Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-32818Remote code execution and Reflected cross site scripting in haml-coffeenpm · haml-coffee
- CVE-2021-32817File disclosure in express-hbsnpm · express-hbs
- CVE-2021-25943Prototype pollution vulnerability in '101' versions 1.0.0 through 1.6.3 allows an attacker to cause a denial of service and may lead to remonpm · 101
- CVE-2021-33026The Flask-Caching extension through 1.10.1 for Flask relies on Pickle for serialization, which may lead to remote code execution or local prPyPI · flask-caching
- CVE-2021-29508Insecure deserialization in WireNuGet · wire
- CVE-2021-20717Cross-site scripting vulnerability in EC-CUBE 4.0.0 to 4.0.5 allows a remote attacker to inject a specially crafted script in the specific iPackagist · ec-cube/ec-cube
- CVE-2021-28128In Strapi through 3.6.0, the admin panel allows the changing of one's own password without entering the current password.npm · strapi
- CVE-2021-31996An issue was discovered in the algorithmica crate through 2021-03-07 for Rust.crates.io · algorithmica
- CVE-2021-25928Prototype pollution vulnerability in 'safe-obj' versions 1.0.0 through 1.0.2 allows an attacker to cause a denial of service and may lead tonpm · safe-obj
- CVE-2021-20083Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-plugin-query-object 2.2.3 allows a malicnpm · jquery-query-object
- CVE-2021-20085Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in backbone-query-parameters 0.4.0 allows a malicinpm · backbone-query-parameters
- CVE-2021-20086Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-bbq 1.2.1 allows a malicious user to injnpm · jquery-bbq
- CVE-2021-20087Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in jquery-deparam 0.5.1 allows a malicious user tonpm · jquery-deparam
- CVE-2021-20088Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in mootools-more 1.6.0 allows a malicious user to npm · mootools-more
- CVE-2021-23379Arbitrary Command Injectionnpm · portkiller
- CVE-2021-23380Arbitrary Command Injectionnpm · roar-pidusage
- CVE-2021-23381Arbitrary Command Injectionnpm · killing
- CVE-2021-23374Arbitrary Command Injectionnpm · ps-visitor
- CVE-2021-23375Arbitrary Command Injectionnpm · psnode
- CVE-2021-23376Arbitrary Command Injectionnpm · ffmpegdotjs
- CVE-2021-23377Arbitrary Command Injectionnpm · onion-oled-js
- CVE-2021-23378Arbitrary Command Injectionnpm · picotts
- CVE-2021-23372Denial of Service (DoS)npm · mongo-express
- CVE-2021-3163A vulnerability in the HTML editor of Slab Quill 4.8.0 allows an attacker to execute arbitrary JavaScript by storing an XSS payload (a craftnpm · quill
- CVE-2020-23761Cross Site Scripting (XSS) vulnerability in subrion CMS Version <= 4.2.1 allows remote attackers to execute arbitrary web script via the "paPackagist · intelliants/subrion
- CVE-2021-30455An issue was discovered in the id-map crate through 2021-02-26 for Rust.crates.io · id-map
- CVE-2021-30457An issue was discovered in the id-map crate through 2021-02-26 for Rust.crates.io · id-map
- CVE-2021-30456An issue was discovered in the id-map crate through 2021-02-26 for Rust.crates.io · id-map
- CVE-2021-30109Froala Editor 3.2.6 is affected by Cross Site Scripting (XSS).npm · froala-editor
- CVE-2021-29929An issue was discovered in the endian_trait crate through 2021-01-04 for Rust.crates.io · endian_trait