Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-23411Cross-site Scripting (XSS)npm · anchorme
- CVE-2020-18155SQL Injection vulnerability in Subrion CMS v4.2.1 in the search page if a website uses a PDO connection.Packagist · intelliants/subrion
- CVE-2021-36383Xen Orchestra (with xo-web through 5.80.0 and xo-server through 5.84.0) mishandles authorization, as demonstrated by modified WebSocket resonpm · xo-server, xo-web
- CVE-2020-23700Cross Site Scripting (XSS) vulnerability in LavaLite-CMS 5.8.0 via the Menu Links feature.Packagist · lavalite/cms
- CVE-2021-23401Open RedirectPyPI · flask-user
- CVE-2020-36397A stored cross site scripting (XSS) vulnerability in the /admin/contact/contact component of LavaLite 5.8.0 allows authenticated attackers tPackagist · lavalite/cms
- CVE-2020-36396A stored cross site scripting (XSS) vulnerability in the /admin/roles/role component of LavaLite 5.8.0 allows authenticated attackers to exePackagist · lavalite/cms
- CVE-2021-23402Prototype Pollutionnpm · record-like-deep-assign
- CVE-2020-36407libavif 0.8.0 and 0.8.1 has an out-of-bounds write in avifDecoderDataFillImageGrid.PyPI · avif
- CVE-2021-25951XXE vulnerability in 'XML2Dict' version 0.2.2 allows an attacker to cause a denial of service.PyPI · xml2dict
- CVE-2021-23399Arbitrary Command Injectionnpm · wincred
- CVE-2021-31649In applications using jfinal 4.9.08 and below, there is a deserialization vulnerability when using redis,may be vulnerable to remote code exMaven · com.jfinal:jfinal
- CVE-2021-23398Cross-site Scripting (XSS)npm · react-bootstrap-table
- CVE-2021-21809A command execution vulnerability exists in the default legacy spellchecker plugin in Moodle 3.10.Packagist · moodle/moodle
- CVE-2021-23396Prototype Pollutionnpm · lutils
- CVE-2021-32245In PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS.Packagist · pagekit/pagekit
- CVE-2021-32244Cross Site Scripting (XSS) in Moodle 3.10.3 allows remote attackers to execute arbitrary web script or HTML via the "Description" field.Packagist · moodle/moodle
- CVE-2021-34801Valine 1.4.14 allows remote attackers to cause a denial of service (application outage) by supplying a ua (aka User-Agent) value that only snpm · valine
- CVE-2021-23395Prototype Pollutionnpm · nedb
- CVE-2021-25948Prototype pollution vulnerability in 'expand-hash' versions 0.1.0 through 1.0.1 allows an attacker to cause a denial of service and may leadnpm · expand-hash
- CVE-2021-20293A reflected Cross-Site Scripting (XSS) flaw was found in RESTEasy in all versions of RESTEasy up to 4.6.0.Final, where it did not properly hMaven · org.jboss.resteasy:resteasy-bom, org.jboss.resteasy:resteasy-core
- CVE-2021-23391Arbitrary File Write via Archive Extraction (Zip Slip)npm · calipso
- CVE-2021-3499A vulnerability was found in OVN Kubernetes in versions up to and including 0.3.0 where the Egress Firewall does not reliably apply firewallGo · github.com/ovn-org/ovn-kubernetes
- CVE-2021-25945Prototype pollution vulnerability in 'js-extend' versions 0.0.1 through 1.0.1 allows attacker to cause a denial of service and may lead to rnpm · js-extend
- CVE-2021-25946Prototype pollution vulnerability in `nconf-toml` versions 0.0.1 through 0.0.2 allows an attacker to cause a denial of service and may lead npm · nconf-toml
- CVE-2021-25934In OpenNMS Horizon, versions opennms-18.0.0-1 through opennms-27.1.0-1; OpenNMS Meridian, versions meridian-foundation-2015.1.0-1 through meMaven · org.opennms:opennms
- CVE-2021-25944Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead npm · deep-defaults
- CVE-2021-30108Feehi CMS 2.1.1 is affected by a Server-side request forgery (SSRF) vulnerability.Packagist · feehi/cms
- CVE-2021-32624Private Field data leaknpm · @keystonejs/keystone
- CVE-2021-33041vmd through 1.34.0 allows 'div class="markdown-body"' XSS, as demonstrated by Electron remote code execution via require('child_process').exnpm · vmd