Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-1295Prototype Pollution in alvarotrigo/fullpage.jsnpm · fullpage.js · fixed in 4.0.2
- CVE-2022-1291XSS vulnerability with default `onCellHtmlData` function in hhurz/tableexport.jquery.pluginnpm · tableexport.jquery.plugin · fixed in 1.25.0
- CVE-2022-24822Denial of Service in @podium/layout and @podium/proxynpm · @podium/layout, @podium/proxy · fixed in 4.6.110, 4.2.74
- CVE-2021-43138In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js npm · async · fixed in 3.2.2, 2.6.4
- CVE-2020-28847Cross Site Scripting (XSS) vulnerability in xCss Valine v1.4.14 via the nick parameter to /classes/Comment.npm · valine · fixed in 1.4.15
- CVE-2022-1243CRHTLF can lead to invalid protocol extraction potentially leading to XSS in medialize/uri.jsnpm · urijs · fixed in 1.19.11
- CVE-2022-1233URL Confusion When Scheme Not Supplied in medialize/uri.jsnpm · urijs · fixed in 1.19.11
- CVE-2022-24814Cross-site Scripting in Directusnpm · directus · fixed in 9.7.0
- CVE-2022-24785Path Traversal in Moment.jsnpm · moment · fixed in 2.29.2
- CVE-2022-21830A blind self XSS vulnerability exists in RocketChat LiveChat <v1.9 that could allow an attacker to trick a victim pasting malicious code in npm · @rocket.chat/livechat · fixed in 1.9.0
- CVE-2022-24066Command Injectionnpm · simple-git · fixed in 3.5.0
- CVE-2022-24802Prototype Pollution in deepmerge-tsnpm · deepmerge-ts · fixed in 4.0.2
- CVE-2022-24794Open Redirect in express-openid-connectnpm · express-openid-connect · fixed in 2.7.2
- CVE-2022-0350Cross-site Scripting (XSS) - Stored in vanessa219/vditornpm · vditor · fixed in 3.8.13
- CVE-2022-26260Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse().npm · simple-plist · fixed in 1.3.1
- CVE-2022-21718Renderers can obtain access to random bluetooth device without permission in Electronnpm · electron · fixed in 13.6.6, 14.2.4, 15.3.5 and more
- CVE-2022-25766Remote Code Execution (RCE)npm · ungit · fixed in 1.5.20
- CVE-2022-26183PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when usenpm · pnpm · fixed in 6.15.1
- CVE-2022-24772Improper Verification of Cryptographic Signature in `node-forge`npm · node-forge · fixed in 1.3.0
- CVE-2022-24773Improper Verification of Cryptographic Signature in `node-forge`npm · node-forge · fixed in 1.3.0
- CVE-2022-24771Improper Verification of Cryptographic Signature in node-forgenpm · node-forge · fixed in 1.3.0
- CVE-2022-24759Failure to validate signature during handshake in @chainsafe/libp2p-noisenpm · @chainsafe/libp2p-noise · fixed in 4.1.2, 5.0.3
- CVE-2021-44906Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).npm · minimist · fixed in 1.2.6, 0.2.4
- CVE-2021-44908SailsJS Sails.js <=1.4.0 is vulnerable to Prototype Pollution via controller/load-action-modules.js, function loadActionModules().npm · sails
- CVE-2022-0748Arbitrary Code Executionnpm · post-loader
- CVE-2022-25354Prototype Pollutionnpm · set-in · fixed in 2.0.3
- CVE-2022-25352Prototype Pollutionnpm · libnested · fixed in 1.5.2
- CVE-2021-23771Sandbox Bypassnpm · argencoders-notevil, notevil
- CVE-2022-25760Arbitrary Code Injectionnpm · accesslog
- CVE-2021-23632Remote Code Execution (RCE)npm · git