Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-36083JOSE vulnerable to resource exhaustion via specifically crafted JWEnpm · jose, jose-browser-runtime +2 · fixed in 1.28.2, 2.0.6, 3.20.4 and more
- CVE-2022-36079Parse Server vulnerable to brute force guessing of user sensitive data via search patternsnpm · parse-server · fixed in 4.10.14, 5.2.5
- CVE-2022-35513The Blink1Control2 application <= 2.2.7 uses weak password encryption and an insecure method of storage.npm · blink1control2 · fixed in 2.2.9
- CVE-2022-36067vm2 vulnerable to Sandbox Escape before v3.9.11npm · vm2 · fixed in 3.9.11
- CVE-2022-36076Account takeover via SSO plugins in NodeBBnpm · nodebb · fixed in 1.17.2
- CVE-2022-36046Unexpected server crash in Next.js version 12.2.3npm · next · fixed in 12.2.4
- CVE-2022-36045Account takeover via cryptographically weak PRNG in NodeBB Forumnpm · nodebb · fixed in 1.19.8, 2.0.1
- CVE-2022-25646Cross-site Scripting (XSS)npm · x-data-spreadsheet
- CVE-2022-25887Regular Expression Denial of Service (ReDoS)npm · sanitize-html · fixed in 2.7.1
- CVE-2020-26938In oauth2-server (aka node-oauth2-server) through 3.1.1, the value of the redirect_uri parameter received during the authorization and tokennpm · oauth2-server
- CVE-2022-36036Improper Control of Generation of Code ('Code Injection') in mdx-mermaidnpm · mdx-mermaid · fixed in 1.3.0, 2.0.0-rc2
- CVE-2022-36034Possible Regular Expression Denial of Service (ReDoS) used on uncontrolled data in nitrado.jsnpm · nitrado.js · fixed in 0.2.5
- CVE-2022-25921Arbitrary Code Executionnpm · morgan-json
- CVE-2022-25644Arbitrary Code Executionnpm · @pendo324/get-process-by-name
- CVE-2022-21165Arbitrary Command Injectionnpm · font-converter
- CVE-2021-43309ReDoS in uri-template-lite URI.expand functionnpm · uri-template-lite · fixed in 22.9.0
- CVE-2022-24375Denial of Service (DoS)npm · node-opcua · fixed in 2.74.0
- CVE-2022-21208Denial of Service (DoS)npm · node-opcua · fixed in 2.74.0
- CVE-2022-25231Denial of Service (DoS)npm · node-opcua · fixed in 2.74.0
- CVE-2022-2932Cross-site Scripting (XSS) - Reflected in bustle/mobiledoc-kitnpm · mobiledoc-kit · fixed in 0.14.2
- CVE-2022-36031Unhandled exception on illegal filename_disk valuenpm · directus · fixed in 9.15.0
- CVE-2022-35204Vitejs Vite before v2.9.13 was discovered to allow attackers to perform a directory traversal via a crafted URL to the victim's service.npm · vite · fixed in 2.9.13, 3.0.0-beta.4
- CVE-2022-36010Arbitrary code execution via function parsing in react-editable-json-treenpm · react-editable-json-tree · fixed in 2.2.2
- CVE-2022-35961ECDSA signature malleability in OpenZeppelin Contractsnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.7.3
- CVE-2022-35954Delimiter injection vulnerability in @actions/core exportVariablenpm · @actions/core · fixed in 1.9.1
- CVE-2022-35948CRLF Injection in Nodejs ‘undici’ via Content-Typenpm · undici · fixed in 5.8.2
- CVE-2022-35942loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filternpm · loopback-connector-postgresql · fixed in 5.5.1
- CVE-2022-35949`undici.request` vulnerable to SSRF using absolute URL on `pathname`npm · undici · fixed in 5.8.2
- CVE-2022-25973Arbitrary Command Executionnpm · mc-kill-port
- CVE-2022-25907Prototype Pollutionnpm · ts-deepmerge · fixed in 2.0.2