The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,300
Mitigations18,329
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@fallow-cli/fallow-node< 3.34.0
npm: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
3.3
5 minutes ago
fallow< 3.34.0
npm: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
3.3
5 minutes ago
@fallow-cli/fallow-node>= 2.68.0, < 3.34.0
npm: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
3.3
6 minutes ago
fallow>= 2.68.0, < 3.34.0
npm: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
3.3
6 minutes ago
postal-mime>= 3.0.0, < 4.0.8
npm: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
7.5
9 minutes ago
nodemailer>= 3.0.0, < 10.1.4
npm: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
6.5
10 minutes ago
nodemailer>= 3.0.0, < 10.1.4
npm: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
6.5
11 minutes ago
nodemailer>= 3.0.0, < 10.1.4
npm: Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
6.5
12 minutes ago
fast-uri< 2.4.8
npm: fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
6.1
22 minutes ago
fast-uri< 2.4.8
npm: fast-uri vulnerable to improper path equivalence in relative reference normalization
3.7
24 minutes ago
fast-uri>= 2.4.2, < 2.4.8
npm: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
4.8
25 minutes ago
fast-uri< 2.4.8
npm: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
3.7
27 minutes ago
@sveltejs/kit< 3.0.0
npm: SvelteKit: URL redirection to untrusted site via enhanced form submission
4.7
1 hour ago
odf-kit>= 0.9.8, < 0.14.2
npm: odf-kit has HTML injection leading to XSS in odsToHtml() via unescaped style attribute values
6.1
1 hour ago
electron< 42.11.16
npm: Electron: Mitigation for compromised eMudhra intermediate certificates
7.4
1 hour ago
body-parser< 1.20.9
npm: body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body
7.5
1 hour ago
@strands-agents/sdk< 1.5.0
npm: Strands Agents SDK: Exposure of data element to wrong session in the A2A Server
8.1
1 hour ago
@sveltejs/kit< 3.0.0
npm: SvelteKit : XSS via untrusted cache-control header in prerendered page
2.3
1 hour ago
obsidian-tc>= 1.0.1, <= 1.31.3
npm: obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
7.1
3 hours ago
obsidian-tc< 1.3.1
npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback
9.6
3 hours ago