Lucene search
+L
SnykMost viewed

42438 matches found

Snyk
Snyk
added 2026/07/08 6:47 p.m.25 views

Prototype Pollution

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Prototype Pollution through the textformat file. An attacker can modify the prototype of the returned map object by supplying a specially crafted map entry with the key proto...

8.3CVSS6.5AI score0.00349EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 12:36 a.m.25 views

Malicious Package

Overview ts-await is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 11:40 p.m.25 views

CRLF Injection

Overview aiosmtplib is an aiosmtplib is an asynchronous SMTP client for use with asyncio. Affected versions of this package are vulnerable to CRLF Injection via the SMTPProtocol.executecommand path in src/aiosmtplib/protocol.py. An attacker can inject extra SMTP verbs by supplying a sender or...

7.5CVSS6.2AI score0.00385EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/04 3:15 p.m.25 views

Protection Mechanism Failure

Overview fickling is an A static analyzer and interpreter for Python pickle data Affected versions of this package are vulnerable to Protection Mechanism Failure due to shared mutable state in the shortencode function. An attacker can execute arbitrary code by providing a malicious pickle payload...

9.8CVSS6.3AI score0.00564EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/03 12:17 p.m.25 views

Missing Origin Validation in WebSockets

Overview @theia/core is a the main extension for all Theia-based applications, and provides the main framework for all dependent extensions. Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets via the shell-terminal and terminals/:id WebSocket endpoints whe...

8.8CVSS6.2AI score0.00219EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/02 9:14 p.m.25 views

External Control of File Name or Path

Overview recce is an Environment diff tool for dbt Affected versions of this package are vulnerable to External Control of File Name or Path via the query run API when configured with a DuckDB-backed project. An attacker can access or modify local files accessible to the server process, potential...

9.9CVSS6AI score0.00449EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/27 12:02 a.m.25 views

External Control of File Name or Path

Overview @pnpm/fs.symlink-dependency is a Symlink a dependency to nodemodules Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules director...

7.1CVSS5.8AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/27 12:02 a.m.25 views

External Control of File Name or Path

Overview @pnpm/installing.deps-resolver is a Resolves dependency graph of a package Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended nodemodules...

7.1CVSS5.8AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/26 8:47 p.m.25 views

Regular Expression Denial of Service (ReDoS)

Overview linkify-it is a Links recognition library with FULL unicode support Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS due to quadratic algorithmic complexity in the match function. An attacker can exhaust CPU resources and cause significant...

8.7CVSS6AI score0.00366EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.25 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper handling of integer values in the storeAtts function. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted input that triggers the...

7.5CVSS6.2AI score0.0014EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/19 2:50 p.m.25 views

Inefficient Algorithmic Complexity

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the query-depth processing in validateQueryDepth and...

8.7CVSS5.9AI score0.0059EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/18 8:16 p.m.25 views

Protection Mechanism Failure

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Protection Mechanism Failure in the skill-command dispatch process. An attacker can bypass hook-based auditing or policy enforcement by routing a skill command through a dispatch path tha...

4.3CVSS5.9AI score0.00185EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/18 6:35 p.m.25 views

Insertion of Sensitive Information Into Sent Data

Overview @theia/ai-chat is a Theia - AI Chat Extension Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the rendering of Markdown image tags in AI chat responses. An attacker can cause sensitive information from the workspace or conversatio...

6.7CVSS5.8AI score0.00312EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/18 12:20 a.m.25 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the deserialization process of RFC7797 JWS payloads with b64=false. An attacker can cause resource exhaustion by submitting a payload that exceeds the intended size limits, bypassi...

8.7CVSS5.9AI score0.00163EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 4:44 p.m.25 views

Use of Cache Containing Sensitive Information

Overview @angular/service-worker is an Angular - service worker tooling! Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the request reconstruction. An attacker can access sensitive session-restricted data or expose credentials by exploiting...

6.1CVSS5.9AI score0.00228EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/12 4:39 p.m.25 views

Authorization Bypass Through User-Controlled Key

Overview chromadb is a Chroma. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the V1 collection-level endpoints passing None for tenant and database to the authorization layer. An attacker can gain unauthorized access to resources by...

8.8CVSS5.4AI score0.00284EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 2:32 p.m.25 views

Malicious Package

Overview ecto-nightly-spirit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 12:00 a.m.25 views

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via insufficient neutralization of special characters in the query construction. An attacker can execute arbitrary queries against Elasticsearch, OpenSearch, or GemFire...

8.8CVSS5.7AI score0.00304EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 9:00 p.m.25 views

Malicious Package

Overview @solana-labs/web3.js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 9:52 a.m.25 views

Malicious Package

Overview sensivity is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 12:00 a.m.25 views

XML External Entity (XXE) Injection

Overview org.springframework.ws:spring-xml is a dependency of org.springframework.ws. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the Jaxp13XPathTemplate class in Jaxp13XPathTemplate.java. When XPath expressions are evaluated against StreamSource and...

