@udecode/plate (>=36.0.0, <=36.0.9), @udecode/plate-serializer-docx (>=36.0.0, <=36.0.9) potentially affected by CVE-2024-40631 via @udecode/plate-media (36.0.0)

@udecode/plate-media NPM version 36.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on @udecode/plate-media and may be impacted: - @udecode/plate =36.0.0, =36.0.0, =36.0.9 Source cves: CVE-2024-40631 Source advisory: OSV:GHSA-H3PQ-667X-R789...

Malicious code in transitive-vulnerability-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94b6b18dfb31ebb3155a17b612cec91c947ae2da8b9be46c3e172b779fa40e99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7758 Malicious code in transitive-vulnerability-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94b6b18dfb31ebb3155a17b612cec91c947ae2da8b9be46c3e172b779fa40e99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@a-type/ui (>=0.8.17, <=1.2.3), @adminjs/design-system (>=3.0.0-beta.4, <=3.1.1) +427 more potentially affected by unknown CVE via prosemirror-model (>=1.0.1, <=1.21.3)

prosemirror-model NPM version =1.0.1, =0.8.17, =3.0.0-beta.4, =0.1.0, =0.0.1, =13.1.0, =10.4.0, =0.0.2, =3.0.0, =16.0.0, =0.0.1, =3.1.7, =11.0.6, =4.0.13, =73.4.4, =194.4.0 and more Source cves: unknown CVE Source advisory: SNYK:JS-PROSEMIRRORMODEL-7838221...

01.webpack-study (1.0.0), 0226 (1.0.0) +3320 more potentially affected by CVE-2024-6485 via bootstrap (>=3.1.1, <=3.4.1)

bootstrap NPM version =3.1.1, =0.1.0, =4.13.7-rc4, =3.0.1, =3.0.4, =0.0.0-ad-beta.1, =0.0.0-aj-alpha.9, =0.0.2, =0.3.6, =0.4.35 and more Source cves: CVE-2024-6485 Source advisory: OSV:GHSA-VXMC-5X29-H64V...

actix-session-surrealdb (>=0.1.0, <=0.1.5), bb8-surrealdb (>=0.1.0, <=0.1.3) +2 more potentially affected by CVE-2024-58363 via surrealdb (1.0.0-beta.9)

surrealdb CARGO version 1.0.0-beta.9 is affected by a known vulnerability. The following packages have a transitive dependency on surrealdb and may be impacted: - actix-session-surrealdb =0.1.0, =0.1.0, =0.1.0, =0.1.1 Source cves: CVE-2024-58363 Source advisory: OSV:GHSA-GH9F-6XM2-C4J2...

3abn (>=1.0.0, <=2.1.11), @2003scape/rsc-sounds (>=1.0.0, <=1.0.1) +380 more potentially affected by CVE-2024-21526 via speaker (>=0.0.10, <=0.5.5)

speaker NPM version =0.0.10, =1.0.0, =1.0.0, =1.0.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =1.0.0, =0.1.0, =1.0.0, =0.1.0, =0.1.5 and more Source cves: CVE-2024-21526 Source advisory: OSV:GHSA-W5FC-GJ3H-26RX...

08cms (1.0.0), @artdotstyle/filepix (>=1.0.10, <=1.0.11) +327 more potentially affected by CVE-2024-21523 via images (>=3.0.0, <=3.2.4)

images NPM version =3.0.0, =1.0.10, =1.1.2, =0.0.1, =0.1.0, =1.0.1, =1.4.0, =1.1.2, =1.1.8, =0.4.0, =0.6.2 and more Source cves: CVE-2024-21523 Source advisory: OSV:GHSA-VJPV-X8P9-7P85...

@persistr/cli (>=2.7.1, <=2.9.1), spidersharkcli (>=0.0.4, <=0.0.8) potentially affected by CVE-2024-21524 via node-stringbuilder (2.2.7)

node-stringbuilder NPM version 2.2.7 is affected by a known vulnerability. The following packages have a transitive dependency on node-stringbuilder and may be impacted: - @persistr/cli =2.7.1, =0.0.4, =0.0.8 Source cves: CVE-2024-21524 Source advisory: OSV:GHSA-G533-XQ5W-JMF3...

24-hr-music (1.0.3), 2pg-music (>=1.0.0, <=1.1.2) +151 more potentially affected by CVE-2024-21521 via @discordjs/opus (>=0.1.0, <=0.8.0)

@discordjs/opus NPM version =0.1.0, =1.0.0, =1.1.2, =1.0.0, =1.0.3, =1.0.1, =1.0.0, =0.1.0, =1.0.0, =1.0.0, =1.0.1 and more Source cves: CVE-2024-21521 Source advisory: OSV:GHSA-43WQ-XRCM-3VGR...

