Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-2422Feathers - SQL injection via attribute aliasesnpm · feathers-sequelize · fixed in 6.3.4
- CVE-2022-29822Feathers - Improper parameter filtering in the Feathers js library, which may ultimately lead to SQL injectionnpm · feathers-sequelize · fixed in 6.3.4
- CVE-2022-29823Feathers - Query “__proto__” is converted to real prototypenpm · feathers-sequelize · fixed in 6.3.3
- CVE-2022-39322@keystone-6/core vulnerable to field-level access-control bypass for multiselect fieldnpm · @keystone-6/core · fixed in 2.3.1
- CVE-2022-39350@dependencytrack/frontend vulnerable to Persistent Cross-Site-Scripting via Vulnerability Detailsnpm · @dependencytrack/frontend · fixed in 4.6.1
- CVE-2022-39313Parse Server crashes when receiving file download request with invalid byte rangenpm · parse-server · fixed in 4.10.17, 5.2.8
- CVE-2022-41709Markdownify version 1.4.1 allows an external attacker to execute arbitrary code remotely on any client attempting to view a malicious markdonpm · electron-markdownify
- CVE-2022-3517A vulnerability was found in the minimatch package.npm · minimatch · fixed in 3.0.5
- CVE-2022-37602Prototype pollution vulnerability in karma-runner grunt-karma 4.0.1 via the key variable in grunt-karma.js.npm · grunt-karma
- CVE-2022-37603A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.npm · loader-utils · fixed in 1.4.2, 2.0.4, 3.2.1
- CVE-2022-39300Signature bypass via multiple root elements in node-SAMLnpm · node-saml · fixed in 4.0.0-beta.5
- CVE-2022-37601Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js.npm · loader-utils · fixed in 2.0.3, 1.4.1
- CVE-2022-37611Prototype pollution vulnerability in tschaub gh-pages 3.1.0 via the partial variable in util.js.npm · gh-pages · fixed in 5.0.0
- CVE-2022-37614Prototype pollution vulnerability in function enable in mockery.js in mfncooper mockery commit 822f0566fd6d72af8c943ae5ca2aa92e516aa2cf via npm · mockery
- CVE-2022-39299Signature bypass via multiple root elements in Passport-SAMLnpm · @node-saml/node-saml, @node-saml/passport-saml +2 · fixed in 4.0.0-beta.5, 4.0.0-beta.3, 3.2.2
- CVE-2022-37599A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.npm · loader-utils · fixed in 1.4.2, 2.0.4, 3.2.1
- CVE-2022-37617Prototype pollution vulnerability in function resolveShims in resolve-shims.js in thlorenz browserify-shim 3.8.15 via the k variable in resonpm · browserify-shim · fixed in 3.8.16
- CVE-2022-40440mxGraph v4.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the setTooltips() function.npm · mxgraph
- CVE-2022-41376Metro UI v4.4.0 to v4.5.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Javascript function.npm · metro4
- CVE-2022-39288Denial of service in Fastify via Content-Type headernpm · fastify · fixed in 4.8.1
- CVE-2022-3423Allocation of Resources Without Limits or Throttling in nocodb/nocodbnpm · nocodb · fixed in 0.92.0
- CVE-2022-39287Plaintext transmission of CSRF tokens in tiny-csrfnpm · tiny-csrf · fixed in 1.1.0
- CVE-2022-40764Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package.npm · snyk, snyk-go-plugin · fixed in 1.996.0, 1.19.1
- CVE-2022-40277Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link in a malicious markdnpm · joplin
- CVE-2022-21222Regular Expression Denial of Service (ReDoS)npm · css-what · fixed in 2.1.3
- CVE-2022-24373Regular Expression Denial of Service (ReDoS)npm · react-native-reanimated · fixed in 2.10.0
- CVE-2022-39266isolated-vm has vulnerable CachedDataOptions in APInpm · isolated-vm · fixed in 4.3.7
- CVE-2022-39250Matrix JavaScript SDK vulnerable to key/device identifier confusion in SAS verificationnpm · matrix-js-sdk · fixed in 19.7.0
- CVE-2022-39263NextAuth.js Upstash Adapter missing token verificationnpm · @next-auth/upstash-redis-adapter · fixed in 3.0.2
- CVE-2022-39236Matrix Javascript SDK improper beacon events can cause availability issuesnpm · matrix-js-sdk · fixed in 19.7.0