Lucene search
+L
SnykMost viewed

47469 matches found

Snyk
Snyk
added 2026/05/27 6:24 p.m.26 views

Arbitrary Code Injection

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Arbitrary Code Injection via the filters and tags registries in Liquid. An attacker can trigger arbitrary inherited Object.prototype...

10CVSS6AI score0.01031EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/27 5:33 p.m.26 views

Allocation of Resources Without Limits or Throttling

Overview liquidjs is an A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the date filter in filters/date.ts and the strftime formatter in...

8.7CVSS5.9AI score0.00385EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/26 11:56 a.m.26 views

Malicious Package

Overview solidity-coverage-plus is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/25 11:19 p.m.26 views

Open Redirect

Overview Affected versions of this package are vulnerable to Open Redirect in handling shiroSavedRequest cookies, which use unprotected/unencrypted values for SAVEDREQUESTKEY. An authenticated user can cause the server to make blind HTTP GET requests to arbitrary URLs or redirect users to untrust...

5.4CVSS5.9AI score0.00367EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/25 8:49 a.m.26 views

Malicious Package

Overview vite-plugin-env-compat-plus is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/25 8:11 a.m.26 views

Malicious Package

Overview mobile-international is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 5:42 p.m.26 views

Cross-site Scripting (XSS)

Overview golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the childTextNodesAreLiteral function in render.go. An attacker can cause the execution of scripts in the context o...

6.1CVSS5.7AI score0.00223EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/22 1:14 p.m.26 views

Improper Authentication

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

6CVSS5.8AI score0.00093EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/22 1:14 p.m.26 views

Improper Authentication

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

6CVSS5.8AI score0.00093EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/22 5:32 a.m.26 views

Missing Release of Resource after Effective Lifetime

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the handling of unsolicited global request responses, which can fill an internal buffer and block the connection's read loop...

9.1CVSS5.9AI score0.00621EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 2:43 a.m.26 views

Malicious Package

Overview chain-key-validator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 2:43 a.m.26 views

Malicious Package

Overview compliance-check-runner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 2:42 a.m.26 views

Malicious Package

Overview ganache-cli-provider is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 2:42 a.m.26 views

Malicious Package

Overview wallet-security-checker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 2:42 a.m.26 views

Malicious Package

Overview solidity-deploy-guard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/22 2:42 a.m.26 views

Malicious Package

Overview foundy-toolkit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/21 9:49 p.m.26 views

Insecure Randomness

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

6.3CVSS5.8AI score0.003EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/21 9:43 p.m.26 views

Division by zero

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

4.8CVSS5.8AI score0.0015EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/21 9:42 p.m.26 views

Off-by-one Error

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

6.9CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/21 9:42 p.m.26 views

Off-by-one Error

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

6.9CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/21 9:42 p.m.26 views

Off-by-one Error

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

6.9CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/20 10:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals an obfuscated payload designed to steal developer credentials during the package installation. The malicious versions are still available on the official package manager. Malware Behaviour The attac...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/20 3:35 p.m.26 views

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Parser::cleanup function. Symfony\Component\Yaml\Parser::cleanup strips the optional %YAML directive header, leading comments, and document start/end markers before parsing. The origina...

8.7CVSS5.8AI score0.00684EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/19 7:46 p.m.26 views

Untrusted Search Path

Overview @turbo/workspaces is a Tools for working with package managers Affected versions of this package are vulnerable to Untrusted Search Path in the package manager detection. An attacker can execute arbitrary code by placing a malicious .yarnrc.yml file with a controlled yarnPath in a...

9.8CVSS6.2AI score0.00386EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/19 3:24 p.m.26 views

Malicious Package

Overview is-really-odd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential-stealing payload and worm propagation logic. A malicious actor associated with the "TeamPCP" or "Mini Shai-Hulud" campaign compromised a maintainer's access token; this allowed the...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 8:37 p.m.26 views

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the MSL decoder. An attacker can cause a denial of service by submitting a specially crafted MSL image that triggers a heap use-after-free condition. Remediation A fix was pushed into the master branch but not yet...

7.5CVSS5.8AI score0.00301EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 8:37 p.m.26 views

Use After Free

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

7.5CVSS5.8AI score0.00301EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 5:52 p.m.26 views

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following during docker cp mount setup due to the switching from GetResourcePath and to createIfNotExists method that has no absolute path checks. An attacker can create empty files or directories at arbitrary...

6.1CVSS5.9AI score0.00108EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 2:07 a.m.26 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in various respons.text invocations in response-handler.ts, which accept and buffer arbitrarily long request strings. Functions like createJsonResponseHandler and...

6.9CVSS5.9AI score0.00561EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/15 6:17 a.m.26 views

Authentication Bypass by Primary Weakness

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness via the...

8.8CVSS7.8AI score0.20783EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/14 3:23 p.m.26 views

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following via the pgbasebackup or pgrewind process. An attacker can overwrite arbitrary files on the local system by leveraging symlink following, potentially hijacking the operating system account. This is on...

8.8CVSS7.7AI score0.00324EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 3:23 p.m.26 views

Use of Inherently Dangerous Function

Overview Affected versions of this package are vulnerable to Use of Inherently Dangerous Function via the PQfn function when called with resultisint=0 in the loexport, loread, lolseek64, and lotell64 functions. An attacker can overwrite client stack memory with arbitrary data by sending a special...

8.8CVSS7.6AI score0.00454EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 3:23 p.m.26 views

Stack-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the refint process. An attacker can execute arbitrary code as the operating system user running the database or execute arbitrary SQL as the database user performing a primary key update by providing...

8.8CVSS8.1AI score0.0037EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/13 8:02 p.m.26 views

SQL Injection

Overview @strapi/content-type-builder is a Create and manage content types Affected versions of this package are vulnerable to SQL Injection via the column.defaultTo attribute in the content type creation or modification. An attacker can execute arbitrary database statements by supplying crafted...

9.3CVSS6.7AI score0.01178EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/12 9:20 p.m.26 views

Dependency on Vulnerable Third-Party Component

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Dependency on Vulnerable Third-Party Component through the use of a vulnerable third-party component. An attacker can cause the application to crash by sending specially...

8.7CVSS5.8AI score0.00508EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/12 7:23 p.m.26 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to improper bounds checking in memory operations. An attacker can execute arbitrary code or escalate privileges by supplying crafted input to the affected process. Remediation Upgrade...

8.3CVSS6.2AI score0.00551EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/12 7:22 p.m.26 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound due to improper validation of user-supplied input in the authentication process. An attacker can gain elevated privileges by providing crafted input during local interaction. Remediation Upgrade...

8.3CVSS5.8AI score0.00662EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/12 3:06 p.m.26 views

Arbitrary Code Injection

Overview protobufjs is a protocol buffer for JavaScript & TypeScript. Affected versions of this package are vulnerable to Arbitrary Code Injection in the toObject function when handling a schema-controlled bytes field default value. An attacker can execute arbitrary JavaScript code by providing a...

8.8CVSS6.2AI score0.00407EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.26 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 6:31 p.m.26 views

Allocation of Resources Without Limits or Throttling

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the...

8.7CVSS5.8AI score0.00351EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/10 12:06 a.m.26 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the GDSDfldsrch function of the Grid File Handler component. An attacker can execute arbitrary code or cause a denial of service by supplying crafted input that triggers a heap-based buffer overflow during...

5.5CVSS6.6AI score0.00258EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/08 4:32 p.m.26 views

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

8.8CVSS6.1AI score0.00363EPSS
SaveExploits1References2
Total number of security vulnerabilities5000