Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2020-7727Prototype Pollutionnpm · gedi
- CVE-2020-7723Prototype Pollutionnpm · promisehelpers
- CVE-2020-7724Prototype Pollutionnpm · tiny-conf
- CVE-2020-7721Prototype Pollutionnpm · node-oojs
- CVE-2020-7717Prototype Pollutionnpm · dot-notes
- CVE-2020-7718Prototype Pollutionnpm · gammautils
- CVE-2020-7714Prototype Pollutionnpm · confucious
- CVE-2020-7716Prototype Pollutionnpm · deeps
- CVE-2020-7713Prototype Pollutionnpm · arr-flatten-unflatten
- CVE-2020-13828Dolibarr 11.0.4 is affected by multiple stored Cross-Site Scripting (XSS) vulnerabilities that could allow remote authenticated attackers toPackagist · dolibarr/dolibarr
- CVE-2020-14042** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Site Scripting (XSS) vulnerability was found in Codiad v1.7.8 and later.Packagist · codiad/codiad
- CVE-2020-14043** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Cross Side Request Forgery (CSRF) vulnerability was found in Codiad v1.7.8 and later.Packagist · codiad/codiad
- CVE-2020-14044** PRODUCT NOT SUPPORTED WHEN ASSIGNED ** A Server-Side Request Forgery (SSRF) vulnerability was found in Codiad v1.7.8 and later.Packagist · codiad/codiad
- CVE-2020-7710Sandbox Escapenpm · safe-eval
- CVE-2020-7703Prototype Pollutionnpm · nis-utils
- CVE-2020-7702Prototype Pollutionnpm · templ8
- CVE-2020-7700Prototype Pollutionnpm · phpjs
- CVE-2020-7697Command Injectionnpm · mock2easy
- CVE-2020-7685Insecure DefaultsNuGet · umbracoforms
- CVE-2020-7687Directory Traversalnpm · fast-http
- CVE-2020-7686Directory Traversalnpm · rollup-plugin-server
- CVE-2020-7681Directory Traversalnpm · marscode
- CVE-2020-7682Directory Traversalnpm · marked-tree
- CVE-2020-7683Directory Traversalnpm · rollup-plugin-server
- CVE-2020-9664Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a php object injection vulnerability.Packagist · magento/core
- CVE-2020-9665Magento versions 1.14.4.5 and earlier, and 1.9.4.5 and earlier have a stored cross-site scripting vulnerability.Packagist · magento/core
- CVE-2020-9309Silverstripe CMS through 4.5 can be susceptible to script execution from malicious upload contents under allowed file extensions (for examplPackagist · silverstripe/cms
- CVE-2020-15779A Path Traversal issue was discovered in the socket.io-file package through 2.0.31 for Node.js.npm · socket.io-file
- CVE-2020-2219Jenkins Link Column Plugin 1.0 and earlier does not filter URLs of links created by users with View/Configure permission, resulting in a stoMaven · org.jenkins-ci.plugins:link-column
- CVE-2020-2216A missing permission check in Jenkins Zephyr for JIRA Test Management Plugin 1.5 and earlier allows attackers with Overall/Read permission tMaven · org.jenkins-ci.plugins:zephyr-for-jira-test-management