Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-10455Reachable Assertion in µD3TNPyPI · pyd3tn
- CVE-2024-39205An issue in pyload-ng v0.5.0b3.dev85 running under python3.11 or below allows attackers to execute arbitrary code via a crafted HTTP requestPyPI · pyload-ng
- CVE-2020-26311GHSL-2020-312: Regular Expression Denial of Service (ReDoS) in useragentnpm · useragent
- CVE-2020-26308GHSL-2020-302: Regular Expression Denial of Service (ReDoS) in validate.jsnpm · validate.js
- CVE-2020-26306GHSL-2020-296: Regular Expression Denial of Service (ReDoS) in Knwl.jsnpm · knwl.js
- CVE-2020-26305GHSL-2020-291: Regular Expression Denial of Service (ReDoS) in CommonRegexJSnpm · commonregex
- CVE-2020-26304GHSL-2020-290: Regular Expression Denial of Service (ReDoS) in foundation-sitesnpm · foundation-sites
- CVE-2020-26303GHSL-2020-289: Regular Expression Denial of Service (ReDoS) in insanenpm · insane
- CVE-2023-26248The Kademlia DHT (go-libp2p-kad-dht 0.20.0 and earlier) used in IPFS (0.18.1 and earlier) assigns routing information for content (i.e., infGo · github.com/libp2p/go-libp2p-kad-dht
- CVE-2024-48218Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/list.Packagist · funadmin/funadmin
- CVE-2024-48222Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/edit.Packagist · funadmin/funadmin
- CVE-2024-48223Funadmin v5.0.2 has a SQL injection vulnerability in /curd/table/fieldlist.Packagist · funadmin/funadmin
- CVE-2024-48224Funadmin v5.0.2 has an arbitrary file read vulnerability in /curd/index/editfile.Packagist · funadmin/funadmin
- CVE-2024-48225Funadmin v5.0.2 has an arbitrary file deletion vulnerability in /curd/index/delfile.Packagist · funadmin/funadmin
- CVE-2024-48226Funadmin 5.0.2 is vulnerable to SQL Injection in curd/table/savefield.Packagist · funadmin/funadmin
- CVE-2024-48227Funadmin 5.0.2 has a logical flaw in the Curd one click command deletion function, which can result in a Denial of Service (DOS).Packagist · funadmin/funadmin
- CVE-2024-48228An issue was found in funadmin 5.0.2.Packagist · funadmin/funadmin
- CVE-2024-48229funadmin 5.0.2 has a SQL injection vulnerability in the Curd one click command mode plugin.Packagist · funadmin/funadmin
- CVE-2024-48230funadmin 5.0.2 is vulnerable to SQL Injection via the parentField parameter in the index method of \backend\controller\auth\Auth.php.Packagist · funadmin/funadmin
- CVE-2024-45031Apache Syncope: Stored XSS in Console and EnduserMaven · org.apache.syncope.client:syncope-client-console
- CVE-2024-48423An issue in assimp v.5.4.3 allows a local attacker to execute arbitrary code via the CallbackToLogRedirector function within the Assimp librPyPI · pyassimp
- CVE-2024-48424A heap-buffer-overflow vulnerability has been identified in the OpenDDLParser::parseStructure function within the Assimp library, specificalPyPI · pyassimp
- CVE-2024-48425A segmentation fault (SEGV) was detected in the Assimp::SplitLargeMeshesProcess_Triangle::UpdateNode function within the Assimp library duriPyPI · pyassimp
- CVE-2024-48426A segmentation fault (SEGV) was detected in the SortByPTypeProcess::Execute function in the Assimp library during fuzz testing with AddressSPyPI · pyassimp
- CVE-2024-50312Graphql: information disclosure via graphql introspection in openshiftGo · github.com/openshift/console
- CVE-2024-48652Cross Site Scripting vulnerability in camaleon-cms v.2.7.5 allows remote attacker to execute arbitrary code via the content group name fieldRubyGems · camaleon_cms
- CVE-2024-8901Lack of JWT issuer and signer validationGo · github.com/awslabs/aws-alb-route-directive-adapter-for-istio
- CVE-2024-48231Funadmin 5.0.2 is vulnerable to SQL Injection via the selectFields parameter in the index method of \backend\controller\auth\Auth.php.Packagist · funadmin/funadmin
- CVE-2024-46212An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.Packagist · redaxo/source
- CVE-2024-6971Path Traversal in parisneo/lollms-webuiPyPI · lollms