Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-35498A cross-site scripting (XSS) vulnerability in Grav v1.7.45 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.Packagist · getgrav/grav
- CVE-2024-46209A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute arbitrPackagist · redaxo/source
- CVE-2025-21609SiYuan has an arbitrary file deletion vulnerabilityGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-56199phpMyFAQ Vulnerable to Stored HTML Injection at FAQPackagist · phpmyfaq/phpmyfaq, thorsten/phpmyfaq
- CVE-2024-11184WP Enabled SVG <= 0.7 - Author+ Stored XSS via SVGPackagist · mwdelaney/wp-enable-svg
- CVE-2024-25133Openshift-dedicated: hive: rce through aws/kubernetes client configuration leads to privilege escalationGo · github.com/openshift/hive
- CVE-2024-56733Password Pusher Allows Session Token Interception Leading to Potential HijackingRubyGems · pwpush
- CVE-2024-56517LGSL has a reflected XSS at /lgsl_files/lgsl_list.phpPackagist · tltneon/lgsl
- CVE-2024-39025Incorrect access control in the /users endpoint of Cpacker MemGPT v0.3.17 allows attackers to access sensitive data.PyPI · letta
- CVE-2024-54774Dcat Admin v2.2.0-beta contains a cross-site scripting (XSS) vulnerability in /admin/articles/create.Packagist · dcat/laravel-admin
- CVE-2024-54775Dcat-Admin v2.2.0-beta and v2.2.2-beta contains a Cross-Site Scripting (XSS) vulnerability via /admin/auth/menu and /admin/auth/extensions.Packagist · dcat/laravel-admin
- CVE-2024-55186An IDOR (Insecure Direct Object Reference) vulnerability exists in oqtane Framework 6.0.0, allowing a logged-in user to access inbox messageNuGet · oqtane.client, oqtane.framework +2
- CVE-2024-55341A stored cross-site scripting (XSS) vulnerability in Piranha CMS 11.1 allows remote attackers to execute arbitrary JavaScript in the web broNuGet · piranha
- CVE-2024-55342A file upload functionality in Piranha CMS 11.1 allows authenticated remote attackers to upload a crafted PDF file to /manager/media.NuGet · piranha
- CVE-2024-55470Oqtane Framework 6.0.0 is vulnerable to Incorrect Access Control.NuGet · oqtane.framework, oqtane.server
- CVE-2024-55471Oqtane Framework is vulnerable to Insecure Direct Object Reference (IDOR) in Oqtane.Controllers.UserController.NuGet · oqtane.framework, oqtane.server
- CVE-2024-55196Insufficiently Protected Credentials in the Mail Server Configuration in GoPhish v0.12.1 allows an attacker to access cleartext passwords foGo · github.com/gophish/gophish
- CVE-2024-36694OpenCart 4.0.2.3 is vulnerable to Server-Side Template Injection (SSTI) via the Theme Editor Function.Packagist · opencart/opencart
- CVE-2024-55660SiYuan has an SSTI via /api/template/renderSprigGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55659SiYuan has an arbitrary file write in the host via /api/asset/uploadGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55658SiYuan has an arbitrary file read and path traversal via /api/export/exportResourcesGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55657SiYuan has an arbitrary file read via /api/template/renderGo · github.com/siyuan-note/siyuan/kernel
- CVE-2024-55587python-libarchive through 4.2.1 allows directory traversal (to create files) in extract in zip.py for ZipFile.extractall and ZipFile.extractPyPI · python-libarchive
- CVE-2024-55500Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the exnpm · whistle
- CVE-2024-53441An issue in the index.js decryptCookie function of cookie-encrypter v1.0.1 allows attackers to execute a bit flipping attack.npm · cookie-encrypter
- CVE-2024-12107Double Free in µD3TNPyPI · pyd3tn
- CVE-2024-39163binux pyspider up to v0.3.10 was discovered to contain a Cross-Site Request Forgery (CSRF) via the Flask endpoints.PyPI · pyspider
- CVE-2024-51210Firepad through 1.5.11 allows remote attackers, who have knowledge of a pad ID, to retrieve both the current text of a document and all contnpm · firepad
- CVE-2024-50948mochiMQTT v2.6.3 is vulnerable to Denial of Service (DoS) due to improper resource management.Go · github.com/mochi-mqtt/server
- CVE-2024-39162pyspider through 0.3.10 allows /update XSS.PyPI · pyspider