The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,861
Mitigations18,585
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
systeminformation< 5.33.16
npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
7.8
7 hours ago
@backstage/plugin-catalog-backend< 3.9.2
npm: Backstage catalog rules can be bypassed for URL locations using encoded path segments
6.5
7 hours ago
@waline/vercel<= 1.40.3
npm: Waline login accepts a non-string email as a match-all MongoDB query
6.5
8 hours ago
seroval>= 1.6.0, < 1.6.11
npm: Seroval: Code injection through a typed array's own constructor property
5.3
8 hours ago
seroval< 1.0.0
npm: Seroval: Script injection through RegExp sources in serialized output
4.7
8 hours ago
seroval<= 1.6.7
npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
7.5
8 hours ago
seroval>= 1.4.1, <= 1.6.7
npm: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
7.5
8 hours ago
seroval<= 1.6.7
npm: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
7.3
8 hours ago
mem0ai< 3.1.6
npm: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
6.3
8 hours ago
systeminformation< 5.33.14
npm: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
3.3
8 hours ago
systeminformation< 5.33.13
npm: systeminformation has prototype pollution in `networkStats()` via the interface name
6.5
8 hours ago
graphql-scalars<= 2.0.0
npm: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
7.5
8 hours ago
i18next-http-backend< 4.0.4
npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
3.7
8 hours ago
re2js>= 2.2.0, < 2.8.7
npm: RE2JS: Quadratic-time denial of service in re2js lookbehind matching
7.5
8 hours ago
i18next-http-backend< 4.0.3
npm: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)
3.1
8 hours ago
happy-dom<= 20.14.6
npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
8.6
9 hours ago
@intlify/vue-i18n-core>= 9.2.0-alpha.7, < 11.4.14
npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
2.1
9 hours ago
petite-vue-i18n>= 9.2.0-alpha.7, < 11.4.14
npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
2.1
9 hours ago
@intlify/core-base>= 9.0.0-beta.12, < 11.4.14
npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
2.1
9 hours ago
@intlify/core>= 9.0.0-beta.10, < 11.4.14
npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
2.1
9 hours ago