@tinyjs/tiny (1.6.6), @trezor/connect (>=9.0.0-beta.1, <=9.0.7) +2 more potentially affected by CVE-2024-36751 via parse-uri (>=1.0.3, <=1.0.7)

parse-uri NPM version =1.0.3, =9.0.0-beta.1, =9.0.0-beta.1, =0.2.0, =0.6.0 Source cves: CVE-2024-36751 Source advisory: OSV:GHSA-6FX8-H7JM-663J...

alerter (>=0.3.0, <=0.3.1), maruc (0.1.0) +9 more potentially affected by CVE-2024-52813 via matrix-sdk-crypto (>=0.1.0, <=0.5.0)

matrix-sdk-crypto CARGO version =0.1.0, =0.3.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.10-alpha, =0.13.0, =0.13.1 Source cves: CVE-2024-52813 Source advisory: OSV:GHSA-R5VF-WF4H-82GG...

@acronis-platform/ui-component-library (1.33.0), @aesoper/i18n (>=1.0.56, <=1.0.57) +27 more potentially affected by CVE-2024-52809 via vue-i18n (>=10.0.0, <=10.0.4)

vue-i18n NPM version =10.0.0, =1.0.56, =1.0.0, =0.0.16, =2.4.8, =3.0.0, =4.0.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.12.0 and more Source cves: CVE-2024-52809 Source advisory: OSV:GHSA-9R9M-FFP6-9X4V...

bounded-prescience (0.0.3), chainer-chemistry (0.7.1) +21 more potentially affected by CVE-2024-48206 via chainer (>=6.0.0, <=7.8.1)

chainer PYPI version =6.0.0, =0.1.0, =0.2.0, =0.3.0, =0.0.1, =0.1.0, =0.6.1, =0.2.0, =0.6.0.post1, =1.3.1rc2, =2024.0.0, =2024.0.1 and more Source cves: CVE-2024-48206 Source advisory: SNYK:PYTHON-CHAINER-8340635...

typedb-protocol (>=3.0.0-alpha-2, <=3.0.0-alpha-7) potentially affected by CVE-2024-47609 via tonic (0.12.2)

tonic CARGO version 0.12.2 is affected by a known vulnerability. The following packages have a transitive dependency on tonic and may be impacted: - typedb-protocol =3.0.0-alpha-2, =3.0.0-alpha-7 Source cves: CVE-2024-47609 Source advisory: OSV:GHSA-4JWC-W2HC-78QV...

GHSA-GMC6-FWG3-75M5 Mimekit has vulnerable dependency that can lead to denial of service

Summary Denial of service vulnerability. Details See: https://github.com/advisories/GHSA-447r-wph3-92pm and https://github.com/dotnet/announcements/issues/312 PoC Update System.Security.Cryptography.Pkcs to 8.0.1 so that the transitive dependency with the issue gets updated Impact Denial of servi...

atuin (>=0.3.0, <=11.0.0), atuin-client (>=0.6.2, <=11.0.0) +27 more potentially affected by unknown CVE via chrono-english (0.1.8)

chrono-english CARGO version 0.1.8 is affected by a known vulnerability. The following packages have a transitive dependency on chrono-english and may be impacted: - atuin =0.3.0, =0.6.2, =0.6.2, =0.1.0, =1.9.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.4.2, =0.4.0, =0.7.0, =0.0.4, =1.0.0 and more Sourc...

@brbb/bot-farm-ts (>=0.0.1, <=0.0.3), @phantasia/blockchain-interface (>=3.6.10, <=5.0.0) +3 more potentially affected by CVE-2024-30253 via @solana/web3.js (>=1.47.2, <=1.47.3)

@solana/web3.js NPM version =1.47.2, =0.0.1, =3.6.10, =1.13.2, =1.0.0, =0.3.53, =0.3.54 Source cves: CVE-2024-30253 Source advisory: OSV:GHSA-8M45-2RJM-J347...

aide (>=0.1.0, <=0.4.3), bpxe (>=0.1.0, <=0.1.2) +66 more potentially affected by unknown CVE via linkme (>=0.1.6, <=0.2.10)

linkme CARGO version =0.1.6, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2-alpha, =0.0.2-alpha, =0.0.4-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0407...

org.webjars:angular-markdown-directive (0.3.0) potentially affected by CVE-2024-1899 via org.webjars:showdown (0.3.1)

org.webjars:showdown MAVEN version 0.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.webjars:showdown and may be impacted: - org.webjars:angular-markdown-directive 0.3.0 Source cves: CVE-2024-1899 Source advisory: SNYK:JAVA-ORGWEBJARS-8685134...

node-js-1408 (1.0.0), node-js-1409 (1.0.0) potentially affected by CVE-2023-39619 via node-email-check (1.0.4)

node-email-check NPM version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on node-email-check and may be impacted: - node-js-1408 1.0.0 - node-js-1409 1.0.0 Source cves: CVE-2023-39619 Source advisory: OSV:GHSA-9242-6P36-6256...

