Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-32860iziModal vulnerable to Cross-site Scriptingnpm · izimodal · fixed in 1.6.1
- CVE-2022-48115The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting (XSS).npm · jspreadsheet-ce · fixed in 4.6.0
- CVE-2023-25653Improper calculations in ECC implementation can trigger a Denial-of-Service (DoS)npm · node-jose · fixed in 2.2.0
- CVE-2023-23936CRLF Injection in Nodejs ‘undici’ via hostnpm · undici · fixed in 5.19.1
- CVE-2023-24807Undici vulnerable to Regular Expression Denial of Service in Headersnpm · undici · fixed in 5.19.1
- CVE-2023-22579Sequalize - Unsafe fall-through in getWhereConditionsnpm · @sequelize/core, sequelize · fixed in 7.0.0-alpha.20, 6.28.1
- CVE-2023-22578Sequalize - Default support for “raw attributes” when using parenthesesnpm · @sequelize/core, sequelize · fixed in 7.0.0-alpha.20, 6.29.0
- CVE-2023-22580Sequalize - Bad query filtering leading to SQL errorsnpm · @sequelize/core, sequelize · fixed in 7.0.0-alpha.20, 6.28.1
- CVE-2023-25571Backstage has XSS Vulnerability in Software Catalognpm · @backstage/catalog-model, @backstage/core-components +1 · fixed in 1.2.0, 0.12.4, 1.7.2
- CVE-2023-25576@fastify/multipart vulnerable to DoS due to unlimited number of partsnpm · @fastify/multipart · fixed in 6.0.1, 7.4.1
- CVE-2023-25572React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`npm · ra-ui-materialui, react-admin · fixed in 4.7.6, 3.19.12
- CVE-2022-25937Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root dinpm · glance · fixed in 3.0.9
- CVE-2019-25103simple-markdown simple-markdown.js redosnpm · simple-markdown · fixed in 0.5.2
- CVE-2019-25102simple-markdown simple-markdown.js redosnpm · simple-markdown · fixed in 0.6.1
- CVE-2023-25166Regular Expression Denial of Service (ReDoS) Vulnerabilitynpm · @sideway/formula · fixed in 3.0.1
- CVE-2023-25164Sensitive Information leak via Script File in TinaCMSnpm · @tinacms/cli · fixed in 1.0.9
- CVE-2022-25853All versions of the package semver-tags are vulnerable to Command Injection via the getGitTagsRemote function due to improper input sanitizanpm · semver-tags
- CVE-2022-25855All versions of the package create-choo-app3 are vulnerable to Command Injection via the devInstall function due to improper user-input saninpm · create-choo-app3
- CVE-2018-25079Segmentio is-url index.js redosnpm · is-url · fixed in 1.2.3
- CVE-2023-22474Parse Server is vulnerable to authentication bypass via spoofingnpm · parse-server · fixed in 5.4.1
- CVE-2023-23925Switcher Client contains Regular Expression Denial of Service (ReDoS)npm · switcher-client · fixed in 3.1.4
- CVE-2023-23635In Jellyfin 10.8.x through 10.8.3, the name of a collection is vulnerable to stored XSS.npm · jellyfin-web · fixed in 10.8.4
- CVE-2023-23636In Jellyfin 10.8.x through 10.8.3, the name of a playlist is vulnerable to stored XSS.npm · jellyfin-web · fixed in 10.8.4
- CVE-2022-25906All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes benpm · is-http2
- CVE-2022-25916Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scanpm · mt7688-wiscan · fixed in 0.8.3
- CVE-2023-23630Cross-site (XSS) vulnerability with Express API in Etanpm · eta · fixed in 2.0.0
- CVE-2022-25979Versions of the package jsuites before 5.0.1 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization in the Edinpm · jsuites · fixed in 5.0.1
- CVE-2022-21129Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.expornpm · nemo-appium · fixed in 0.0.9
- CVE-2022-25881This affects versions of the package http-cache-semantics before 4.1.1.npm · http-cache-semantics · fixed in 4.1.1
- CVE-2022-45598Cross Site Scripting vulnerability in Joplin Desktop App before v2.9.17 allows attacker to execute arbitrary code via improper santization.npm · joplin · fixed in 2.9.17