Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2024-2057LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgeryPyPI · langchain-community
- CVE-2023-52555In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.npm · mongo-express
- CVE-2024-22891Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.npm · nteract
- CVE-2024-2001Cross-Site Scripting vulnerability in Cockpit CMSPackagist · cockpit-hq/cockpit
- CVE-2024-22723Webtrees 2.1.18 is vulnerable to Directory Traversal.Packagist · fisharebest/webtrees
- CVE-2024-25169An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.PyPI · mezzanine
- CVE-2024-25170An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.PyPI · mezzanine
- CVE-2024-25399Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.Packagist · intelliants/subrion
- CVE-2024-26470A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackeNuGet · fullstackhero.webapi.boilerplate
- CVE-2024-1899Showdownjs Denial of Servicenpm · showdown
- CVE-2024-25874A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scPackagist · enhavo/enhavo-app
- CVE-2024-25875A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HPackagist · enhavo/enhavo-app
- CVE-2024-25876A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or HPackagist · enhavo/enhavo-app
- CVE-2024-1648electron-pdf 20.0.0 - Local File Read via Server Side XSSnpm · electron-pdf
- CVE-2024-1647pyhtml2pdf 0.0.6 - Local File Read via Server Side XSSPyPI · pyhtml2pdf
- CVE-2024-1651Torrentpier 2.4.1 - RCEPackagist · torrentpier/torrentpier
- CVE-2024-21493All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a CaddyfileGo · github.com/greenpau/caddy-security
- CVE-2024-21495Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure randGo · github.com/greenpau/caddy-security
- CVE-2024-21494All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For hGo · github.com/greenpau/caddy-security
- CVE-2024-21500All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts vGo · github.com/greenpau/caddy-security
- CVE-2024-21499All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due Go · github.com/greenpau/caddy-security
- CVE-2024-21498All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host heaGo · github.com/greenpau/caddy-security
- CVE-2024-21497Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect_url parameter.Go · github.com/greenpau/caddy-security
- CVE-2024-21492All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user sessioGo · github.com/greenpau/caddy-security
- CVE-2024-21496All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to iGo · github.com/greenpau/caddy-security
- CVE-2024-25298An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.moPackagist · redaxo/source
- CVE-2024-1439Inadequate access control vulnerability in MoodlePackagist · moodle/moodle
- CVE-2023-52430The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with eithGo · github.com/greenpau/caddy-security
- CVE-2024-23724Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profnpm · ghost
- CVE-2024-21490This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.npm · angular