Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-26109All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to impropenpm · node-bluetooth-serial-port
- CVE-2023-26110All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user inputnpm · node-bluetooth
- CVE-2023-1283 Code Injection in builderio/qwiknpm · @builder.io/qwik · fixed in 0.21.0
- CVE-2023-27481Extract password hashes through export querying in directusnpm · directus · fixed in 9.16.0
- CVE-2023-27474HTML Injection in Password Reset email to custom Reset URL in directusnpm · directus · fixed in 9.23.0
- CVE-2023-26108Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe.npm · @nestjs/core · fixed in 9.0.5
- CVE-2023-26107All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrinpm · sketchsvg
- CVE-2023-26111All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to npm · @nubosoftware/node-static, node-static
- CVE-2023-26106All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.npm · dot-lens
- CVE-2021-4329json-logic-js logic.js command injectionnpm · json-logic-js · fixed in 2.0.1
- CVE-2023-26486Vega `scale` expression function cross site scriptingnpm · vega, vega-functions · fixed in 5.23.0, 5.13.1
- CVE-2023-26487Vega has cross-site scripting vulnerability in `lassoAppend` functionnpm · vega, vega-functions · fixed in 5.23.0, 5.13.1
- CVE-2023-26491RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parametersnpm · rsshub · fixed in 1.0.0-master.c910c4d
- CVE-2023-26492Directus vulnerable to Server-Side Request Forgery On File Importnpm · directus · fixed in 9.23.0
- CVE-2023-26488OpenZeppelin Contracts contains Incorrect Calculationnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.8.2
- CVE-2023-26105All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.npm · utilities
- CVE-2023-26104All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes conpm · lite-web-server
- CVE-2023-26102All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function npm · rangy
- CVE-2022-44310In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived sharnpm · ecdh · fixed in 0.2.0
- CVE-2022-48345sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.npm · @braintree/sanitize-url · fixed in 6.0.1
- CVE-2023-25813SQL Injection via replacements in sequelizenpm · sequelize · fixed in 6.19.1
- CVE-2021-4326Imperative Local Command Injection allows Activity Maskingnpm · @zowe/imperative · fixed in 5.7.1, 4.18.10
- CVE-2023-25805versionn Command Injection Vulnerabilitynpm · versionn · fixed in 1.1.0
- CVE-2016-15025generator-hottowel 404 Error _app.js cross site scriptingnpm · generator-hottowel · fixed in 0.5.0
- CVE-2021-32850jQuery MiniColors vulnerable to Cross-site Scriptingnpm · @claviska/jquery-minicolors · fixed in 2.3.6
- CVE-2021-32851jQuery MiniColors vulnerable to Cross-site Scriptingnpm · mind-elixir · fixed in 0.18.1
- CVE-2021-32853Erxes vulnerable to Cross-site Scriptingnpm · erxes
- CVE-2021-32854textAngular text editor vulnerable to Cross-site Scriptingnpm · textangular
- CVE-2021-32855vditor vulnerable to Cross-site Scriptingnpm · vditor · fixed in 3.8.7
- CVE-2021-32859Baremetrics date range picker vulnerable to Cross-site Scriptingnpm · baremetrics-calendar