Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-37701Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksnpm · tar · fixed in 4.4.16, 5.0.8, 6.1.7
- CVE-2021-37712Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic linksnpm · tar · fixed in 4.4.18, 5.0.10, 6.1.9
- CVE-2021-39178XSS in Image Optimization API for Next.js versions between 10.0.0 and 11.1.0npm · next · fixed in 11.1.1
- CVE-2021-32831Code injection in total.jsnpm · total.js · fixed in 3.4.9
- CVE-2021-39171Unlimited transforms allowed for signed nodesnpm · passport-saml · fixed in 3.1.0
- CVE-2021-23434Prototype Pollutionnpm · object-path · fixed in 0.11.6
- CVE-2021-39167TimelockController vulnerability in OpenZeppelin Contractsnpm · @openzeppelin/contracts · fixed in 4.3.1, 3.4.2
- CVE-2021-39168TimelockController vulnerability in OpenZeppelin Contractsnpm · @openzeppelin/contracts-upgradeable · fixed in 4.3.1, 3.4.2
- CVE-2021-39157Improper Handling of Exceptional Conditions in detect-character-encodingnpm · detect-character-encoding · fixed in 0.7.0
- CVE-2021-23432Prototype Pollutionnpm · mootools
- CVE-2021-23429Denial of Service (DoS)npm · transpile
- CVE-2021-23430Directory Traversalnpm · startserver
- CVE-2021-23431Cross-site Request Forgery (CSRF)npm · joplin · fixed in 2.3.2
- CVE-2021-23406Remote Code Execution (RCE)npm · degenerator, pac-resolver · fixed in 3.0.1, 5.0.0
- CVE-2021-39138New anonymous user session acts as if it's created with passwordnpm · parse-server · fixed in 4.5.2
- CVE-2021-23424Regular Expression Denial of Service (ReDoS)npm · ansi-html · fixed in 0.0.8
- CVE-2021-23425Regular Expression Denial of Service (ReDoS)npm · trim-off-newlines · fixed in 1.0.3
- CVE-2021-39131Improper Handling of Unexpected Data Type in cednpm · ced · fixed in 1.0.0
- CVE-2021-32830The @diez/generation npm package is a client for Diez.npm · @diez/generation
- CVE-2021-32822File disclosure in hbsnpm · hbs
- CVE-2021-37695Execution of JavaScript code using malformed HTML in ckeditornpm · ckeditor4 · fixed in 4.16.2
- CVE-2021-37700Clipboard-based DOM-XSSnpm · @github/paste-markdown · fixed in 0.3.4
- CVE-2021-32809Arbitrary HTML injection vulnerability in ckeditornpm · ckeditor4 · fixed in 4.16.2
- CVE-2021-32808Cross-site scripting in ckeditor via abuse of undo functionalitynpm · ckeditor4 · fixed in 4.16.2
- CVE-2020-22403Cross Site Request Forgery (CSRF) vulnerability in Express cart v1.1.16 allows attackers to add an administrator account, add discount code npm · express-cart · fixed in 1.1.17
- CVE-2021-37699Open Redirect in Next.js versions below 11.1.0npm · next · fixed in 11.1.0
- CVE-2021-23421Prototype Pollutionnpm · merge-change
- CVE-2021-37694Code injection issue for java-spring-cloud-stream-templatenpm · @asyncapi/java-spring-cloud-stream-template · fixed in 0.7.0
- CVE-2021-38384Serverless Offline 8.0.0 returns a 403 HTTP status code for a route that has a trailing / character, which might cause a developer to implemnpm · serverless-offline
- CVE-2021-23419Prototype Pollutionnpm · open-graph · fixed in 0.2.6