Total
419331 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2021-23379 | 1 Portkiller Project | 1 Portkiller | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| This affects all versions of package portkiller. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. | |||||
| CVE-2021-23378 | 1 Picotts Project | 1 Picotts | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| This affects all versions of package picotts. If attacker-controlled user input is given to the say function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. | |||||
| CVE-2021-23377 | 1 Onion-oled-js Project | 1 Onion-oled-js | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| This affects all versions of package onion-oled-js. If attacker-controlled user input is given to the scroll function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. | |||||
| CVE-2021-23376 | 1 Ffmpegdotjs Project | 1 Ffmpegdotjs | 2026-06-17 | 7.5 HIGH | 9.8 CRITICAL |
| This affects all versions of package ffmpegdotjs. If attacker-controlled user input is given to the trimvideo function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. | |||||
| CVE-2021-23375 | 1 Psnode Project | 1 Psnode | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| This affects all versions of package psnode. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. | |||||
| CVE-2021-23374 | 1 Ps-visitor Project | 1 Ps-visitor | 2026-06-17 | 7.5 HIGH | 7.3 HIGH |
| This affects all versions of package ps-visitor. If attacker-controlled user input is given to the kill function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. | |||||
| CVE-2021-23373 | 1 Set-deep-prop Project | 1 Set-deep-prop | 2026-06-17 | N/A | 7.5 HIGH |
| All versions of package set-deep-prop are vulnerable to Prototype Pollution via the main functionality. | |||||
| CVE-2021-23372 | 1 Mongo-express Project | 1 Mongo-express | 2026-06-17 | 5.0 MEDIUM | 4.4 MEDIUM |
| All versions of package mongo-express are vulnerable to Denial of Service (DoS) when exporting an empty collection as CSV, due to an unhandled exception, leading to a crash. | |||||
| CVE-2021-23371 | 1 Chrono-node Project | 1 Chrono-node | 2026-06-17 | 5.0 MEDIUM | 7.5 HIGH |
| This affects the package chrono-node before 2.2.4. It hangs on a date-like string with lots of embedded spaces. | |||||
| CVE-2021-23370 | 1 Swiperjs | 1 Swiper | 2026-06-17 | 7.5 HIGH | 7.5 HIGH |
| This affects the package swiper before 6.5.1. | |||||
| CVE-2021-23368 | 1 Postcss | 1 Postcss | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing. | |||||
| CVE-2021-23365 | 1 Tyk | 1 Tyk-identity-broker | 2026-06-17 | 5.5 MEDIUM | 4.8 MEDIUM |
| The package github.com/tyktechnologies/tyk-identity-broker before 1.1.1 are vulnerable to Authentication Bypass via the Go XML parser which can cause SAML authentication bypass. This is because the XML parser doesn’t guarantee integrity in the XML round-trip (encoding/decoding XML data). | |||||
| CVE-2021-23364 | 1 Browserslist Project | 1 Browserslist | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries. | |||||
| CVE-2021-23363 | 1 Kill-by-port Project | 1 Kill-by-port | 2026-06-17 | 6.5 MEDIUM | 6.3 MEDIUM |
| This affects the package kill-by-port before 0.0.2. If (attacker-controlled) user input is given to the killByPort function, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. | |||||
| CVE-2021-23362 | 2 Npmjs, Siemens | 2 Hosted-git-info, Sinec Infrastructure Network Services | 2026-06-17 | 5.0 MEDIUM | 5.3 MEDIUM |
| The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity. | |||||
| CVE-2021-23360 | 1 Killport Project | 1 Killport | 2026-06-17 | 6.5 MEDIUM | 7.5 HIGH |
| This affects the package killport before 1.0.2. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success. | |||||
| CVE-2021-23359 | 1 Port-killer Project | 1 Port-killer | 2026-06-17 | 6.5 MEDIUM | 7.5 HIGH |
| This affects all versions of package port-killer. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization. Running this PoC will cause the command touch success to be executed, leading to the creation of a file called success. | |||||
| CVE-2021-23358 | 4 Debian, Fedoraproject, Tenable and 1 more | 4 Debian Linux, Fedora, Tenable.sc and 1 more | 2026-06-17 | 6.5 MEDIUM | 3.3 LOW |
| The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized. | |||||
| CVE-2021-23357 | 1 Tyk | 1 Tyk | 2026-06-17 | 4.6 MEDIUM | 3.3 LOW |
| All versions of package github.com/tyktechnologies/tyk/gateway are vulnerable to Directory Traversal via the handleAddOrUpdateApi function. This function is able to delete arbitrary JSON files on the disk where Tyk is running via the management API. The APIID is provided by the user and this value is then used to create a file on disk. If there is a file found with the same name then it will be deleted and then re-created with the contents of the API creation request. | |||||
| CVE-2021-23356 | 1 Kill-process-by-name Project | 1 Kill-process-by-name | 2026-06-17 | 7.5 HIGH | 5.6 MEDIUM |
| This affects all versions of package kill-process-by-name. If (attacker-controlled) user input is given, it is possible for an attacker to execute arbitrary commands. This is due to use of the child_process exec function without input sanitization in the index.js file. | |||||