Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-25354RegEx Denial of Service in domain-suffix 1.0.8 allows attackers to crash the application via crafted input to the parse function.npm · domain-suffix
- CVE-2024-29644Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script Packagist · dcat/laravel-admin
- CVE-2024-1603confirmedPyPI · paddlepaddle
- CVE-2024-28593The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leadsPackagist · moodle/moodle
- CVE-2024-29338Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.Packagist · anchorcms/anchor-cms
- CVE-2024-29499Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2.Packagist · anchorcms/anchor-cms
- CVE-2024-29374A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.Packagist · moodle/moodle
- CVE-2023-41877GeoServer log file path traversal vulnerabilityMaven · org.geoserver:gs-main
- CVE-2024-28125FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands.Maven · org.fitnesse:fitnesse
- CVE-2024-2497RaspAP raspap-webgui HTTP POST Request provider.php code injectionPackagist · billz/raspap-webgui
- CVE-2024-28423Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py.PyPI · airflow-diagrams
- CVE-2024-28425greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py.PyPI · greykite
- CVE-2023-49785NextChat vulnerable to Server-Side Request Forgery and Cross-site Scriptingnpm · nextchat
- CVE-2024-2319Cross-Site Scripting vulnerability in Django MarkdownXPyPI · django-markdownx
- CVE-2024-0818Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6PyPI · paddlepaddle
- CVE-2024-0917remote code execution in paddlepaddle/paddle 2.6.0PyPI · paddlepaddle
- CVE-2023-48703SAML authentication bypass vulnerability in RobotsAndPencils/go-samlGo · github.com/robotsandpencils/go-saml
- CVE-2024-28160Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scriptingMaven · org.jenkins-ci.plugins:icescrum
- CVE-2024-28159A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permissionMaven · org.jenkins-ci.plugins:svn-partial-release-mgr
- CVE-2024-28158A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers toMaven · org.jenkins-ci.plugins:svn-partial-release-mgr
- CVE-2024-28157Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vMaven · org.jenkins-ci.plugins:gitbucket
- CVE-2024-28156Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-Maven · org.jenkins-ci.plugins:build-monitor-plugin
- CVE-2024-2216A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permiMaven · org.jenkins-ci.plugins:docker-build-step
- CVE-2024-2215A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attMaven · org.jenkins-ci.plugins:docker-build-step
- CVE-2024-2056Artica Proxy Loopback Services Remotely Accessible UnauthenticatedGo · github.com/gvalkov/tailon
- CVE-2024-22889Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crPyPI · plone
- CVE-2024-25865Cross Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia senpm · hexo-theme-anzhiyu
- CVE-2024-27138Apache Archiva: disabling user registration is not effectiveMaven · org.apache.archiva:archiva
- CVE-2024-27139Apache Archiva: incorrect authentication potentially leading to account takeoverMaven · org.apache.archiva:archiva
- CVE-2024-27140Apache Archiva: reflected XSSMaven · org.apache.archiva:archiva-common