Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- CVE-2023-26109All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to impropenpm · node-bluetooth-serial-port
- CVE-2023-26110All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user inputnpm · node-bluetooth
- CVE-2023-1269Use of Hard-coded Credentials in alextselegidis/easyappointmentsPackagist · alextselegidis/easyappointments
- CVE-2023-24773Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.Packagist · funadmin/funadmin
- CVE-2023-24777Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.Packagist · funadmin/funadmin
- CVE-2023-24782Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.Packagist · funadmin/funadmin
- CVE-2023-24775Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.Packagist · funadmin/funadmin
- CVE-2023-24780Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns.Packagist · funadmin/funadmin
- CVE-2023-24781Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\MemberLevel.php.Packagist · funadmin/funadmin
- CVE-2023-26107All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrinpm · sketchsvg
- CVE-2023-26111All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to npm · @nubosoftware/node-static, node-static
- CVE-2023-26106All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.npm · dot-lens
- CVE-2022-4134A flaw was found in openstack-glance.PyPI · glance
- CVE-2023-24776Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.Packagist · funadmin/funadmin
- CVE-2023-24789jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.Maven · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2022-2835A flaw was found in coreDNS.Go · github.com/coredns/coredns
- CVE-2022-2837A flaw was found in coreDNS.Go · github.com/coredns/coredns
- CVE-2023-1160Use of Platform-Dependent Third Party Components in cockpit-hq/cockpitPackagist · cockpit-hq/cockpit
- CVE-2023-26105All versions of the package utilities are vulnerable to Prototype Pollution via the _mix function.npm · utilities
- CVE-2023-1081Cross-site Scripting (XSS) - Stored in microweber/microweberPackagist · microweber/microweber
- CVE-2023-1067Cross-site Scripting (XSS) - Stored in pimcore/pimcorePackagist · pimcore/pimcore
- CVE-2023-24249An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.Packagist · encore/laravel-admin
- CVE-2023-26104All versions of the package lite-web-server are vulnerable to Denial of Service (DoS) when an attacker sends an HTTP request and includes conpm · lite-web-server
- CVE-2023-26102All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function npm · rangy
- CVE-2023-0869Cross-site scripting in outage/list.htmMaven · org.opennms:opennms-web-api
- CVE-2022-36231pdf_info 0.5.3 is vulnerable to Command Execution because the Ruby code uses backticks instead of Open3.RubyGems · pdf_info
- CVE-2021-32853Erxes vulnerable to Cross-site Scriptingnpm · erxes
- CVE-2021-32854textAngular text editor vulnerable to Cross-site Scriptingnpm · textangular
- CVE-2021-32856Microweber vulnerable to Cross-site ScriptingPackagist · microweber/microweber
- CVE-2021-32859Baremetrics date range picker vulnerable to Cross-site Scriptingnpm · baremetrics-calendar