Lucene search
+L
SnykMost viewed

42553 matches found

Snyk
Snyk
added 2026/05/07 9:28 p.m.20 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fetchPeerConnectInfo function. An attacker can access sensitive internal resources by supplying crafted URLs to the server, which are then requested on behalf of the authenticated user. Remediati...

7.7CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/07 8:26 p.m.20 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the SWfinfo function of the HDF-EOS Grid File Handler componet. An attacker can cause a denial of service by supplying a specially crafted HDF-EOS swath file with an empty or single-character DimList value...

5.5CVSS5.8AI score0.00264EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/07 1:15 a.m.20 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the downloadFrom and webhook processes. An attacker can access internal network resources and potentially exfiltrate sensitive information or interact with internal-only services by supplying special...

9.4CVSS5.8AI score0.00352EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/06 9:43 p.m.20 views

Cross-site Scripting (XSS)

Overview @jupyterlab/notebook-extension is a JupyterLab - Notebook Extension Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute arbitrary...

9.3CVSS5.9AI score0.00349EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 9:19 p.m.20 views

Incorrect Authorization

Overview @openclaw/matrix is an OpenClaw Matrix channel plugin Affected versions of this package are vulnerable to Incorrect Authorization via the DM pairing-store process. An attacker can gain unauthorized access to privileged room control commands by leveraging DM-paired sender IDs to bypass...

8.8CVSS5.8AI score0.00288EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 7:32 p.m.20 views

Binding to an Unrestricted IP Address

Overview Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address which defaults to 0.0.0.0 when the -port argument is used or the -listen argument is used without specifying a host. An attacker can execute arbitrary code remotely by connecting to the exposed...

8.8CVSS5.9AI score0.00223EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 5:34 p.m.20 views

Prototype Pollution

Overview next-intl is an Internationalization i18n for Next.js Affected versions of this package are vulnerable to Prototype Pollution in the setNestedProperty function when processing translation catalog keys containing reserved properties such as proto, constructor, or prototype. An attacker ca...

6.6CVSS6.3AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 5:05 p.m.20 views

Incorrect Authorization

Overview auth0-js is an Auth0 headless browser sdk Affected versions of this package are vulnerable to Incorrect Authorization via token validation. An attacker can gain unauthorized access to user profile information by providing a specifically crafted invalid ID token along with a valid access...

6CVSS5.8AI score0.00211EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 10:21 p.m.20 views

Improper Validation of Array Index

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Improper Validation of Array Index via the getinputpositionstensor function. An attacker can cause the service to terminate or become unavailable by...

7.5CVSS5.8AI score0.00414EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/05 6:43 p.m.20 views

Arbitrary Code Injection

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Arbitrary Code Injection in the setup-api.js loading process. An attacker can execute arbitrary code by placing a malicious setup-api.js file in the extensions// directory of a repository...

8.5CVSS6.2AI score0.00144EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 3:27 p.m.20 views

Malicious Package

Overview @bold-commerce/stacks-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/04 5:18 a.m.20 views

Arbitrary Argument Injection

Overview prefect is a Prefect is a new workflow management system, designed for modern infrastructure and powered by the open-source Prefect Core workflow engine. Users organize Tasks into Flows, and Prefect takes care of the rest. Affected versions of this package are vulnerable to Arbitrary...

6.5CVSS6.6AI score0.00247EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/04 3:02 a.m.20 views

Malicious Package

Overview @apiary-annex/meta is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/04 12:00 a.m.20 views

Malicious Package

Overview @bcs-adapters/keycloak-api-adapter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/03 12:31 a.m.20 views

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview sglang is a SGLang is a fast serving framework for large language models and vision language models. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the gettokenizer function in the...

6.3CVSS5.8AI score0.00368EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/02 3:31 a.m.20 views

Arbitrary Command Injection

Overview yii2-mcp-server is a MCP Server for Yii2 Framework - Database schema inspection, command execution, and project management Affected versions of this package are vulnerable to Arbitrary Command Injection via the yiicommandhelp or yiiexecutecommand functions in the MCP Interface. An attack...

6.5CVSS6.1AI score0.0111EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/01 5:07 p.m.20 views

Cross-site Scripting (XSS)

Overview jsondiffpatch is a JSON diff & patch object and array diff, text diff, multiple output formats Affected versions of this package are vulnerable to Cross-site Scripting XSS via the annotated formatter due to improper sanitization of JSON values and property names. If an application compar...

