Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-21186Arbitrary Command Injectionnpm · @acrontum/filesystem-template · fixed in 0.0.2
- CVE-2022-35142An issue in Renato v0.17.0 allows attackers to cause a Denial of Service (DoS) via a crafted payload injected into the Search parameter.npm · raneto · fixed in 0.17.1
- CVE-2022-35143Renato v0.17.0 employs weak password complexity requirements, allowing attackers to crack user passwords via brute-force attacks.npm · raneto · fixed in 0.17.1
- CVE-2022-35144Renato v0.17.0 was discovered to contain a cross-site scripting (XSS) vulnerability.npm · raneto · fixed in 0.17.1
- CVE-2022-31175Cross-site scripting caused by the editor instance destroying process in ckeditor5npm · @ckeditor/ckeditor5-html-embed, @ckeditor/ckeditor5-html-support +1 · fixed in 35.0.1
- CVE-2022-35923Inefficient Regular Expression Complexity in v8nnpm · v8n · fixed in 1.5.1
- CVE-2022-35924Verification requests (magic link) sent to unwanted emailsnpm · next-auth · fixed in 4.10.3, 3.29.10
- CVE-2020-28423Command Injectionnpm · monorepo-build
- CVE-2020-28425Command Injectionnpm · curljs
- CVE-2020-28433Command Injectionnpm · node-latex-pdf
- CVE-2020-7795Command Injectionnpm · get-npm-package-version · fixed in 1.0.7
- CVE-2020-28434Command Injectionnpm · gitblame
- CVE-2020-28437Command Injectionnpm · heroku-env
- CVE-2020-28451Command Injectionnpm · image-tiler
- CVE-2020-28453Command Injectionnpm · npos-tesseract
- CVE-2022-35917Weakness in Transfer Validation Logic in @solana/paynpm · @solana/pay · fixed in 0.2.1
- CVE-2022-35915Unbounded gas consumption in @openzeppelin/contractsnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable +2 · fixed in 4.7.2
- CVE-2022-35916Cross chain utilities for Arbitrum L2 see EOA calls as cross chain callsnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.7.2
- CVE-2022-31198GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contractsnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.7.2
- CVE-2022-31186Leakage of excessive information into log in next-authnpm · next-auth · fixed in 3.29.9, 4.10.2
- CVE-2022-31179Insufficient escaping of line feeds for CMD in shescapenpm · shescape · fixed in 1.5.8
- CVE-2022-31180Insufficient escaping of whitespace in shescapenpm · shescape · fixed in 1.5.8
- CVE-2022-2596Inefficient Regular Expression Complexity in node-fetch/node-fetchnpm · node-fetch · fixed in 3.2.10
- CVE-2022-2564Prototype Pollution in automattic/mongoosenpm · mongoose · fixed in 6.4.6, 5.13.15
- CVE-2022-35131Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles.npm · joplin · fixed in 2.9.1
- CVE-2020-28447Command Injectionnpm · xopen
- CVE-2021-23451Insecure Randomnessnpm · otp-generator · fixed in 3.0.0
- CVE-2021-23373Prototype Pollutionnpm · set-deep-prop
- CVE-2020-28455Cross-site Scripting (XSS)npm · markdown-it-toc
- CVE-2020-28435Command Injectionnpm · ffmpeg-sdk