVE-2023-5571Improper Input Validation in vriteio/vritenpm · @vrite/sdk · fixed in 0.3.0
- CVE-2023-45143Undici's cookie header not cleared on cross-origin redirect in fetchnpm · undici · fixed in 5.26.2
- CVE-2023-45133Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious codenpm · @babel/traverse, babel-traverse · fixed in 7.23.2, 8.0.0-alpha.4
- CVE-2023-44400Uptime Kuma has Persistentent User Sessions npm · uptime-kuma · fixed in 1.23.3
- CVE-2023-45282In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.npm · openmct
- CVE-2023-45311fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arnpm · fsevents · fixed in 1.2.11
- CVE-2023-26152All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath npm · static-server
- CVE-2023-44270An issue was discovered in PostCSS before 8.4.31.npm · postcss · fixed in 8.4.31
- CVE-2023-4316Zod 3.22.2 - Regular expression Denial of Servicenpm · zod · fixed in 3.22.3