6.1CVSS5.5AI score0.00191EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/30 5:28 p.m.20 views

Insufficient Session Expiration

Overview weblate is an A web-based continuous localization system with tight version control integration Affected versions of this package are vulnerable to Insufficient Session Expiration through the SetPasswordForm and resetpassword/resetapikey account handlers in the accounts component. An...

6.3CVSS5.7AI score0.0027EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/29 10:44 p.m.20 views

Embedded Malicious Code

Overview tanstack is a TanStack Player — A developer-first, universal Video Player SDK built on Video.js with headless hooks, plugin architecture, and React-first DX Affected versions of this package are vulnerable to Embedded Malicious Code that exfiltrates environment variables from developers'...

9.8CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/29 12:00 a.m.20 views

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error via the reuse of an easy handle in HTTP requests when a custom Host: header is set for the initial request and omitted in a subsequent one. An attacker can obtain cookies intended for a different host by exploiti...

7.5CVSS5.8AI score0.00295EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/29 12:00 a.m.20 views

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the reuse of a proxy connection during HTTP redirects when using .netrc for credentials. An attacker can obtain sensitive credential information by intercepting traffic if both the...

6.5CVSS5.8AI score0.00519EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/28 10:00 p.m.20 views

Malicious Package

Overview @meme-sdk/trade is a malicious package. This package contains malicious code, and its content was not yet removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/24 7:43 p.m.20 views

Malicious Package

Overview modern-events is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/24 7:20 p.m.20 views

Incomplete List of Disallowed Inputs

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the isLoopback host check in the proxy helper, which relied on a static list of LOOPBACKADDRESSES. An attacker can route requests...

10CVSS5.4AI score0.01186EPSS
SaveExploits2References3
Snyk
Snyk
added 2026/04/23 3:07 p.m.20 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via import flow. An attacker can gain remote code execution using company creation endpoint that improperly checks for admin rights in authenticated mode deployment with default configuration. Remediation Upgrade...

10CVSS6.5AI score0.04673EPSS
SaveExploits5References2
Snyk
Snyk
added 2026/04/23 3:56 a.m.20 views

Malicious Package

Overview vime-azl is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/22 1:53 a.m.20 views

Malicious Package

Overview crypto-keccak-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/21 12:00 a.m.20 views

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the Information Schema component. An attacker can gain unauthorized access to sensitive data by sending crafted requests over the network. Remediation Upgrade libmysqlclient to versi...

5.3CVSS7.8AI score0.00243EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/21 12:00 a.m.20 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the InnoDB component. An attacker can cause the server to hang or repeatedly crash by sending crafted requests over the network with high privileges. Remediation Upgrade...

6.9CVSS7.7AI score0.00323EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/21 12:00 a.m.20 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Optimizer component. An attacker can cause the server to hang or crash repeatedly by sending specially crafted requests over the network. This is only exploitable if the...

6.9CVSS7.7AI score0.00323EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/17 10:42 p.m.20 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the GitHub OAuth callback handler when the refreshInterval query parameter is embedded verbatim into an error message and rendered unescaped into HTML. An attacker can execute arbitrary JavaScript in the...

6.1CVSS5.5AI score0.00209EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/17 12:00 a.m.20 views

HTTP Request Smuggling

Overview org.springframework:spring-webflux is a Spring Framework module that contains support for reactive HTTP and WebSocket clients as well as for reactive server web applications including REST, HTML browser, and WebSocket style interactions. Affected versions of this package are vulnerable t...

5.9CVSS5.7AI score0.00236EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/16 10:48 p.m.20 views

Insufficient Granularity of Access Control

Overview Affected versions of this package are vulnerable to Insufficient Granularity of Access Control inadequate authorization checks in the POST /api/agents/:id/keys, GET /api/agents/:id/keys, and DELETE /api/agents/:id/keys/:keyId routes. An attacker can gain unauthorized access to sensitive...

8.5CVSS5.8AI score
SaveExploits0References4
Snyk
Snyk
added 2026/04/16 10:47 p.m.20 views

Missing Authentication for Critical Function

Overview @paperclipai/ui is a Prebuilt Paperclip board UI assets. Affected versions of this package are vulnerable to Missing Authentication for Critical Function in several API endpoints that lack proper authentication checks. An attacker can access sensitive data, perform state-changing...