8.8CVSS5.7AI score0.00352EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/09 5:05 p.m.25 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can exhaust system resources by sending specially crafted requests over the network, resulting in service unavailability for legitimate users. Remediation Upgrade...

8.7CVSS5.3AI score0.02481EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/08 12:00 a.m.25 views

Server-side Request Forgery (SSRF)

Overview org.springframework:spring-web is a package that provides a comprehensive programming and configuration model for modern Java-based enterprise applications - on any kind of deployment platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via...

6.5CVSS5.5AI score0.00123EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/06 9:00 p.m.25 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...

9.8CVSS5.7AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/06 9:00 p.m.25 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Shai-Hulud / Miasma software supply chain campaign, a large scale operation that has affected numerous packages across open source ecosystems. The malicio...

9.8CVSS5.7AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/05 8:07 p.m.25 views

Malicious Package

Overview moustick is a malicious package. This package contains malicious code that fetches and eval a remote payload from attacker-controlled URL https://www.jsonkeeper.com/b/MYUKZ on require in moustick/index.js. The payload is designed to extract RELAYERPRIVATEKEY and JWTSECRET from the victim...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/05 4:22 p.m.25 views

Authorization Bypass Through User-Controlled Key

Overview nocodb is a NocoDB Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the readAttachment tool. An attacker can access files in the shared storage belonging to other users by supplying a known attachment path and a valid MCP token...

3.5CVSS5.3AI score0.00271EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/05 4:14 p.m.25 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the NTFS handler that miscalculates compression-unit buffer size in GetCuSize function. An attacker can achieve arbitrary code execution or application crash by sending data with specially crafted...

8.8CVSS6.4AI score0.01116EPSS
SaveExploits1References4
Snyk
Snyk
added 2026/06/03 9:15 p.m.25 views

External Control of File Name or Path

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to External Control of File Name or Path in backend/htmlbackend.py‎, which ...

7.1CVSS5.5AI score0.00373EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/03 9:00 p.m.25 views

Malicious Package

Overview chai-val is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.25 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.25 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.25 views

Malicious Package

Overview nottuff4 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate advertising...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.25 views

Malicious Package

Overview captainindia is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 8:26 p.m.25 views

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the SvgLoader::run function. An attacker can cause a crash of the process by supplying a specially crafted 6-byte malformed SVG input to the Picture::load function. Remediation A fix was pushed into the mast...

5.3CVSS5.3AI score0.00235EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/31 9:00 p.m.25 views

Malicious Package

Overview @cloudplatform-single-spa/evocs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/31 9:00 p.m.25 views

Malicious Package

Overview @cloudplatform-single-spa/evolution is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/31 9:00 p.m.25 views

Malicious Package

Overview @cloudplatform-single-spa/ml-ai-agents-evo-claw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/31 9:00 p.m.25 views

Malicious Package

Overview @mlspace/env-gitlab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/31 9:00 p.m.25 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/31 9:00 p.m.25 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code linked to the "Miasma" supply chain attack targeting the @redhat-cloud-services npm namespace. A malicious actor compromised the publication pipeline and published versions containing malicious code that includes...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/31 6:03 p.m.25 views

Malicious Package

Overview cacheutilskit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/29 10:54 p.m.25 views

Malicious Package

Overview @cloudplatform-single-spa/datagrid is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/29 10:04 p.m.25 views

Malicious Package

Overview @timelycare/config-service is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/28 4:50 p.m.25 views

Cross-site Scripting (XSS)

Overview TinyMCE is a web-based JavaScript HTML WYSIWYG editor control. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the media plugin when handling crafted data-mce- attributes. An attacker can execute arbitrary scripts in the context of the user's browser by...

8.7CVSS5.9AI score0.00264EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/28 1:39 p.m.25 views

Malicious Package

Overview @service-suppliers/setinitialloaded is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/28 1:39 p.m.25 views

Malicious Package

Overview @service-suppliers/fetch-initial-suppliers-watcher-saga is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/27 1:25 p.m.25 views

Malicious Package

Overview testing-on-npmjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/27 12:38 a.m.25 views

Insufficiently Protected Credentials

Overview @hapi/wreck is a HTTP Client Utilities library. Affected versions of this package are vulnerable to Insufficiently Protected Credentials due to leaking the sensitive Proxy-Authorization header across cross-hostname redirects. An attacker can obtain sensitive proxy credentials by inducing...

6.3CVSS5.8AI score0.0042EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/27 12:11 a.m.25 views

Denial of Service (DoS)

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Denial of Service DoS through the renderTemplates function when the for or tablerow tag is used with an empty body. An attacker can...

7.1CVSS5.8AI score0.00317EPSS
SaveExploits0References2
Total number of security vulnerabilities5000