Lucene search
+L
SnykMost viewed

42530 matches found

Snyk
Snyk
added 2026/04/17 12:00 a.m.20 views

HTTP Request Smuggling

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

5.9CVSS5.7AI score0.00236EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/16 10:48 p.m.20 views

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control inadequate authorization checks in the POST /api/agents/:id/keys, GET /api/agents/:id/keys, and DELETE /api/agents/:id/keys/:keyId routes. An attacker can gain unauthorized access to sensitive...

8.5CVSS5.8AI score
SaveExploits0References4
Snyk
Snyk
added 2026/04/16 10:47 p.m.20 views

Missing Authentication for Critical Function

Overview @paperclipai/ui is a Prebuilt Paperclip board UI assets. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in several API endpoints that lack proper authentication checks. An attacker can access sensitive data, perform state-changing...

8.7CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/14 11:27 p.m.20 views

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the MailAddressParser.TryParseAddress function due to improper neutralisation of CRLF sequences. An attacker can impersonate another user or entity by sending specially crafted data over the network...

8.7CVSS6.2AI score0.02279EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/14 10:32 p.m.20 views

Arbitrary Argument Injection

Overview mcp-server-kubernetes is a MCP server for interacting with Kubernetes clusters via kubectl Affected versions of this package are vulnerable to Arbitrary Argument Injection through the startPortForward function in src/tools/portforward.ts. An attacker can inject additional kubectl flags b...

8.7CVSS5.8AI score0.00258EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 10:11 p.m.20 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the MVG decoder. An attacker can cause a denial of service by submitting a specially crafted image file that causes an out-of-bounds write. Remediation A fix was pushed into the master branch but not yet...

8.8CVSS5.8AI score0.00566EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 5:15 p.m.20 views

Expired Pointer Dereference

Overview Affected versions of this package are vulnerable to Expired Pointer Dereference in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile modules. An attacker can execute arbitrary code or access sensitive information by triggering a use-after-free condition through repeated...

9.2CVSS6.1AI score0.00579EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 3:25 p.m.20 views

Malicious Package

Overview @mx-shared/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 3:25 p.m.20 views

Malicious Package

Overview wm-plugin-visions-recorder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 3:25 p.m.20 views

Malicious Package

Overview ccn-common-react-library is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/09 11:08 p.m.20 views

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound via the sslDecodePacket process. An attacker can cause a program crash and trigger a large out-of-bounds read by injecting a malformed TLS Application Data record that is shorter than the required...

6.5CVSS5.8AI score0.00225EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/09 10:10 p.m.20 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the CertFromX509 function when processing the AuthorityKeyIdentifier extension due to incorrect size handling. An attacker can cause a heap buffer overflow by supplying a specially crafted X.509 certificate...

7.5CVSS6AI score0.00222EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/08 9:10 p.m.20 views

Allocation of Resources Without Limits or Throttling

Overview react-server-dom-parcel is a React Server Components bindings for DOM using Parcel. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling...

8.7CVSS5.8AI score0.01551EPSS
SaveExploits4References3
Snyk
Snyk
added 2026/04/08 12:18 a.m.20 views

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the eventstream decoder process. An attacker can cause the host process to terminate unexpectedly by sending a crafted EventStream response frame containing a header value type byte outside the valid range...

8.2CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/07 11:09 p.m.20 views

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the CMSdecrypt function. An attacker can cause a crash by submitting a specially crafted CMS EnvelopedData message with a missing optional parameters field in the KeyEncryptionAlgorithmIdentifier, leading to ...

8.2CVSS5.8AI score0.00805EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/06 4:10 p.m.20 views

SQL Injection

Overview glpi/glpi is a free Asset and IT Management Software package with ITIL Service Desk, licenses tracking and software auditing. Affected versions of this package are vulnerable to SQL Injection via the Search process. An attacker can execute arbitrary SQL commands on the underlying databas...

9.8CVSS6.2AI score0.08741EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/02 9:00 p.m.20 views

Malicious Package

Overview strapi-plugin-blurhash is a malicious package. This package contains malicious code that conceals a command-and-control agent and credential harvester. A malicious actor published a coordinated campaign of thirty-six packages disguised as community Strapi CMS plugins. These packages aren...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/02 2:26 p.m.20 views

Directory Traversal

Overview opencart/opencart is a shopping cart system Affected versions of this package are vulnerable to Directory Traversal via the installer.php process. An attacker can access or modify files outside the intended directory by submitting crafted input remotely. Details A Directory Traversal...

5.8CVSS6.5AI score0.00396EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/01 9:10 a.m.20 views

Malicious Package

Overview base-or-engine is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/01 9:10 a.m.20 views

Malicious Package

Overview @logcore/pino-pretty-logger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/31 4:54 p.m.20 views

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the mediaUrl and fileUrl parameters in the message tool. An attacker can access arbitrary files on the local filesystem by supplying specially crafted requests tha...

8.6CVSS6.5AI score0.00555EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/31 2:29 a.m.20 views

Cross-site Scripting (XSS)

Overview baserproject/basercms is a Content management system based on CakePHP. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the tag creation process. An attacker can execute arbitrary scripts in the context of the user's browser by crafting malicious input...