8.7CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/14 11:27 p.m.20 views

HTTP Response Splitting

Overview Affected versions of this package are vulnerable to HTTP Response Splitting via the MailAddressParser.TryParseAddress function due to improper neutralisation of CRLF sequences. An attacker can impersonate another user or entity by sending specially crafted data over the network...

8.7CVSS6.2AI score0.02279EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/14 10:32 p.m.20 views

Arbitrary Argument Injection

Overview mcp-server-kubernetes is a MCP server for interacting with Kubernetes clusters via kubectl Affected versions of this package are vulnerable to Arbitrary Argument Injection through the startPortForward function in src/tools/portforward.ts. An attacker can inject additional kubectl flags b...

8.7CVSS5.8AI score0.00258EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 10:11 p.m.20 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the MVG decoder. An attacker can cause a denial of service by submitting a specially crafted image file that causes an out-of-bounds write. Remediation A fix was pushed into the master branch but not yet...

8.8CVSS5.8AI score0.00566EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 5:15 p.m.20 views

Expired Pointer Dereference

Overview Affected versions of this package are vulnerable to Expired Pointer Dereference in the lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile modules. An attacker can execute arbitrary code or access sensitive information by triggering a use-after-free condition through repeated...

9.2CVSS6.1AI score0.00579EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 3:25 p.m.20 views

Malicious Package

Overview @mx-shared/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 3:25 p.m.20 views

Malicious Package

Overview wm-plugin-visions-recorder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/13 3:25 p.m.20 views

Malicious Package

Overview ccn-common-react-library is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/09 11:08 p.m.20 views

Integer Underflow (Wrap or Wraparound)

Overview Affected versions of this package are vulnerable to Integer Underflow Wrap or Wraparound via the sslDecodePacket process. An attacker can cause a program crash and trigger a large out-of-bounds read by injecting a malformed TLS Application Data record that is shorter than the required...

6.5CVSS5.8AI score0.00225EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/09 10:10 p.m.20 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the CertFromX509 function when processing the AuthorityKeyIdentifier extension due to incorrect size handling. An attacker can cause a heap buffer overflow by supplying a specially crafted X.509 certificate...

7.5CVSS6AI score0.00222EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/08 9:10 p.m.20 views

Allocation of Resources Without Limits or Throttling

Overview react-server-dom-parcel is a React Server Components bindings for DOM using Parcel. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling...

8.7CVSS5.8AI score0.01551EPSS
SaveExploits4References3
Snyk
Snyk
added 2026/04/08 12:18 a.m.20 views

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the eventstream decoder process. An attacker can cause the host process to terminate unexpectedly by sending a crafted EventStream response frame containing a header value type byte outside the valid range...

8.2CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/07 11:09 p.m.20 views

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the CMSdecrypt function. An attacker can cause a crash by submitting a specially crafted CMS EnvelopedData message with a missing optional parameters field in the KeyEncryptionAlgorithmIdentifier, leading to ...

8.2CVSS5.8AI score0.00805EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/06 4:10 p.m.20 views

SQL Injection

Overview glpi/glpi is a free Asset and IT Management Software package with ITIL Service Desk, licenses tracking and software auditing. Affected versions of this package are vulnerable to SQL Injection via the Search process. An attacker can execute arbitrary SQL commands on the underlying databas...

9.8CVSS6.2AI score0.08741EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/02 9:00 p.m.20 views

Malicious Package

Overview strapi-plugin-blurhash is a malicious package. This package contains malicious code that conceals a command-and-control agent and credential harvester. A malicious actor published a coordinated campaign of thirty-six packages disguised as community Strapi CMS plugins. These packages aren...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/02 2:26 p.m.20 views

Directory Traversal

Overview opencart/opencart is a shopping cart system Affected versions of this package are vulnerable to Directory Traversal via the installer.php process. An attacker can access or modify files outside the intended directory by submitting crafted input remotely. Details A Directory Traversal...

5.8CVSS6.5AI score0.00396EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/01 9:10 a.m.20 views

Malicious Package

Overview @logcore/pino-pretty-logger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.9AI score
SaveExploits0References2
Total number of security vulnerabilities5000