@ascua/app (>=0.1.0, <=0.4.6), @itsfe/electron-bootstrap (>=1.0.0, <=1.0.1) +7 more potentially affected by CVE-2024-39698 via electron-updater (>=6.0.2, <=6.2.1)

electron-updater NPM version =6.0.2, =0.1.0, =1.0.0, =0.11.11-dev.1, =0.0.0-snapshot-20240316121210, =2024.4.146, =2024.10.110 Source cves: CVE-2024-39698 Source advisory: OSV:GHSA-9JXC-QJR9-VJXQ...

@angular-devkit/build-angular (>=18.0.0-next.4, <=18.1.0-next.2), @angular/build (>=18.0.0-next.3, <=18.1.0-next.2) +64 more potentially affected by CVE-2024-38372 via undici (>=6.14.1, <=6.19.1)

undici NPM version =6.14.1, =18.0.0-next.4, =18.0.0-next.3, =1.2.0, =0.1.0, =2.1.0, =2.3.0, =1.1.1, =19.1.0, =10.0.20, =1.0.12, =2.1.1-dev.1717589072-346d1be72, =2.4.0-dev.1717589083-346d1be72, =2.4.0-dev.1724328261-ec9080b88 - @draftbot/discord.js 14.15.3 - @draftbot/rest 2.3.0 and more Source...

@directus/api (>=15.0.0, <=19.3.1), @meta-factory/cms (0.1.1) +6 more potentially affected by CVE-2024-39896 via directus (>=9.21.2, <=10.12.1)

directus NPM version =9.21.2, =15.0.0, =0.1.0, =1.2.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2024-39896 Source advisory: OSV:GHSA-JGF4-VWC3-R46V...

ayaka-model (0.2.0), ayaka-runtime (0.2.0) +16 more potentially affected by unknown CVE via zerovec-derive (>=0.6.0, <=0.8.0)

zerovec-derive CARGO version =0.6.0, =0.6.0, =1.0.0-beta1 - icuproviderblob 1.0.0-beta1 - icusegmenter 1.0.0-alpha1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-74R5-G7VC-J2V2...

@meta-factory/cms (0.1.1), @wep2/editor-dev (1.0.0) +4 more potentially affected by CVE-2024-39701 via directus (9.26.0)

directus NPM version 9.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on directus and may be impacted: - @meta-factory/cms 0.1.1 - @wep2/editor-dev 1.0.0 - dbaas =0.1.0, =1.0.1, =1.0.0, =1.0.75 - nuxtus-server 1.0.0 Source cves: CVE-2024-39701 Sourc...

ayaka-model (0.2.0), ayaka-runtime (0.2.0) +26 more potentially affected by unknown CVE via zerovec (>=0.2.3, <=0.8.1)

zerovec CARGO version =0.2.3, =0.3.0, =0.6.0, =1.0.0-beta1 and more Source cves: unknown CVE Source advisory: OSV:GHSA-XRV3-JMCP-374J...

directus (>=10.9.1, <=10.9.2) potentially affected by CVE-2024-39699 via @directus/api (>=17.0.0, <=17.0.1)

@directus/api NPM version =17.0.0, =10.9.1, =10.9.2 Source cves: CVE-2024-39699 Source advisory: OSV:GHSA-8P72-RCQ4-H6PW...

apikit (>=0.1.0, <=0.2.0), apisdk (>=0.0.1, <=0.0.5) +138 more potentially affected by unknown CVE via opentelemetry_api (>=0.1.0, <=0.20.0)

opentelemetryapi CARGO version =0.1.0, =0.1.0, =0.0.1, =0.8.1, =0.3.0, =4.0.15, =0.1.0, =0.1.0, =0.1.0, =0.1.1, =0.4.0-rc.1, =0.5.0, =0.1.0, =6.6.4, =0.6.1, =0.8.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0387...

async-mongodb-session (2.1.0), chord-action (>=0.1.13, <=0.1.16) +7 more potentially affected by CVE-2024-6382 via mongodb (>=2.0.0-alpha, <=2.6.1)

mongodb CARGO version =2.0.0-alpha, =0.1.13, =0.1.13, =0.1.13, =0.2.1, =0.3.2 - mongodb-gridfs 0.2.0 - rocketauthifier 0.111.0 - sqlite2mongo 0.3.0 Source cves: CVE-2024-6382 Source advisory: OSV:GHSA-32JF-H775-G29H...

@nokecy/qc-ui (>=0.4.7, <=0.9.6), ag-grid-charts-enterprise (32.0.0) +3 more potentially affected by CVE-2024-39001 via ag-grid-community (32.0.0)

ag-grid-community NPM version 32.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on ag-grid-community and may be impacted: - @nokecy/qc-ui =0.4.7, =0.9.6 - ag-grid-charts-enterprise 32.0.0 - ag-grid-enterprise 32.0.0 - ag-grid-react 32.0.0 -...