reaper

4 results · Clear filters · Feed

• Critical 9.1
  CVE-2025-9288

  Missing type checks leading to hash rewind and passing on crafted data

  Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11.

  opensearch-dashboards-3 opensearch-dashboards-3-dashboards-observability opensearch-dashboards-3-dashboards-reporting opensearch-dashboards-3-alerting-dashboards-plugin Debian Ubuntu Azure Linux Wolfi npm
  Aug 20, 2025
• Critical 9.1
  CVE-2024-48949

  Elliptic's verify function omits uniqueness validation

  The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.

  reaper elliptic node-elliptic node-elliptic Debian Ubuntu Azure Linux npm
  Oct 10, 2024
• Critical 9.8
  CVE-2023-42282

  NPM IP package incorrectly identifies some private IP addresses as public

  The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

  renovate nodejs lerna sqlpad Debian Ubuntu Azure Linux Wolfi npm
  Feb 8, 2024
• Critical 9.8
  CVE-2022-37601

  Prototype pollution in webpack loader-utils

  Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.

  reaper jitsucom-jitsu loader-utils node-loader-utils Debian Ubuntu Azure Linux Wolfi npm
  Oct 12, 2022