@dweb-browser/desktop (0.1.2), @dweb-browser/js-process (0.1.2) +25 more potentially affected by CVE-2023-39956 via electron (>=25.0.0-beta.1, <=25.4.0)

electron NPM version =25.0.0-beta.1, =1.0.0, =1.0.0, =0.6.0, =0.6.3 - electron-proxy-example 1.0.0 - electronim 0.0.93 - firedev 16.444.5 - firedev-class-helpers 16.444.4 - firedev-config 16.444.4 - firedev-core 16.444.5 - firedev-logger 16.444.4 - firedev-rest 16.444.3 - firedev-storage 16.444.4...

@pnpm/exe (>=8.0.0-alpha.0, <=8.6.7) potentially affected by CVE-2023-37478 via @pnpm/win-x64 (>=8.0.0, <=8.6.7)

@pnpm/win-x64 NPM version =8.0.0, =8.0.0-alpha.0, =8.6.7 Source cves: CVE-2023-37478 Source advisory: OSV:GHSA-5R98-F33J-G8H7...

10minions-engine (>=0.0.1, <=0.0.4), @1amageek/document-propagator (>=0.10.1, <=1.0.0) +1993 more potentially affected by CVE-2023-36665 via protobufjs (>=7.0.0, <=7.2.4)

protobufjs NPM version =7.0.0, =0.0.1, =0.10.1, =1.1.0, =0.4.0, =1.22.0, =6.2.36, =1.0.0-alpha.2, =1.8.0, =0.0.0-beta.0, =1.0.0, =1.0.1, =3.1.0 and more Source cves: CVE-2023-36665 Source advisory: OSV:GHSA-H755-8QP9-CQ85...

btctax-store (>=0.1.0, <=0.17.0), did-webkey (0.1.1) +4 more potentially affected by CVE-2023-53160 via sequoia-openpgp (1.14.0)

sequoia-openpgp CARGO version 1.14.0 is affected by a known vulnerability. The following packages have a transitive dependency on sequoia-openpgp and may be impacted: - btctax-store =0.1.0, =0.3.0, =0.4.0-rc.1, =5.0.4 Source cves: CVE-2023-53160 Source advisory: OSV:GHSA-25MX-8F3V-8WH7...

@boomerang-io/gatsby-theme-boomerang (>=1.5.0-beta.0, <=1.6.2), @sonarsource/gatsby-theme-marketing (>=3.1.0, <=3.5.0) +1 more potentially affected by CVE-2023-30548 via gatsby-plugin-sharp (>=5.0.0, <=5.6.0)

gatsby-plugin-sharp NPM version =5.0.0, =1.5.0-beta.0, =3.1.0, =5.0.0-alpha-drupal-proxyurl.14, =5.0.0-alpha-v5.d20221012t101120.57 Source cves: CVE-2023-30548 Source advisory: OSV:GHSA-H2PM-378C-PCXX...

Karate has vulnerable dependency on json-smart package (CVE-2023-1370)

Summary The CVE How to fix it Very simple, just upgrade json-path package to 2.8.0 from 2.7.0 inside karate-core pom.xml ;...

acme-client (>=0.1.0, <=0.2.0), aerial (0.1.0) +807 more potentially affected by unknown CVE via openssl (>=0.2.18, <=0.10.40)

openssl CARGO version =0.2.18, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.7.0, =0.1.0, =0.0.10, =0.0.1, =0.1.0, =0.2.0 - apns 0.1.1 - aries 0.1.0 - arubaripple 0.0.1 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0024...

cargo-generate (>=0.13.1, <=0.16.0), cargo-smart-release (>=0.1.0, <=0.2.4) +44 more potentially affected by unknown CVE via git-hash (>=0.1.2, <=0.10.3)

git-hash CARGO version =0.1.2, =0.13.1, =0.1.0, =0.2.11, =11.0.0, =0.12.11, =0.1.0, =0.1.0, =0.3.0, =0.2.0, =0.1.0, =0.1.0, =0.10.0, =0.1.0, =0.1.0, =0.4.3 - git-lock 0.0.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0025...

@roots/bud-imagemin (2023.1.31) potentially affected by unknown CVE via @roots/bud (2023.1.31)

@roots/bud NPM version 2023.1.31 is affected by a known vulnerability. The following packages have a transitive dependency on @roots/bud and may be impacted: - @roots/bud-imagemin 2023.1.31 Source cves: unknown CVE Source advisory: SNYK:JS-ROOTSBUD-3326363...