Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-23433Prototype Pollutionnpm · algoliasearch-helper · fixed in 3.6.2
- CVE-2021-37939It was discovered that Kibana’s JIRA connector & IBM Resilient connector could be used to return HTTP response data on internal hosts, whichnpm · kibana · fixed in 7.15.2
- CVE-2021-41165HTML comments vulnerability allowing to execute JavaScript codenpm · ckeditor4 · fixed in 4.17.0
- CVE-2021-41164Advanced Content Filter (ACF) vulnerability allowing to execute JavaScript code using malformed HTMLnpm · ckeditor4 · fixed in 4.17.0
- CVE-2021-3918Prototype Pollution in kriszyp/json-schemanpm · json-schema · fixed in 0.4.0
- CVE-2021-41264UUPSUpgradeable vulnerability in OpenZeppelin Contractsnpm · @openzeppelin/contracts, @openzeppelin/contracts-upgradeable · fixed in 4.3.2
- CVE-2021-41038In versions of the @theia/plugin-ext component of Eclipse Theia prior to 1.18.0, Webview contents can be hijacked via postMessage().npm · @theia/plugin-ext · fixed in 1.18.0
- CVE-2021-43571The verify function in the Stark Bank Node.js ECDSA library (ecdsa-node) 1.1.2 fails to check that the signature is non-zero, which allows anpm · starkbank-ecdsa · fixed in 1.1.3
- CVE-2021-25979Apostrophe - Insufficient Session Expirationnpm · apostrophe · fixed in 3.4.0
- CVE-2021-25978Apostrophe - XSSnpm · apostrophe · fixed in 3.4.0
- CVE-2021-41251Possibility to elevate privileges or get unauthorized access to datanpm · @sap-cloud-sdk/core · fixed in 1.52.0
- CVE-2021-42057Obsidian Dataview through 0.4.12-hotfix1 allows eval injection.npm · obsidian-dataview · fixed in 0.4.13
- CVE-2021-41248XSS vulnerability in GraphiQLnpm · graphiql · fixed in 1.4.7
- CVE-2021-41249XSS vulnerability in GraphQL Playgroundnpm · graphql-playground-react · fixed in 1.7.28
- CVE-2021-41174XSS vulnerability allowing arbitrary JavaScript executionnpm · @grafana/data · fixed in 8.2.3
- CVE-2021-41134Stored XSS in Jupyter nbdimenpm · nbdime, nbdime-jupyterlab · fixed in 5.0.2, 6.1.2, 1.0.1 and more
- CVE-2021-23472Cross-site Scripting (XSS)npm · bootstrap-table
- CVE-2021-23784Cross-site Scripting (XSS)npm · tempura · fixed in 0.4.0
- CVE-2021-23509Prototype Pollutionnpm · json-ptr · fixed in 3.0.0
- CVE-2021-23807Prototype Pollutionnpm · jsonpointer, org.webjars.npm:json-pointer · fixed in 5.0.0
- CVE-2021-23624Prototype Pollutionnpm · dotty · fixed in 0.1.2
- CVE-2021-23820Prototype Pollutionnpm · json-pointer · fixed in 0.6.2
- CVE-2021-3765Inefficient Regular Expression Complexity in validatorjs/validator.jsnpm · validator · fixed in 13.7.0
- CVE-2020-36379An issue was discovered in the remove function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parametnpm · aaptjs
- CVE-2020-36381An issue was discovered in the singleCrunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath pnpm · aaptjs
- CVE-2020-36380An issue was discovered in the crunch function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parametnpm · aaptjs
- CVE-2020-36377An issue was discovered in the dump function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameternpm · aaptjs
- CVE-2020-36378An issue was discovered in the packageCmd function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parnpm · aaptjs
- CVE-2020-36376An issue was discovered in the list function in shenzhim aaptjs 1.3.1, allows attackers to execute arbitrary code via the filePath parameternpm · aaptjs
- CVE-2020-22864A cross site scripting (XSS) vulnerability in the Insert Video function of Froala WYSIWYG Editor 3.1.0 allows attackers to execute arbitrarynpm · froala-editor · fixed in 4.0.11