Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-35877An issue was discovered in the ozone crate through 2020-07-04 for Rust.crates.io · ozone
- CVE-2020-35878An issue was discovered in the ozone crate through 2020-07-04 for Rust.crates.io · ozone
- CVE-2020-35879An issue was discovered in the rulinalg crate through 2020-02-11 for Rust.crates.io · rulinalg
- CVE-2020-35880An issue was discovered in the bigint crate through 2020-05-07 for Rust.crates.io · bigint
- CVE-2020-35881An issue was discovered in the traitobject crate through 2020-06-01 for Rust.crates.io · traitobject
- CVE-2020-35885An issue was discovered in the alpm-rs crate through 2020-08-20 for Rust.crates.io · alpm-rs
- CVE-2020-35886An issue was discovered in the arr crate through 2020-08-25 for Rust.crates.io · arr
- CVE-2020-35887An issue was discovered in the arr crate through 2020-08-25 for Rust.crates.io · arr
- CVE-2020-35888An issue was discovered in the arr crate through 2020-08-25 for Rust.crates.io · arr
- CVE-2020-35889An issue was discovered in the crayon crate through 2020-08-31 for Rust.crates.io · crayon
- CVE-2020-35890An issue was discovered in the ordnung crate through 2020-09-03 for Rust.crates.io · ordnung
- CVE-2020-35891An issue was discovered in the ordnung crate through 2020-09-03 for Rust.crates.io · ordnung
- CVE-2020-35896An issue was discovered in the ws crate through 2020-09-25 for Rust.crates.io · ws
- CVE-2020-35900An issue was discovered in the array-queue crate through 2020-09-26 for Rust.crates.io · array-queue
- CVE-2020-35927An issue was discovered in the thex crate through 2020-12-08 for Rust.crates.io · thex
- CVE-2020-5809A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.NuGet · umbracocms.core
- CVE-2020-28283Prototype pollution vulnerability in 'libnested' versions 0.0.0 through 1.5.0 allows an attacker to cause a denial of service and may lead tnpm · libnested
- CVE-2020-28276Prototype pollution vulnerability in 'deep-set' versions 1.0.0 through 1.0.1 allows attacker to cause a denial of service and may lead to renpm · deep-set
- CVE-2020-29470OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Subject field of mail.Packagist · opencart/opencart
- CVE-2020-29471OpenCart 3.0.3.6 is affected by cross-site scripting (XSS) in the Profile Image.Packagist · opencart/opencart
- CVE-2020-35476A remote code execution vulnerability occurs in OpenTSDB through 2.4.0 via command injection in the yrange parameter.Maven · net.opentsdb:opentsdb
- CVE-2020-20136QuantConnect Lean versions from 2.3.0.0 to 2.4.0.1 are affected by an insecure deserialization vulnerability due to insecure configuration oNuGet · quantconnect.common
- CVE-2020-28439Command Injectionnpm · corenlp-js-prefab
- CVE-2020-28440Command Injectionnpm · corenlp-js-interface
- CVE-2020-28838Cross Site Request Forgery (CSRF) in CART option in OpenCart Ltd.Packagist · opencart/opencart
- CVE-2020-28274Prototype pollution vulnerability in 'deepref' versions 1.1.1 through 1.2.1 allows attacker to cause a denial of service and may lead to remnpm · deepref
- CVE-2020-25449Cross Site Scripting (XSS) vulnerability in Arachnys Cabot 0.11.12 can be exploited via the Address column.PyPI · cabot
- CVE-2020-5680Improper input validation vulnerability in EC-CUBE versions from 3.0.5 to 3.0.18 allows a remote attacker to cause a denial-of-service (DoS)Packagist · ec-cube/ec-cube
- CVE-2020-5679Improper restriction of rendered UI layers or frames in EC-CUBE versions from 3.0.0 to 3.0.18 leads to clickjacking attacks.Packagist · ec-cube/ec-cube
- CVE-2020-7779Regular Expression Denial of Service (ReDoS)npm · djvalidator