Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-28436Command Injectionnpm · google-cloudstorage-commands
- CVE-2020-28471Prototype Pollutionnpm · properties-reader · fixed in 2.2.0
- CVE-2020-7677Arbitrary Code Executionnpm · thenify · fixed in 3.3.1
- CVE-2020-7678Arbitrary Code Executionnpm · node-import
- CVE-2021-23397Prototype Pollutionnpm · @ianwalter/merge
- CVE-2020-7649Directory Traversalnpm · snyk-broker · fixed in 4.73.0
- CVE-2020-28462Prototype Pollutionnpm · ion-parser
- CVE-2020-28461Prototype Pollutionnpm · js-ini · fixed in 1.3.0
- CVE-2020-28441Prototype Pollutionnpm · conf-cfg-ini · fixed in 1.2.2
- CVE-2020-28422Command Injectionnpm · git-archive
- CVE-2020-28438Command Injectionnpm · deferred-exec
- CVE-2020-28459Cross-site Scripting (XSS)npm · markdown-it-decorate
- CVE-2020-28446Command Injectionnpm · ntesseract · fixed in 0.2.9
- CVE-2020-28443Command Injectionnpm · sonar-wrapper
- CVE-2022-21802Cross-site Scripting (XSS)npm · grapesjs
- CVE-2022-25759Remote Code Injectionnpm · convert-svg-core · fixed in 0.6.2
- CVE-2022-36313An issue was discovered in the file-type package before 16.5.4 and 17.x before 17.1.3 for Node.js.npm · file-type · fixed in 16.5.4, 17.1.3
- CVE-2022-31170 OpenZeppelin Contracts's ERC165Checker may revert instead of returning falsenpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.7.1
- CVE-2022-31172OpenZeppelin Contracts's SignatureChecker may revert on invalid EIP-1271 signersnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.7.1
- CVE-2022-31151Uncleared cookies on cross-host/cross-origin redirect in undicinpm · undici · fixed in 5.8.0
- CVE-2022-31160jQuery UI contains potential XSS vulnerability when refreshing a checkboxradio with an HTML-like initial text labelnpm · jquery-ui · fixed in 1.13.2
- CVE-2022-31150CRLF injection in request headersnpm · undici · fixed in 5.8.0
- CVE-2022-36127Service unavailability impact in NodeJS agent(version <= 0.5.0)npm · skywalking-backend-js · fixed in 0.5.1
- CVE-2020-7641Prototype Pollutionnpm · grunt-util-property
- CVE-2022-25869All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cronpm · angular
- CVE-2022-25858Regular Expression Denial of Service (ReDoS)npm · terser · fixed in 4.8.1, 5.14.2
- CVE-2022-31147jquery-validation ReDoS in url2 due to incomplete fix of CVE-2021-43306npm · jquery-validation · fixed in 1.19.5
- CVE-2022-31142Potential Timing Attack Vector in @fastify/bearer-authnpm · @fastify/bearer-auth, fastify-bearer-auth · fixed in 7.0.2, 8.0.1
- CVE-2022-32210`Undici.ProxyAgent` never verifies the remote server's certificate, and always exposes all request & response data to the proxy.npm · undici · fixed in 5.5.1
- CVE-2022-32213The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly parse and validate Transfer-Encoding henpm · llhttp · fixed in 6.0.7