Lucene search
+L
SnykMost viewed

42356 matches found

Snyk
Snyk
added 2026/04/16 1:20 a.m.28 views

Insertion of Sensitive Information into Log File

Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File through the Client handling of events. An attacker can bypass redaction controls and...

6.3CVSS5.8AI score0.00214EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/04/13 10:11 p.m.28 views

Integer Overflow or Wraparound

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

5.9CVSS6.1AI score0.00148EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/06 5:59 p.m.28 views

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect through the redirecturi parameter in multiple endpoints ForgotPassword, MagicLinkLogin, Signup, InviteMembers, OAuthLoginHandler, VerifyEmailHandler which is not validated against AllowedOrigins. An attacker can obtain...

8.6CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/03 4:07 a.m.28 views

Improper Validation of Unsafe Equivalence in Input

Overview fast-jwt is a Fast JSON Web Token implementation Affected versions of this package are vulnerable to Improper Validation of Unsafe Equivalence in Input in the cacheKeyBuilder function when custom implementations do not generate unique keys for different tokens, leading to cache collision...

9.3CVSS5.9AI score0.00212EPSS
SaveExploits0References4
Snyk
Snyk
added 2026/03/27 7:58 p.m.28 views

Server-side Request Forgery (SSRF)

Overview @clerk/backend is a Clerk Backend SDK - REST Client for Backend API & JWT verification utilities Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the clerkFrontendApiProxy function. An attacker can obtain secret keys by crafting a request path that...

9.1CVSS5.9AI score0.00309EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/26 10:20 p.m.28 views

Prototype Pollution

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Prototype Pollution via the resolvePartial function. An attacker can inject malicious scripts into rendered output by polluting Object.prototype with a key matching a parti...

4.7CVSS6.5AI score0.00276EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/03/24 10:16 p.m.28 views

Allocation of Resources Without Limits or Throttling

Overview Scriban is a Scriban is a fast, powerful, safe and lightweight scripting language and engine for .NET, which was primarily developed for text templating with a compatibility mode for parsing liquid templates. Today, not only Scriban can be used in text templating scenarios, but also can ...

7.1CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/12 10:39 p.m.28 views

Numeric Truncation Error

Overview Affected versions of this package are vulnerable to Numeric Truncation Error in the chunk size parsing process when handling HTTP requests with Transfer-Encoding set to chunked. An attacker can cause HTTP request or response smuggling by sending a chunk size value that parses to 2^64 or...

6.5CVSS6AI score0.00207EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/12 4:23 p.m.28 views

Malicious Package

Overview prefer-let is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The package...

9.8CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
added 2026/03/12 4:23 p.m.28 views

Malicious Package

Overview minify-mangle-names is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...

9.8CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
added 2026/03/02 6:34 p.m.28 views

Cross-site Scripting (XSS)

Overview nocodb is a NocoDB Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Comment.insert function that that lacks sanitization for stored HTML. An attacker can execute arbitrary JavaScript code in the context of the user's browser by submitting crafted input...

5.4CVSS5.9AI score0.00143EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/01/30 8:38 p.m.28 views

Arbitrary Command Injection

Overview cai-framework is a Cybersecurity AI Framework Affected versions of this package are vulnerable to Arbitrary Command Injection via the findfile function, which calls subprocess.Popen with shell=True. An attacker can execute arbitrary commands on the host system by injecting malicious...

9.6CVSS5.8AI score0.008EPSS
SaveExploits3References2
Snyk
Snyk
added 2025/12/02 6:45 a.m.28 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via algorithmic complexity in the SQL parsing logic. The parser fails to enforce limits when handling deeply nested tuples or unusually large token sequences, allowing an attacker to...

8.7CVSS7.5AI score0.03237EPSS
SaveExploits0References4
Snyk
Snyk
added 2025/11/24 8:33 p.m.28 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

9.8CVSS6.8AI score
SaveExploits0References3
Snyk
Snyk
added 2023/11/28 10:19 a.m.28 views

Regular Expression Denial of Service (ReDoS)

Overview angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this package...

7.5CVSS6.6AI score0.01891EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.27 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.27 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.27 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 8:46 p.m.27 views

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the WebSocket upgrade. An attacker can bypass request boundaries and interfere with HTTP request processing by crafting specially constructed HTTP requests. Remediation Upgrade aiohttp to version 3.14.2 or...

7CVSS5.5AI score0.00275EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/30 10:49 p.m.27 views

Malicious Package

Overview api-gateway-lambda-router is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 11:00 p.m.27 views

Malicious Package

Overview @exocore/exocode is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 5:36 a.m.27 views

Malicious Package

Overview fluterjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 4:47 p.m.27 views

Inefficient Algorithmic Complexity

Overview js-yaml is a human-friendly data serialization language. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the readFlowCollection function of parser.ts, which reaches exponential time when a flow sequence entry turns out to be a key: value pair and...

