Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-26226Secret disclosure in semantic-releasenpm · semantic-release · fixed in 17.2.3
- CVE-2020-7774Prototype Pollutionnpm · y18n · fixed in 3.2.2, 4.0.1, 5.0.5
- CVE-2020-7773Cross-site Scripting (XSS)npm · markdown-it-highlightjs · fixed in 3.3.1
- CVE-2020-7765Prototype Pollutionnpm · @firebase/util · fixed in 0.3.4
- CVE-2020-28268Prototype pollution vulnerability in 'controlled-merge' versions 1.0.0 through 1.2.0 allows attacker to cause a denial of service and may lenpm · controlled-merge · fixed in 1.3.0
- CVE-2020-7772Prototype Pollutionnpm · doc-path · fixed in 2.1.2
- CVE-2020-27193A cross-site scripting (XSS) vulnerability in the Color Dialog plugin for CKEditor 4.15.0 allows remote attackers to run arbitrary web scripnpm · ckeditor4 · fixed in 4.15.1
- CVE-2020-28271Prototype pollution vulnerability in 'deephas' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remnpm · deephas
- CVE-2020-28270Prototype pollution vulnerability in 'object-hierarchy-access' versions 0.2.0 through 0.32.0 allows attacker to cause a denial of service annpm · object-hierarchy-access · fixed in 0.33.0
- CVE-2020-28269Prototype pollution vulnerability in 'field' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to remotnpm · field
- CVE-2020-7770Prototype Pollutionnpm · json8 · fixed in 1.0.3
- CVE-2020-7769Command Injectionnpm · nodemailer · fixed in 6.4.16
- CVE-2020-7767Regular Expression Denial of Service (ReDoS)npm · express-validators
- CVE-2020-7768Prototype Pollutionnpm · @grpc/grpc-js, grpc · fixed in 1.1.8, 1.24.4
- CVE-2020-28267Prototype pollution vulnerability in '@strikeentco/set' version 1.0.0 allows attacker to cause a denial of service and may lead to remote conpm · @strikeentco/set · fixed in 1.0.1
- CVE-2020-7766Prototype Pollutionnpm · json-ptr · fixed in 2.1.0
- CVE-2020-8268Prototype pollution vulnerability in json8-merge-patch npm package < 1.0.3 may allow attackers to inject or modify methods and properties ofnpm · json8-merge-patch · fixed in 1.0.3
- CVE-2020-7764Web Cache Poisoningnpm · find-my-way · fixed in 2.2.5, 3.0.5
- CVE-2020-28168Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providinnpm · axios · fixed in 0.21.1
- CVE-2020-28249Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note.npm · joplin · fixed in 1.3.11
- CVE-2020-7763Arbitrary File Readnpm · phantom-html-to-pdf · fixed in 0.6.2
- CVE-2020-7762Arbitrary File Readnpm · jsreport-chrome-pdf · fixed in 1.10.0
- CVE-2020-7761Regular Expression Denial of Service (ReDoS)npm · @absolunet/kafe · fixed in 3.2.10
- CVE-2020-7758Path Traversalnpm · browserless-chrome · fixed in 1.43.0
- CVE-2020-7757Path Traversalnpm · droppy
- CVE-2020-7760Regular Expression Denial of Service (ReDoS)npm · codemirror · fixed in 5.58.2
- CVE-2020-7746Prototype Pollutionnpm · chart.js · fixed in 2.9.4
- CVE-2020-7755Regular Expression Denial of Service (ReDoS)npm · dat.gui
- CVE-2020-7754Regular Expression Denial of Service (ReDoS)npm · npm-user-validate · fixed in 1.0.1
- CVE-2020-7753Regular Expression Denial of Service (ReDoS)npm · trim · fixed in 0.0.3