Lucene search
+L
SnykMost viewed

47469 matches found

Snyk
Snyk
added 2026/07/15 1:11 a.m.30 views

Malicious Package

Overview angylarjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 9:00 p.m.30 views

Malicious Package

Overview l2-x-x is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package attempts to impersonate legitimate gaming utilities, bots, or performance panels, it is entirely malicious and has no connection to the...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/09 11:17 a.m.30 views

Malicious Package

Overview fusion-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 9:22 p.m.30 views

Missing Authorization

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Missing Authorization due to missing authentication checks on several API endpoints, including /api/providers, /api/usage/stats, /api/usage/request-logs, and...

9.8CVSS6.1AI score0.02908EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/06 6:55 p.m.30 views

Malicious Package

Overview oldermorgan is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 8:18 a.m.30 views

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the CURLOPTSSHKEYFUNCTION process. An attacker can intercept or manipulate data by presenting a server host key type that does not match the recorded key type in the knownhosts file, which is improperl...

8.3CVSS6AI score0.00325EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/29 8:21 p.m.30 views

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the clear function. An attacker can access or manipulate memory contents from another buffer by triggering the reuse of a memory page after it has been returned to the shared pool, leading to unintended disclosure or...

5.4CVSS5.9AI score0.00164EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/28 7:36 p.m.30 views

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the extraction process. An attacker can bypass security warnings and spoof file content by crafting a RAR5 archive with specially named alternate data streams that overwrite the intended Internet-zone...

4.8CVSS5.8AI score0.00171EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 5:05 a.m.30 views

Malicious Package

Overview analysis-chart is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/21 5:11 p.m.30 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the resolveSystemId function. An attacker can cause unexpected behavior or potentially execute arbitrary code by providing specially crafted input that triggers an integer overflow during processing...

7.5CVSS6.2AI score0.00205EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/21 5:09 p.m.30 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the endDoctypeDecl process when handling NOTATION declarations. An attacker can cause memory corruption or potentially execute arbitrary code by providing specially crafted XML input. Remediation Upgra...

7.5CVSS6.2AI score0.00205EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/19 8:28 a.m.30 views

Malicious Package

Overview ts-ecro is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/18 2:31 p.m.30 views

Insufficiently Protected Credentials

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the backup process. An attacker can obtain sensitive account credentials and configuration secrets by...

6.9CVSS5.8AI score0.00265EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/18 12:20 a.m.30 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the deserialization process of RFC7797 JWS payloads with b64=false. An attacker can cause resource exhaustion by submitting a payload that exceeds the intended size limits, bypassi...

8.7CVSS5.9AI score0.00163EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/17 2:02 p.m.30 views

Interpretation Conflict

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Interpretation Conflict in the image processing pipeline. An attacker can cause the model to interpret images differently from human expectations by...

6.9CVSS5.9AI score0.00239EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/16 6:09 a.m.30 views

Malicious Package

Overview rbac-auth is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 3:20 p.m.30 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of the Host header when parsing raw HTTP request messages or deriving a server request URI from server variables. An attacker can manipulate the Host header to include URI authori...

6.9CVSS5.4AI score0.00198EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 1:54 p.m.30 views

Malicious Package

Overview @trackking/core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 9:44 a.m.30 views

Malicious Package

Overview tw-fluid-type is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 11:10 p.m.30 views

Infinite loop

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

6.5CVSS5.4AI score0.00093EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 11:36 a.m.30 views

Malicious Package

Overview csc154-internall-depend is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/09 12:00 a.m.30 views

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to improperly configured XML parsing in the PrettyPrintingContentModifier and XmlContentHandler classes, in PrettyPrintingContentModifier.java and payload/XmlContentHandler.java. When the...

6CVSS6AI score0.00223EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/06 9:00 p.m.30 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/06 9:00 p.m.30 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/05 1:40 p.m.30 views

Malicious Package

Overview utils-mf is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/03 9:00 p.m.30 views

Malicious Package

Overview ui-weave is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/03 9:00 p.m.30 views

Malicious Package

Overview buffer-utilities is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.30 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.30 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.30 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.30 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.30 views

Malicious Package

Overview nottuff29 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate advertisin...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.30 views

Malicious Package

Overview abuden22 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate advertising...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.30 views

Malicious Package

Overview sixseven6 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate advertisin...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.30 views

Malicious Package

Overview backup5-updated is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.30 views

Malicious Package

Overview nottuff3 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate advertising...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/31 9:00 p.m.30 views

Malicious Package

Overview @cloudplatform-single-spa/container-registry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/31 9:00 p.m.30 views

Malicious Package

Overview @cloudplatform-single-spa/ml-inference-docker-run is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/29 10:54 p.m.30 views

Malicious Package

Overview @cloudplatform-single-spa/ssh-keys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/29 10:03 p.m.30 views

Malicious Package

Overview ethers-abstract-signer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/29 10:02 p.m.30 views

Malicious Package

Overview raven-i18n-react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/28 4:50 p.m.30 views

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the jwt.decode or jwt.decodecomplete functions when used with a PyJWK key. An attacker can bypass algorithm restrictions and gain unauthorized access to protected resources by signing...

5.4CVSS5.8AI score0.00127EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/28 4:50 p.m.30 views

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication when decoding JSON Web Tokens. An attacker can forge valid tokens by supplying a public key as the secret for the HMAC algorithm when both asymmetric and HMAC algorithms are supported. PoC python from jwt.apijws...

8.8CVSS5.8AI score0.00395EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/28 1:39 p.m.30 views

Malicious Package

Overview @service-suppliers/fetch-initial-suppliers-watcher-saga is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/27 1:25 p.m.30 views

Malicious Package

Overview claude-channel-imessage is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/27 12:09 a.m.30 views

Cross-site Scripting (XSS)

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the striphtml filter, which fails to properly remove HTML tags containing newline characters. An attacker...

6.1CVSS5.8AI score0.00203EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/24 3:54 p.m.30 views

Deserialization of Untrusted Data

Overview transformers is a State-of-the-art Machine Learning for JAX, PyTorch and TensorFlow Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to unsafe deserialization of model configuration files, an attacker can craft a malicious config.json file...

8.5CVSS7.2AI score0.00479EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/24 3:36 p.m.30 views

Malicious Package

Overview prompt-engineering-toolkit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/23 9:00 p.m.30 views

Malicious Package

Overview env-loader-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package was linked to a supply chain attack and contained code designed to steal developer secrets, crypto wallets, SSH keys, and cloud...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 5:42 p.m.30 views

Cross-site Scripting (XSS)

Overview golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the writeQuoted function, which does not properly handle characters in DOCTYPE data. An attacker can cause the...

8.1CVSS5.7AI score0.00223EPSS
SaveExploits0References3
Total number of security vulnerabilities5000