Lucene search
+L
SnykMost viewed

42436 matches found

Snyk
Snyk
added 2026/04/15 7:19 p.m.26 views

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration in the DSF FHIR and BPE Servers with enabled OIDC authentication due to the lack of session timeout enforcement in OIDC browser sessions. An attacker can gain unauthorized access to a user's session by...

6.8CVSS5.8AI score0.00154EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/10 12:11 a.m.26 views

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow in the wcPKCS7DecryptOri function when processing a CMS EnvelopedData message containing an OtherRecipientInfo recipient. An attacker can execute arbitrary code or cause a crash by sending a crafted message...

8CVSS6.2AI score0.00175EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/03 5:21 p.m.26 views

Server-side Request Forgery (SSRF)

Overview google-search-mcp is a Google Search MCP Server for Claude Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the extractContent function. An attacker can access internal resources or perform unauthorized requests by supplying crafted URLs to the...

6.5CVSS6.6AI score0.00206EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/27 6:21 p.m.26 views

Improper Check for Unusual or Exceptional Conditions

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions through the registerDecorator path in lib/handlebars/compiler/javascript-compiler.js. An attacker can crash the Node.js...

8.7CVSS5.9AI score0.00616EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/27 6:19 p.m.26 views

Access of Resource Using Incompatible Type ('Type Confusion')

Overview handlebars is an extension to the Mustache templating language. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' via the compile function. An attacker can execute arbitrary code by supplying a crafted Abstract Syntax Tree AST...

9.8CVSS6.2AI score0.01704EPSS
SaveExploits4References4
Snyk
Snyk
added 2026/03/26 7:07 p.m.26 views

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via improper validation of file URLs and UNC-style paths in the media loading process. An attacker can cause network-hosted files to be treated as local content by...

6.9CVSS6.4AI score0.00319EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/25 5:30 p.m.26 views

Missing Authentication for Critical Function

Overview @grackle-ai/powerline is a gRPC PowerLine server for Grackle AI agent integration Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the PowerLine gRPC server when when --token is not provided and GRACKLEPOWERLINETOKEN is not set. An...

6.3CVSS6.3AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/20 3:56 p.m.26 views

Access of Resource Using Incompatible Type ('Type Confusion')

Overview @builder.io/qwik-city is a The meta-framework for Qwik. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' in the FormData function when handling application/x-www-form-urlencoded or multipart/form-data requests. An attacker ca...

8.7CVSS5.9AI score0.00427EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/17 8:51 p.m.26 views

Improper Null Termination

Overview Affected versions of this package are vulnerable to Improper Null Termination via the madrwavstrlen function. An attacker can cause memory access violations and application crashes by submitting specially crafted WAV files that exploit improper null-termination handling in the coding...

5.5CVSS5.9AI score0.00225EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/16 4:22 p.m.26 views

Buffer Overflow

Overview Affected versions of this package are vulnerable to Buffer Overflow via the setcookiegeneratecallback function. An attacker can cause a buffer overflow by providing a callback that returns a cookie value greater than 256 bytes. Note: This is only exploitable if the application explicitly...

9.8CVSS6.1AI score0.00704EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/12 2:08 p.m.26 views

Integer Overflow or Wraparound

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

8.3CVSS5.9AI score0.00194EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/11 11:00 p.m.26 views

Prototype Pollution

Overview graphql-upload-minimal is a Minimalistic and developer friendly middleware and an Upload scalar to add support for GraphQL multipart requests file uploads via queries and mutations to various Node.js GraphQL servers. Affected versions of this package are vulnerable to Prototype Pollution...

9.3CVSS7.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/06 7:14 a.m.26 views

Malicious Package

Overview permissionscaling is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/02/28 2:01 a.m.26 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in which the non-blocking async JSON parser can be made to bypass the maxNumberLength constraint default: 1000 characters defined in StreamReadConstraints. An attacker can cause...

8.7CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/02/25 7:12 p.m.26 views

Out-of-bounds Read

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

6.3CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/02/21 8:36 a.m.26 views

Encoding Error

Overview asn1-ts is an ASN.1 encoding and decoding, including BER, CER, and DER. Affected versions of this package are vulnerable to Encoding Error in the integer decoding that can leak the underlying ArrayBuffer. Remediation Upgrade asn1-ts to version 11.0.6 or higher. References - GitHub Commit...

9.2CVSS5.9AI score0.0026EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/02/18 12:57 a.m.26 views

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the handling of module paths in the gateway configuration. An attacker can execute arbitrary code by supplying a crafted module path to the configuration if they...

8.6CVSS6.7AI score0.00405EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/01/07 7:20 p.m.26 views

Improper Validation of Specified Type of Input

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input that is passed to the handleFormData function. An attacker can gain unauthorized access to files on the underlying server by requests with unexpected...

10CVSS7.2AI score0.78197EPSS
SaveExploits23References2
Snyk
Snyk
added 2026/01/05 11:13 p.m.26 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Request.post function. An attacker can cause the server to exhaust available memory and become unresponsive. Details Denial of Service DoS describes a family of attacks, all...