7.1CVSS7.3AI score0.00258EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/30 2:05 a.m.20 views

Arbitrary File Write via Archive Extraction (Zip Slip)

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Arbitrary File Write via Archive Extraction Zip Slip via the...

10CVSS7.7AI score0.00579EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/27 3:07 a.m.20 views

Malicious Package

Overview testtestsharp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/26 10:09 p.m.20 views

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

4.6CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/26 9:53 p.m.20 views

Information Exposure

Overview apollo-server-core is a core module of the Apollo community GraphQL Server. Affected versions of this package are vulnerable to Information Exposure in the request handling process. An attacker can infer sensitive information about server responses by issuing specially crafted...

6.3CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/26 7:14 p.m.20 views

Out-of-bounds Write

Overview Magick.NET-Q16-HDRI-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

5.9CVSS6.4AI score0.00128EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/03/26 6:34 p.m.20 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal in the AdvancedLoggingJSON configuration during support packet generation. An attacker can access arbitrary files on the host system by supplying a malicious file path. Details A Directory Traversal attack also known...

6.8CVSS6.5AI score0.00421EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/26 6:07 p.m.20 views

Brute Force

Overview wwbn/avideo is an Audio and Video Platform or simply "A Video Platform". Affected versions of this package are vulnerable to Brute Force via the getapivideopasswordiscorrect API endpoint, which allows unauthenticated users to verify passwords for protected videos without rate limiting or...

6.9CVSS5.8AI score0.0032EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/25 9:07 p.m.20 views

Arbitrary Code Injection

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Arbitrary Code Injection via the Merge node's Combine by SQL mode. An authenticated user with permissions to create or modify workflows can execute arbitrary code and access sensitive files on the...

9.4CVSS6.3AI score0.00951EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/19 11:00 p.m.20 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. The publishing pipeline of this package was compromised as the result of Trivy's GitHub Actions compromise and a malicious versions were released on NPM. They contain malicious code, and its content was NOT yet...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/19 7:13 p.m.20 views

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:fast-xml-parser is a Validate XML, Parse XML, Build XML without C/C++ based libraries Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input in the DocTypeReader component when the maxEntityCount or maxEntitySize configurati...

8.2CVSS5.8AI score0.00449EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/17 5:12 p.m.20 views

Out-of-bounds Write

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

7.5CVSS5.8AI score0.00475EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/13 8:03 p.m.20 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchKey function. An attacker can cause the server to make arbitrary HTTP requests to attacker-controlled destinations by crafting a JWT with malicious claim values that are interpolated into th...

9.3CVSS5.9AI score0.00258EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/13 8:00 p.m.20 views

Cross-site Scripting (XSS)

Overview @oneuptime/common is a The OneUptime Common UI Library is a collection of shared components, utilities that are used across the OneUptime platform. It is designed to be easy to install and use, and to be extensible. This library is built with React and TypeScript. It includes c Affected...

7.6CVSS5.7AI score0.00224EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/03/12 4:23 p.m.20 views

Malicious Package

Overview no-type-assertion is a malicious package. This package was recognized as part of the 'PhantomRaven' supply chain campaign, which involves credential-stealing malware. The package impersonates well-known ecosystem plugins to deceive developers into installing it. Malicious Behavior The...

9.8CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
added 2026/03/12 2:09 p.m.20 views

Use After Free

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

7.5CVSS5.9AI score0.00243EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/11 9:11 p.m.20 views

Allocation of Resources Without Limits or Throttling

Overview Microsoft.AspNetCore.App.Runtime.linux-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling ...

8.7CVSS5.8AI score0.02818EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/03/06 7:14 a.m.20 views

Malicious Package

Overview @saferpay/logging is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/06 7:14 a.m.20 views

Malicious Package

Overview relay-github-root is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/06 7:14 a.m.20 views

Malicious Package

Overview pornhub is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/03/03 9:00 p.m.20 views

Template Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Template Injection via the craft.app.fs.write function in Twig templates. An attacker can execute arbitrary system commands and disclose sensitive information by injecting malicious payloads...

9.4CVSS5.9AI score0.01068EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/02/25 9:23 p.m.20 views

Arbitrary Code Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Arbitrary Code Injection via the Merge node's SQL query mode. An attacker can execute arbitrary code and write arbitrary files on the server by crafting malicious workflows after authenticating with...

9.9CVSS6.4AI score0.00765EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/02/06 6:50 a.m.20 views

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the uvcscanstreaming function in the UVC Descriptor Handler component. An attacker can cause a denial of service by triggering a null pointer dereference through local access. Remediation There is no fixed...

5.5CVSS5.6AI score0.0018EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/01/28 4:33 p.m.20 views

Malicious Package

Overview mona-service-commands is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/01/28 4:33 p.m.20 views

Malicious Package

Overview libnpmpublishing is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/01/28 4:33 p.m.20 views

Malicious Package

Overview bytes-guide is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/01/28 4:33 p.m.20 views

Malicious Package

Overview @douinfe/semi-illustrations is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/01/28 4:33 p.m.20 views

Malicious Package

Overview @metrics-service/mf-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/01/21 4:39 a.m.20 views

Malicious Package

Overview bitbot is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.5AI score
SaveExploits0References2
Total number of security vulnerabilities5000