Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-23541jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMACnpm · jsonwebtoken · fixed in 9.0.0
- CVE-2022-24431Command Injectionnpm · abacus-ext-cmdline
- CVE-2022-25893Arbitrary Code Executionnpm · vm2 · fixed in 3.9.10
- CVE-2022-25895Directory Traversalnpm · lite-dev-server
- CVE-2022-25929Cross-site Scripting (XSS)npm · smoothie · fixed in 1.36.1
- CVE-2022-25171Command Injectionnpm · p4 · fixed in 0.0.7
- CVE-2022-25904Prototype Pollutionnpm · safe-eval
- CVE-2022-25931Directory Traversalnpm · easy-static-server
- CVE-2022-25940Denial of Service (DoS)npm · lite-server
- CVE-2021-4264LinkedIn dustjs prototype pollutionnpm · dustjs-linkedin · fixed in 3.0.0
- CVE-2016-20018Knex Knex.js through 2.3.0 has a limited SQL injection vulnerability that can be exploited to ignore the WHERE clause of a SQL query.npm · knex · fixed in 2.4.0
- CVE-2020-36618Furqan node-whois index.coffee prototype pollutionnpm · whois · fixed in 2.13.6
- CVE-2021-4260oils-js Web.js redirectnpm · oils · fixed in 8.0.0
- CVE-2022-24377Command Injectionnpm · cycle-import-check · fixed in 1.3.2
- CVE-2022-23474editor.js contains Code Injectionnpm · @editorjs/editorjs · fixed in 2.26.0
- CVE-2020-24855Directory Traversal vulnerability in easywebpack-cli before 4.5.2 allows attackers to obtain sensitive information via crafted GET request.npm · @easy-team/easywebpack-cli · fixed in 4.5.2
- CVE-2021-33420A deserialization issue discovered in inikulin replicator before 1.0.4 allows remote attackers to run arbitrary code via the fromSerializablnpm · replicator · fixed in 1.0.4
- CVE-2021-4245chbrown rfc6902 pointer.ts prototype pollutionnpm · rfc6902 · fixed in 5.0.0
- CVE-2022-23505Passport-wsfed-saml2 vulnerable to Authentication Bypass for WSFed authenticationnpm · passport-wsfed-saml2 · fixed in 4.6.3
- CVE-2022-25912Remote Code Execution (RCE)npm · simple-git · fixed in 3.15.0
- CVE-2022-23510SQl injection in cube-jsnpm · @cubejs-backend/api-gateway · fixed in 0.31.24
- CVE-2022-23494Cross-site scripting vulnerability in TinyMCE alertsnpm · tinymce · fixed in 6.3.1, 5.10.7
- CVE-2022-23487libp2p denial of service vulnerability from lack of resource managementnpm · libp2p · fixed in 0.38.0
- CVE-2022-46164Account takeover via prototype vulnerabilitynpm · nodebb · fixed in 2.6.1
- CVE-2022-41642OS command injection vulnerability in Nadesiko3 (PC Version) v3.3.61 and earlier allows a remote attacker to execute an arbitrary OS commandnpm · nadesiko3 · fixed in 3.3.69
- CVE-2022-41777Improper check or handling of exceptional conditions vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlnpm · nadesiko3 · fixed in 3.3.75
- CVE-2022-42496OS command injection vulnerability in Nako3edit, editor component of nadesiko3 (PC Version) v3.3.74 and earlier allows a remote attacker to npm · nadesiko3 · fixed in 3.3.75
- CVE-2022-22984Command Injectionnpm · @snyk/snyk-cocoapods-plugin, @snyk/snyk-hex-plugin +6 · fixed in 2.5.3, 1.1.6, 1.1064.0 and more
- CVE-2022-24441Code Injectionnpm · snyk · fixed in 1.1064.0
- CVE-2022-25848Directory Traversalnpm · static-dev-server