Vulnerabilities & Supply Chain
in real time

Multer vulnerable to Denial of Service via unhandled exception from malformed request

axios Requests Vulnerable To Possible SSRF and Credential Leakage via Absolute URL

Wheel Affected by Arbitrary File Permission Modification via Path Traversal in wheel unpack

Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial

Python-Multipart has Arbitrary File Write via Non-Default Configuration

Flask-CORS vulnerable to Improper Handling of Case Sensitivity

Request smuggling leading to endpoint restriction bypass in Gunicorn

Denial of Service in pyasn1 via Unbounded Recursion

PyJWT accepts unknown `crit` header extensions

minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments

flatted vulnerable to unbounded recursion DoS in parse() revive phase

glob CLI: Command injection via -c/--cmd executes matches with shell:true

Rollup 4 has Arbitrary File Write via Path Traversal

Minerva timing attack on P-256 in python-ecdsa

jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch

Infinite Loop in colors.js

Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

setuptools vulnerable to Command Injection via package URL

Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements