369 matches found
CVE-2026-25814
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization...
CVE-2026-25814 NoSQL Injection Risk via Unsanitized Query Parameters
PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, User-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization...
CVE-2026-25814
PlaciPy (educational placement system) 1.0.0 is affected by a NoSQL injection risk: user-controlled query parameters are passed directly into DynamoDB query/filter construction without validation or sanitization. This vulnerability enables tampering with queries, potentially compromising confiden...
PlaciPy 注入漏洞
PlaciPy is an open-source employment management system developed by Praskla Technology. It aims to simplify the employment processes for students, trainers, and managers in educational institutions. Version 1.0.0 of PlaciPy contains a vulnerability that stems from unvalidated or unchecked...
ai-dynamo (=0.1.0), bentoctl (=0.2.3) +6 more potentially affected by CVE-2026-24123 via bentoml (>=1.0.0a7 <=1.4.3)
bentoml PYPI version =1.0.0a7, =1.0.1, =0.3.12, =0.0.1, =1.0.3, =0.0.10, =0.6.20 - raptor-labsdk =0.3.2 Source cves: CVE-2026-24123 Source advisory: SNYK:PYTHON-BENTOML-15123972...
ai-dynamo (=0.1.0), bento2seldon (>=0.1.0 <=0.4.0) +16 more potentially affected by CVE-2026-24123 via bentoml (>=0.10.1 <=1.4.3)
bentoml PYPI version =0.10.1, =0.1.0, =0.1.0, =0.0.10, =0.0.5, =0.3.12, =0.0.1, =1.0.3, =0.0.10, =0.0.1, =0.0.1, =0.0.13 and more Source cves: CVE-2026-24123 Source advisory: OSV:GHSA-6R62-W2Q3-48HF...
serde_dynamo (>=3.0.1 <=4.2.8) potentially affected by unknown CVE via aws-sdk-dynamodbstreams (>=0.10.1 <=0.9.0)
aws-sdk-dynamodbstreams CARGO version =0.10.1, =3.0.1, =4.2.8 Source cves: unknown CVE Source advisory: OSV:GHSA-G59M-GF8J-GJF5...
aws-secretsmanager-cache (=0.5.0), dynamo-es (=0.4.5) +1 more potentially affected by unknown CVE via aws-sdk-config (>=0.17.0 <=0.26.0)
aws-sdk-config CARGO version =0.17.0, =0.1.0, =0.1.3 Source cves: unknown CVE Source advisory: OSV:GHSA-G59M-GF8J-GJF5...
EUVD-2025-176619
Malicious code in rocket-dynamo-supervisor-winston npm...
Malicious code in dynamo-schema-higgs-geoarchaeology (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ea29699a4255f978ebc4feb2e45e81710950a299da4f1af155fa329cbc775c9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-180243
Malicious code in augmentedreality-update-tethys-dynamo npm...
EUVD-2025-179498
Malicious code in cross-env-native-centaurus-dynamo npm...
EUVD-2025-179230
Malicious code in dynamo-ganymede-init-sequelize npm...
EUVD-2025-178217
Malicious code in kardashevscale-transport-tailwindcss-dynamo npm...
Malicious code in uninstall-sails-development-dynamo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2f009141574a4ca3a211c93ce3277437cc7eb9f1f2db531117da82598c90e901 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in alphard-dynamo-antares-meteor (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 548e58df085b49fb6b9511df3b11a9697aff3fa1dfec19601ea92bc5f247f34a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186657 Malicious code in dynamo-sirius-changelog-string (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99724af34264220df5ccb753c1103bd7ff76b4df241a798532e0790d5505f7bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-189256 Malicious code in rocket-dynamo-supervisor-winston (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80b41f5a989473e5be9b2bc5751e31d7d24fad060b49d6606c000ce2dc8d72f1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...