Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-24901Authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter npm · parse-server · fixed in 4.10.10, 5.2.1
- CVE-2021-46440Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi before 3.6.9 and 4.x before 4.1.5 allows an attacknpm · @strapi/strapi, strapi · fixed in 4.1.5, 3.6.9
- CVE-2022-28118SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.npm · siteserver
- CVE-2022-25301Prototype Pollutionnpm · jsgui-lang-essentials
- CVE-2022-22143Prototype Pollutionnpm · convict · fixed in 6.2.3
- CVE-2022-25645Prototype Pollutionnpm · dset · fixed in 3.1.2
- CVE-2022-25349Cross-site Scripting (XSS)npm · materialize-css
- CVE-2022-25844Regular Expression Denial of Service (ReDoS)npm · angular
- CVE-2022-23923Sandbox Bypassnpm · jailed
- CVE-2022-21189Prototype Pollutionnpm · dexie · fixed in 3.2.2, 4.0.0-alpha.3
- CVE-2022-21227Denial of Service (DoS)npm · sqlite3 · fixed in 5.0.3
- CVE-2022-21144Denial of Service (DoS)npm · libxmljs · fixed in 0.19.8
- CVE-2022-24437Command Injectionnpm · git-pull-or-clone · fixed in 2.0.2
- CVE-2022-25854Cross-site Scripting (XSS)npm · @yaireo/tagify · fixed in 4.9.8
- CVE-2022-29078The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputnpm · ejs · fixed in 3.1.7
- CVE-2022-27103element-plus 2.0.5 is vulnerable to Cross Site Scripting (XSS) via el-table-column.npm · element-plus · fixed in 2.0.6
- CVE-2022-1440Command Injection vulnerability in git-interface@2.1.1 in yarkeev/git-interfacenpm · git-interface · fixed in 2.1.2
- CVE-2022-24858Default redirect callback vulnerable to open redirectsnpm · next-auth · fixed in 3.29.2, 4.3.2
- CVE-2022-24279Prototype Pollutionnpm · madlib-object-utils · fixed in 0.1.8
- CVE-2022-1330stored xss due to unsantized anchor url in alvarotrigo/fullpage.jsnpm · fullpage.js · fixed in 4.0.5
- CVE-2022-28397An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a craftnpm · ghost
- CVE-2022-27952An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafnpm · payload · fixed in 0.15.1
- CVE-2022-27263An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted fnpm · strapi
- CVE-2022-27261An arbitrary file write vulnerability in Express-FileUpload v1.3.1 allows attackers to upload multiple files with the same name, causing an npm · express-fileupload
- CVE-2022-27260An arbitrary file upload vulnerability in the file upload component of ButterCMS v1.2.8 allows attackers to execute arbitrary code via a cranpm · buttercms
- CVE-2022-27139An arbitrary file upload vulnerability in the file upload module of Ghost v4.39.0 allows attackers to execute arbitrary code via a crafted Snpm · ghost
- CVE-2022-21803Prototype Pollutionnpm · nconf · fixed in 0.11.4
- CVE-2022-29080The npm-dependency-versions package through 0.3.0 for Node.js allows command injection if an attacker is able to call dependencyVersions witnpm · npm-dependency-versions
- CVE-2022-0436Path Traversal in gruntjs/gruntnpm · grunt · fixed in 1.5.2
- CVE-2022-24815SQL Injection when creating an application with Reactive SQL backend npm · generator-jhipster · fixed in 7.8.1