Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-38991akbr patch-into v1.0.1 was discovered to contain a prototype pollution via the function patchInto.npm · @akbr/patch-into
- CVE-2024-38992airvertco frappejs v0.0.11 was discovered to contain a prototype pollution via the function registerView.npm · @airvertco/frappejs
- CVE-2024-38994amoyjs amoy common v1.0.10 was discovered to contain a prototype pollution via the function extend.npm · @amoy/common
- CVE-2024-38997adolph_dudu ratio-swiper v0.0.2 was discovered to contain a prototype pollution via the function extendDefaults.npm · @adolph_dudu/ratio-swiper
- CVE-2024-39018harvey-woo cat5th/key-serializer v0.2.5 was discovered to contain a prototype pollution via the function "query".npm · @cat5th/key-serializer
- CVE-2024-39236Gradio v4.36.1 was discovered to contain a code injection vulnerability via the component /gradio/component_meta.py.PyPI · gradio
- CVE-2024-6139Path Traversal in parisneo/lollmsPyPI · lollms
- CVE-2024-6085Path Traversal in parisneo/lollmsPyPI · lollms
- CVE-2024-5822Server-Side Request Forgery (SSRF) in gaizhenbiao/ChuanhuChatGPTPyPI · chuanhuchatgpt
- CVE-2024-6038ReDoS Vulnerability in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-6090Path Traversal Vulnerability in gaizhenbiao/chuanhuchatgptPyPI · chuanhuchatgpt
- CVE-2024-5826Remote Code Execution via Prompt Injection in vanna-ai/vannaPyPI · vanna
- CVE-2024-5979Denial of Service via Invalid Argument in h2oai/h2o-3PyPI · h2o
- CVE-2024-37843Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint.Packagist · craftcms/cms
- CVE-2024-3121Remote Code Execution in create_conda_env function in parisneo/lollmsPyPI · lollms
- CVE-2024-4940Open Redirect in gradio-app/gradioPyPI · gradio
- CVE-2024-21516This affects versions of the package opencart/opencart from 4.0.0.0 and before 4.1.0.0.Packagist · opencart/opencart
- CVE-2024-21519This affects versions of the package opencart/opencart from 4.0.0.0.Packagist · opencart/opencart
- CVE-2024-21514This affects versions of the package opencart/opencart from 0.0.0.Packagist · opencart/opencart
- CVE-2024-21518This affects versions of the package opencart/opencart from 4.0.0.0.Packagist · opencart/opencart
- CVE-2024-21517This affects versions of the package opencart/opencart from 4.0.0.0.Packagist · opencart/opencart
- CVE-2024-21515This affects versions of the package opencart/opencart from 4.0.0.0.Packagist · opencart/opencart
- CVE-2024-28397An issue in the component js2py.disable_pyimport() of js2py up to v0.74 allows attackers to execute arbitrary code via a crafted API call.PyPI · js2py
- CVE-2024-37818Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image.npm · @strapi/strapi
- CVE-2024-38358Symlink bypasses filesystem sandbox in wasmercrates.io · wasmer
- CVE-2024-5899Improper trust check in Bazel Build intellij pluginGo · github.com/bazelbuild/intellij
- CVE-2024-36543Incorrect access control in the Kafka Connect REST API in the STRIMZI Project 0.41.0 and earlier allows an attacker to deny the service for Maven · io.strimzi:strimzi
- CVE-2024-36574A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-jsonpm · @allanlancioni/flatten-json
- CVE-2024-36578akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.npm · @akbr/update
- CVE-2024-36580A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.npm · @cdr0/sg