Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-29529matrix-js-sdk vulnerable to invisible eavesdropping in group callsnpm · matrix-js-sdk · fixed in 24.1.0
- CVE-2023-26122All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization.npm · safe-eval
- CVE-2023-26121All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its pnpm · safe-eval
- CVE-2023-29017vm2 Sandbox Escape vulnerabilitynpm · vm2 · fixed in 3.9.15
- CVE-2023-29008SvelteKit framework has Insufficient CSRF protection for CORS requestsnpm · @sveltejs/kit · fixed in 1.15.2
- CVE-2023-0842xml2js 0.4.23 - Prototype Pollutionnpm · xml2js · fixed in 0.5.0
- CVE-2023-29003SvelteKit has Insufficient Cross-Site Request Forgery Protectionnpm · @sveltejs/kit · fixed in 1.15.1
- CVE-2020-19697Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted scriptnpm · editor.md
- CVE-2020-19698Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted scriptnpm · editor.md
- CVE-2020-19850An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.npm · directus · fixed in 2.2.1
- CVE-2023-0835markdown-pdf 11.0.0 - Local File Read via Server Side XSSnpm · markdown-pdf
- CVE-2023-26116Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility funpm · angular
- CVE-2023-26118Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> elementnpm · angular
- CVE-2023-26117Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to tnpm · angular
- CVE-2022-36060Prototype pollution in matrix-react-sdknpm · matrix-react-sdk · fixed in 3.53.0
- CVE-2023-28103Prototype pollution in matrix-react-sdknpm · matrix-react-sdk · fixed in 3.69.0
- CVE-2023-28427Prototype pollution in matrix-js-sdknpm · matrix-js-sdk · fixed in 24.0.0
- CVE-2022-36059Prototype pollution in matrix-js-sdknpm · matrix-js-sdk · fixed in 19.4.0
- CVE-2018-25083The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.npm · pullit · fixed in 1.4.0
- CVE-2022-2237A flaw was found in the Keycloak Node.js Adapter.npm · keycloak-connect · fixed in 21.0.1
- CVE-2023-28444angular-server-side-configuration information disclosure vulnerability in monorepo with node.js backendnpm · angular-server-side-configuration · fixed in 15.1.0
- CVE-2023-28443directus vulnerable to Insertion of Sensitive Information into Log Filenpm · directus · fixed in 9.23.3
- CVE-2023-26114Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.npm · code-server · fixed in 4.10.1
- CVE-2023-26113Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/npm · collection.js · fixed in 6.8.1
- CVE-2022-43441A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1.npm · sqlite3 · fixed in 5.1.5
- CVE-2023-28155The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protonpm · @cypress/request, request · fixed in 3.0.0
- CVE-2023-25345Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the includenpm · swig, swig-templates
- CVE-2023-28154Webpack 5 before 5.76.0 does not avoid cross-realm object access.npm · webpack · fixed in 5.76.0
- CVE-2021-33360An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_pronpm · @stoqey/gnuplot
- CVE-2023-27490Missing proper state, nonce and PKCE checks for OAuth authentication in next-authnpm · next-auth · fixed in 4.20.1