8.7CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 3:01 a.m.27 views

Malicious Package

Overview @gocortexio/npmgremlinbox-sendmail-8-23 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 3:00 a.m.27 views

Malicious Package

Overview @gocortexio/npmgremlinbox-artistic-1-0 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.27 views

Malicious Package

Overview zwxbclic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 11:41 p.m.27 views

Malicious Package

Overview iwsdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 10:52 p.m.27 views

Incorrect Authorization

Overview com.fasterxml.jackson.core:jackson-databind is a library which contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. Affected versions of this package are vulnerable to Incorrect Authorization in the deserialization process when handling...

7.1CVSS6.1AI score0.00346EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/13 9:00 p.m.27 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a second-stage obfuscated loader. A malicious actor gained push access to the AsyncAPI generator monorepo's next branch. This allowed the attacker to trigger the project's legitimate CI/CD pipeline ...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 9:22 p.m.27 views

Missing Authorization

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Missing Authorization due to missing authentication checks on several API endpoints, including /api/providers, /api/usage/stats, /api/usage/request-logs, and...

9.8CVSS6.1AI score0.02244EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/06 6:53 p.m.27 views

Malicious Package

Overview env-axios is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 9:00 p.m.27 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 8:18 a.m.27 views

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the curleasycleanup process after configuring an HTTP/2 stream-dependency tree using CURLOPTSTREAMDEPENDS or CURLOPTSTREAMDEPENDSE and invoking curleasyreset. An attacker can cause the application to access freed memor...

9.8CVSS6.2AI score0.00507EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/03 8:18 a.m.27 views

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the CURLOPTSSHKEYFUNCTION process. An attacker can intercept or manipulate data by presenting a server host key type that does not match the recorded key type in the knownhosts file, which is improperl...

8.3CVSS6AI score0.00325EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/19 9:42 p.m.27 views

Cross-site Scripting (XSS)

Overview @sveltia/cms is a Sveltia CMS is a modern, lightweight, Git-based headless content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Markdown/RichText preview rendering process. An attacker can execute arbitrary JavaScript in the conte...

5.4CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/18 2:31 p.m.27 views

Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the backup process. An attacker can obtain sensitive account credentials and configuration secrets by...

6.9CVSS5.8AI score0.00174EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/17 6:21 p.m.27 views

Use of Cache Containing Sensitive Information

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the cache interceptor. An attacker can obtain another user's authenticated response data by exploiting whitespace-padded...

8.9CVSS7.1AI score0.0036EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/17 6:20 p.m.27 views

Improper Certificate Validation

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation in the ProxyAgent when configured with a SOCKS5 proxy URI, which causes the requestTls option to be silently dropped. An attacker can...

7.4CVSS6.4AI score0.00459EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/17 2:03 p.m.27 views

Incorrect Conversion between Numeric Types

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the ggmldequantize, ggmlmulmatveca8, ggmlmulmata8, and ggmlmoea8 functions when tensor dimensions are...

7.5CVSS5.9AI score0.00281EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/16 6:09 a.m.27 views

Malicious Package

Overview rbac-auth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 4:52 p.m.27 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the formatNumber function when the digitsInfo parameter is controlled by untrusted user input. An attacker can exhaust system resources and cause application unavailability by...

8.2CVSS5.9AI score0.00161EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 4:23 p.m.27 views

Malicious Package

Overview ioredis-typed is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 1:54 p.m.27 views

Malicious Package

Overview @trackking/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 9:35 a.m.27 views

Malicious Package

Overview rate-limits-flexible is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 11:10 p.m.27 views

Infinite loop

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

6.5CVSS5.4AI score0.00093EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 3:08 p.m.27 views

Malicious Package

Overview crypto-hash-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 1:37 p.m.27 views

Incorrect Comparison

Overview @hulumi/policies is a Pulumi CrossGuard policy packs for AWS, GitHub, Kubernetes, Cloudflare, and deployment governance. Includes HulumiHardeningPack, HulumiAwsOrgHardeningPack, state/backend/primitive/detection rules, GitHub packs, EKS packs, and platform governance. SLSA Bui Affected...

8.3CVSS5.8AI score0.00309EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 1:34 p.m.27 views

Malicious Package

Overview npmjstruffle-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 11:36 a.m.27 views

Malicious Package

Overview csc154-internall-depend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/09 6:33 p.m.27 views

Missing Cryptographic Step

Overview Affected versions of this package are vulnerable to Missing Cryptographic Step in the AES-OCB provider when an application uses the EVPCipher interface. The handler silently discards the IV, so every message under a given key runs with the all-zero offset state, causing nonce reuse. If...

9.1CVSS7.1AI score0.00603EPSS
SaveExploits0References2
Total number of security vulnerabilities5000