The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total53,693
Mitigations17,699
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
vm2<= 3.12.1
NPM: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
10
21 minutes ago
@graphql-tools/executor-legacy-ws<= 1.1.34
NPM: GraphQL Tools: TLS Certificate Validation Disabled in Legacy GraphQL WebSocket Executor
7.4
25 minutes ago
@graphql-tools/utils<= 12.0.0
NPM: GraphQL Tools has prototype pollution in well-established utility function `mergeDeep`
8.2
25 minutes ago
snowflake-sdk< 3.3.0
NPM: Snowflake drivers writes sensitive information to logs
6.5
26 minutes ago
postcss-selector-parser< 7.1.6
NPM: PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion
5.9
28 minutes ago
@angular/ssr<= 19.2.27
NPM: Angular SSR: Path Traversal to Sibling Directories in CommonEngine on Windows
6.3
28 minutes ago
@capacitor/ios>= 6.0.0, < 6.2.2
NPM: Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
9.3
28 minutes ago
@capacitor/android>= 6.0.0, < 6.2.2
NPM: Capacitor Android and iOS: remote content can be loaded at the app origin via the internal HTTP proxy path
9.3
28 minutes ago
@opentelemetry/instrumentation-pg< 0.73.0
NPM: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
5.8
29 minutes ago
@opentelemetry/instrumentation-mysql2< 0.67.0
NPM: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
5.8
29 minutes ago
@opentelemetry/instrumentation-knex< 0.65.0
NPM: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
5.8
29 minutes ago
@opentelemetry/instrumentation-mysql< 0.67.0
NPM: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
5.8
29 minutes ago
@opentelemetry/instrumentation-mongoose< 0.67.0
NPM: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
5.8
29 minutes ago
@opentelemetry/instrumentation-oracledb< 0.46.0
NPM: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
5.8
29 minutes ago
@opentelemetry/instrumentation-tedious< 0.40.0
NPM: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
5.8
29 minutes ago
@opentelemetry/instrumentation-cassandra-driver< 0.66.0
NPM: Multiple @opentelemetry/instrumentation-* packages expose database username via unconditional db.user span attribute
5.8
29 minutes ago
fast-copy< 2.2.0
NPM: fast-copy: Stack exhaustion in fast-copy when copying deeply-nested values
6.3
29 minutes ago
@vue/server-renderer< 3.5.42
NPM: @vue/server-renderer: XSS via missing CR in attribute-name blacklist
7.2
31 minutes ago
tinypool<= 2.1.0
NPM: Tinypool: Prototype Pollution gadget in worker options leads to Remote Code Execution
9.5
31 minutes ago
tinypool< 2.1.2
NPM: Tinypool: Prototype Pollution Gadget to RCE in run() options
9.5
32 minutes ago