8.7CVSS7AI score0.00361EPSS
SaveExploits0References2
Snyk
Snyk
added 2025/10/21 7:21 a.m.26 views

Malicious Package

Overview @jdtaro/dynamic-devtools-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

9.8CVSS6.8AI score
SaveExploits0References2
Snyk
Snyk
added 2025/10/21 6:19 a.m.26 views

Malicious Package

Overview optional-native-module-abc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS6.8AI score
SaveExploits0References2
Snyk
Snyk
added 2025/07/30 7:18 a.m.26 views

Malicious Package

Overview exceljs-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.25 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/31 12:52 a.m.25 views

Malicious Package

Overview asdsafsafdasdsaasdasda is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 11:00 p.m.25 views

Malicious Package

Overview croft-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 10:59 p.m.25 views

Malicious Package

Overview polymarket-risk-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 4:26 p.m.25 views

Uncontrolled Recursion

Overview org.webjars.npm:tar is a full-featured Tar for Node.js. Affected versions of this package are vulnerable to Uncontrolled Recursion in the mapHas helper and filesFilter function in src/list.ts, which walk an entry path upward with one path.dirname call per recursion and no segment cap. An...

6.9CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 5:03 p.m.25 views

Malicious Package

Overview s3-lambda-dynamodb-cdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.25 views

Malicious Package

Overview zztxtwtmp06 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.25 views

Malicious Package

Overview zjiarange2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.25 views

Malicious Package

Overview zrgvh4b70 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 3:58 a.m.25 views

Malicious Package

Overview ldpbootstrap-jquery is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 9:40 p.m.25 views

Malicious Package

Overview jsonfb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 9:00 p.m.25 views

Malicious Package

Overview majestic-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/13 6:12 a.m.25 views

Malicious Package

Overview @gt-test-exp/profiler-exp-00000002 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 6:47 p.m.25 views

Prototype Pollution

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Prototype Pollution through the textformat file. An attacker can modify the prototype of the returned map object by supplying a specially crafted map entry with the key proto...

8.3CVSS6.5AI score0.00349EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 2:23 a.m.25 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to improper handling of the MaxAuthTries parameter during the authentication process. An attacker can exhaust server resources by repeatedly attempting authentication using GSSAPI...

7.5CVSS6.1AI score0.00441EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 12:36 a.m.25 views

Malicious Package

Overview ts-await is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 11:40 p.m.25 views

CRLF Injection

Overview aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio. Affected versions of this package are vulnerable to CRLF Injection via the SMTPProtocol.executecommand path in src/aiosmtplib/protocol.py. An attacker can inject extra SMTP verbs by supplying a sender or...

7.5CVSS6.2AI score0.00385EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/07 3:46 p.m.25 views

Malicious Package

Overview evm-typechain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:54 p.m.25 views

Malicious Package

Overview modulyn is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 3:15 p.m.25 views

Protection Mechanism Failure

Overview fickling is an A static analyzer and interpreter for Python pickle data Affected versions of this package are vulnerable to Protection Mechanism Failure due to shared mutable state in the shortencode function. An attacker can execute arbitrary code by providing a malicious pickle payload...

9.8CVSS6.3AI score0.00564EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/03 12:17 p.m.25 views

Missing Origin Validation in WebSockets

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the shell-terminal and terminals/:id WebSocket endpoints whe...

8.8CVSS6.2AI score0.00219EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/02 9:14 p.m.25 views

External Control of File Name or Path

Overview recce is an Environment diff tool for dbt Affected versions of this package are vulnerable to External Control of File Name or Path via the query run API when configured with a DuckDB-backed project. An attacker can access or modify local files accessible to the server process, potential...

9.9CVSS6AI score0.00449EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:44 p.m.25 views

Malicious Package

Overview @mcconnect/mcc-common-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/27 12:02 a.m.25 views

External Control of File Name or Path

Overview @pnpm/fs.symlink-dependency is a Symlink a dependency to nodemodules Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules director...

7.1CVSS5.8AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/27 12:02 a.m.25 views

External Control of File Name or Path

Overview @pnpm/installing.deps-resolver is a Resolves dependency graph of a package Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules...

7.1CVSS5.8AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/26 8:47 p.m.25 views

Regular Expression Denial of Service (ReDoS)

Overview linkify-it is a Links recognition library with FULL unicode support Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to quadratic algorithmic complexity in the match function. An attacker can exhaust CPU resources and cause significant...

8.7CVSS6AI score0.00366EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/24 9:00 p.m.25 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to a variant of the "Miasma" supply chain attack targeting the LeoPlatform npm ecosystem. A malicious actor compromised a legitimate maintainer account and used it to publish infected versions of this...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.25 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the storeAtts function. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input that triggers the...

7.5CVSS6.2AI score0.0014EPSS
SaveExploits0References2
Total number of security vulnerabilities5000