Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2021-3189The slashify package 1.0.0 for Node.js allows open-redirect attacks, as demonstrated by a localhost:3000///example.com/ substring.npm · slashify
- CVE-2020-1717A flaw was found in Keycloak 7.0.1.Maven · org.keycloak:keycloak-parent
- CVE-2021-23335LDAP Injectionnpm · is-user-valid
- CVE-2020-7786Command Injectionnpm · macfromip
- CVE-2020-7782Command Injectionnpm · spritesheet-js
- CVE-2020-7785Command Injectionnpm · node-ps
- CVE-2020-28449Prototype Pollutionnpm · decal
- CVE-2020-28450Prototype Pollutionnpm · decal
- CVE-2021-23331Insecure Temporary FileMaven · com.squareup:connect
- CVE-2020-7775Command Injectionnpm · freediskspace
- CVE-2020-21176SQL injection vulnerability in the model.increment and model.decrement function in ThinkJS 3.2.10 allows remote attackers to execute arbitranpm · thinkjs
- CVE-2020-28426Command Injectionnpm · kill-process-on-port
- CVE-2021-23330Command Injectionnpm · launchpad
- CVE-2021-23328Prototype Pollutionnpm · iniparserjs
- CVE-2020-23355** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** Codiad 2.8.4 /componetns/user/class.user.php:Authenticate() is vulnerable in magic hash authenticaPackagist · codiad/codiad
- CVE-2021-21278Risk of code injection in RSSHubnpm · rsshub
- CVE-2021-25864node-red-contrib-huemagic 3.0.0 is affected by hue/assets/..%2F Directory Traversal.in the res.sendFile API, used in file hue-magic.js, to fnpm · node-red-contrib-huemagic
- CVE-2020-36207An issue was discovered in the aovec crate through 2020-12-10 for Rust.crates.io · aovec
- CVE-2020-36219An issue was discovered in the atomic-option crate through 2020-10-31 for Rust.crates.io · atomic-option
- CVE-2021-25903An issue was discovered in the cache crate through 2021-01-01 for Rust.crates.io · cache
- CVE-2021-25908An issue was discovered in the fil-ocl crate through 2021-01-04 for Rust.crates.io · fil-ocl
- CVE-2020-8554Kubernetes man in the middle using LoadBalancer or ExternalIPsGo · k8s.io/kubernetes
- CVE-2020-22643Feehi CMS 2.1.0 is affected by an arbitrary file upload vulnerability, potentially resulting in remote code execution.Packagist · feehi/cms
- CVE-2020-35459An issue was discovered in ClusterLabs crmsh through 4.2.1.PyPI · crmsh
- CVE-2020-7784command_injectionnpm · ts-process-promises
- CVE-2020-7794Command Injectionnpm · buns
- CVE-2020-25476Liferay CMS Portal version 7.1.3 and 7.2.1 have a blind persistent cross-site scripting (XSS) vulnerability in the user name parameter to CaMaven · com.liferay.portal:release.portal.bom
- CVE-2019-25010An issue was discovered in the failure crate through 2019-11-13 for Rust.crates.io · failure
- CVE-2020-35860An issue was discovered in the cbox crate through 2020-03-19 for Rust.crates.io · cbox
- CVE-2020-35876An issue was discovered in the rio crate through 2020-05-11 for Rust.crates.io · rio