Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2016-10683arcanist downloads resources over HTTP, which leaves it vulnerable to MITM attacks.npm · arcanist
- CVE-2016-10684healthcenter - IBM Monitoring and Diagnostic Tools health Center agent healthcenter downloads binary resources over HTTP, which leaves it vunpm · healthcenter
- CVE-2016-10685pk-app-wonderbox is an integration with wonderbox pk-app-wonderbox downloads binary resources over HTTP, which leaves it vulnerable to MITM npm · pk-app-wonderbox
- CVE-2016-10686fis-sass-all is another libsass wrapper for node.npm · fis-sass-all
- CVE-2016-10687windows-selenium-chromedriver is a module that downloads the Selenium Jar file.npm · windows-selenium-chromedriver
- CVE-2016-10688Haxe 3 : The Cross-Platform Toolkit (a fork from David Mouton's damoebius/haxe-npm) haxe3 downloads resources over HTTP, which leaves it vulnpm · haxe3
- CVE-2016-10689The windows-iedriver module downloads fixed version of iedriverserver.exe windows-iedriver downloads binary resources over HTTP, which leavenpm · windows-iedriver
- CVE-2016-10690openframe-ascii-image module is an openframe plugin which adds support for ascii images via fim.npm · openframe-ascii-image
- CVE-2016-10691windows-seleniumjar is a module that downloads the Selenium Jar file windows-seleniumjar downloads binary resources over HTTP, which leaves npm · windows-seleniumjar
- CVE-2016-10692haxeshim haxe shim to deal with coexisting versions.npm · haxeshim
- CVE-2016-10693pm2-kafka is a PM2 module that installs and runs a kafka server pm2-kafka downloads binary resources over HTTP, which leaves it vulnerable tnpm · pm2-kafka
- CVE-2018-11564Stored XSS in YOOtheme Pagekit 1.0.13 and earlier allows a user to upload malicious code via the picture upload feature.Packagist · pagekit/pagekit
- CVE-2016-10580nodewebkit is an installer for node-webkit.npm · nodewebkit
- CVE-2016-10581Steroids is PhoneGap on Steroids, providing native UI elements, multiple WebViews and enhancements for better developer productivity.npm · steroids
- CVE-2016-10582closurecompiler is a Closure Compiler for node.js.npm · closurecompiler
- CVE-2016-10583closure-utils is Utilities for Closure Library based projects.npm · closure-util
- CVE-2016-10585libxl provides Node bindings for the libxl library for reading and writing excel (XLS and XLSX) spreadsheets.npm · libxl
- CVE-2016-10587wasdk is a toolkit for creating WebAssembly modules.npm · wasdk
- CVE-2016-10592jser-stat is a JSer.info stat library.npm · jser-stat
- CVE-2016-10594ipip is a Node.js module to query geolocation information for an IP or domain, based on database by ipip.net.npm · ipip
- CVE-2016-10595jdf-sass is a fork from node-sass, jdf use only.npm · jdf-sass
- CVE-2016-10596imageoptim is a Node.js wrapper for some images compression algorithms.npm · imageoptim
- CVE-2016-10597cobalt-cli downloads resources over HTTP, which leaves it vulnerable to MITM attacks.npm · cobalt-cli
- CVE-2016-10598arrayfire-js is a module for ArrayFire for the Node.js platform.npm · arrayfire-js
- CVE-2016-10599sauce-connect is a Node.js wrapper over the SauceLabs SauceConnect.jar program for establishing a secure tunnel for intranet testing.npm · sauce-connect
- CVE-2016-10600webrtc-native uses WebRTC from chromium project.npm · webrtc-native
- CVE-2016-10603air-sdk is a NPM wrapper for the Adobe AIR SDK.npm · air-sdk
- CVE-2016-10604dalek-browser-chrome is Google Chrome bindings for DalekJS.npm · dalek-browser-chrome
- CVE-2016-10605dalek-browser-ie is Internet Explorer bindings for DalekJS.npm · dalek-browser-ie
- CVE-2016-10606grunt-webdriver-qunit is a grunt plugin to run qunit with webdriver in grunt grunt-webdriver-qunit downloads binary resources over HTTP, whinpm · grunt-webdriver-qunit