Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2022-0691Authorization Bypass Through User-Controlled Key in unshiftio/url-parsenpm · url-parse · fixed in 1.5.9
- CVE-2022-0686Authorization Bypass Through User-Controlled Key in unshiftio/url-parsenpm · url-parse · fixed in 1.5.8
- CVE-2021-23702Prototype Pollutionnpm · object-extend
- CVE-2022-23647Cross-site Scripting in Prismnpm · prismjs · fixed in 1.27.0
- CVE-2022-23646Improper CSP in Image Optimization API for Next.jsnpm · next · fixed in 12.1.0
- CVE-2022-22912Prototype pollution vulnerability via .parse() in Plist before v3.0.4 allows attackers to cause a Denial of Service (DoS) and may lead to renpm · plist · fixed in 3.0.5
- CVE-2022-0639Authorization Bypass Through User-Controlled Key in unshiftio/url-parsenpm · url-parse · fixed in 1.5.7
- CVE-2021-23682Prototype Pollutionnpm · litespeed.js · fixed in 0.3.12
- CVE-2022-0613Authorization Bypass Through User-Controlled Key in medialize/uri.jsnpm · urijs · fixed in 1.19.8
- CVE-2022-0512Authorization Bypass Through User-Controlled Key in unshiftio/url-parsenpm · url-parse · fixed in 1.5.6
- CVE-2021-23555Sandbox Bypassnpm · vm2 · fixed in 3.9.6
- CVE-2021-23597Denial of Service (DoS)npm · fastify-multipart · fixed in 5.3.1
- CVE-2022-23631Prototype Pollution leading to Remote Code Execution in superjsonnpm · blitz, superjson · fixed in 0.45.3, 1.8.1
- CVE-2022-0536Improper Removal of Sensitive Information Before Storage or Transfer in follow-redirects/follow-redirectsnpm · follow-redirects · fixed in 1.14.8
- CVE-2022-23340Joplin 2.6.10 allows remote attackers to execute system commands through malicious code in user search results.npm · joplin · fixed in 2.7.1
- CVE-2022-0508Server-Side Request Forgery (SSRF) in chocobozzz/peertubenpm · @peertube/embed-api · fixed in 4.1.0-rc.1
- CVE-2022-23623Validation bypass in frourionpm · frourio · fixed in 0.26.0
- CVE-2022-23624Validation bypass in frourio-expressnpm · frourio-express · fixed in 0.26.0
- CVE-2022-0437Cross-site Scripting (XSS) - DOM in karma-runner/karmanpm · karma · fixed in 6.3.14
- CVE-2021-23507Prototype Pollutionnpm · object-path-set · fixed in 1.0.2
- CVE-2021-23470Prototype Pollutionnpm · putil-merge · fixed in 3.8.0
- CVE-2021-23497Prototype Pollutionnpm · @strikeentco/set · fixed in 1.0.2
- CVE-2021-46320In OpenZeppelin <=v4.4.0, initializer functions that are invoked separate from contract creation (the most prominent example being minimal pnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.4.1
- CVE-2022-0401Path Traversal in yuda-lyu/w-zipnpm · w-zip · fixed in 1.0.12
- CVE-2022-21721DOS Vulnerability in next.jsnpm · next · fixed in 12.0.9
- CVE-2021-23558Prototype Pollutionnpm · bmoor · fixed in 0.10.1
- CVE-2021-23760Prototype Pollutionnpm · keyget
- CVE-2021-23484Arbitrary File Write via Archive Extraction (Zip Slip)npm · zip-local · fixed in 0.3.5
- CVE-2022-0355Improper Removal of Sensitive Information Before Storage or Transfer in feross/simple-getnpm · simple-get · fixed in 4.0.1, 3.1.1, 2.8.2
- CVE-2021-4103Cross-site Scripting (XSS) - Stored in vanessa219/vditornpm · vditor · fixed in 3.8.11