Lucene search
+L
SnykMost viewed

42540 matches found

Snyk
Snyk
added 2026/07/22 11:06 p.m.19 views

Improper Encoding or Escaping of Output

Overview next is a react framework. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the IncrementalCache.generateCacheKey function in next/dist/server/lib/incremental-cache. An attacker can make a server-side fetch return a cached response body from...

6.3CVSS5.9AI score0.00351EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/22 11:00 p.m.19 views

Insertion of Sensitive Information Into Sent Data

Overview next is a react framework. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data in action-handler.ts and action-utils.ts. An attacker can enumerate internal Server Action IDs by sending crafted Next-Action requests or probing client-served...

6.3CVSS5.9AI score0.00516EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/22 10:10 p.m.19 views

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization via the genericAuthType in the HTTP Request node. An attacker can gain unauthorized access to credentials belonging to other users by referencing another user's credential...

8.2CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 11:26 p.m.19 views

Cross-site Request Forgery (CSRF)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the security.checkOrigin logic when middleware is absent or mounted after actions or pages in the...

7.4CVSS5.3AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 3:59 p.m.19 views

Malicious Package

Overview Rg.Plugins.Popups.Net is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 3:59 p.m.19 views

Malicious Package

Overview Modernial.UI.WinForm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.19 views

Malicious Package

Overview 866667576576582 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/17 6:21 p.m.19 views

Allocation of Resources Without Limits or Throttling

Overview mcp is a The official Ruby SDK for Model Context Protocol servers and clients Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handlepost method of lib/mcp/server/transports/streamablehttptransport.rb, which reads the entire...

8.7CVSS5.5AI score0.00431EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 4:35 p.m.19 views

Server-side Request Forgery (SSRF)

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the file-import-from-URL. An attacker can access internal network resources by supplying the address 0.0.0.0 to th...

7.7CVSS5.7AI score0.00407EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 10:27 p.m.19 views

CSV Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to CSV Injection through the postActivityReport process. An attacker can cause arbitrary formula execution in spreadsheet software by injecting a specially crafted User-Agent...

7.3CVSS6.3AI score0.00425EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 6:31 p.m.19 views

Allocation of Resources Without Limits or Throttling

Overview adm-zip is a JavaScript implementation for zip data compression for NodeJS. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in zipEntry.js and entryHeader.js, which size a Buffer.alloc call directly from the uncompressed-size field...

8.7CVSS6.1AI score0.00609EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 4:35 p.m.19 views

Missing Authorization

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

7.1CVSS6.1AI score0.00413EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 10:18 a.m.19 views

Malicious Package

Overview nodemon-slint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 12:30 a.m.19 views

Symlink Attack

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Symlink Attack via the fs.link process. An attacker can gain unauthorized access to sensitive files or corrupt file contents by crafting an archive containing a hardlink...

6.9CVSS6.1AI score0.00301EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/08 10:39 p.m.19 views

Improper Handling of Highly Compressed Data (Data Amplification)

Overview httplib2 is a small HTTP client library for Python. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the decompressContent function in httplib2/init.py. An attacker can exhaust memory and crash the client by sendin...

7.5CVSS6.1AI score0.00423EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/08 10:37 p.m.19 views

Cross-site Scripting (XSS)

Overview @appium/base-driver is a Base driver class for Appium drivers Affected versions of this package are vulnerable to Cross-site Scripting XSS via compileLodashTemplate. An attacker can execute arbitrary JavaScript in the context of the server origin by injecting malicious input into the...

9.6CVSS6.2AI score0.00316EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/08 9:00 p.m.19 views

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper enforcement of the Certificate Revocation List on the gRPC listener when separate listeners are configured for HTTP and gRPC client endpoints. An attacker can gain unauthorized access and...

8.5CVSS6.1AI score0.0043EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 4:40 p.m.19 views

Buffer Access with Incorrect Length Value

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Buffer Access with Incorrect Length Value in the GDALRaster process when constructed from a bytes object. An attacker can access...

6.3CVSS6AI score0.00437EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 4:38 p.m.19 views

Improper Neutralization

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Improper Neutralization via the DomainNameValidator process. An attacker can inject arbitrary HTTP headers by submitting input...

6.1CVSS6AI score0.00327EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 4:17 p.m.19 views

Malicious Package

Overview warp-dependency is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 10:39 p.m.19 views

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the users.getUser method in the JSON-RPC API. An attacker can retrieve sensitive credential information, such as password hashes, TOTP secrets, and session tokens, by supplying...

8.6CVSS6.1AI score0.00448EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 9:35 p.m.19 views

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the ElementTableSorter.js process when a user with sufficient permissions drags an entry under a maliciously crafted entry in table view. An attacker can execute...

5.9CVSS5.8AI score0.00412EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 8:31 p.m.19 views

Insecure Temporary File

Overview linuxfabrik-lib is a Python libraries used in various Linuxfabrik projects, including the 'Linuxfabrik Monitoring Plugins' project. Affected versions of this package are vulnerable to Insecure Temporary File in the process that creates SQLite databases at predictable paths in /tmp. An...

5.1CVSS6.2AI score0.00184EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 7:00 p.m.19 views

Malicious Package

Overview winston-prism is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 5:29 p.m.19 views

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview weasyprint is a The Awesome Document Factory Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the processing of presentational hints when unescaped attribute values are embedded into CS...

6.9CVSS6.1AI score0.00273EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 8:35 a.m.19 views

Command Injection

Overview react-dev-utils is an includes some utilities used by Create React App. Affected versions of this package are vulnerable to Command Injection via the startBrowserProcess function in react-dev-utils/openBrowser.js. An attacker can execute arbitrary operating system commands by supplying...

9.8CVSS7.2AI score0.02109EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/03 12:17 p.m.19 views

Server-side Request Forgery (SSRF)

Overview @theia/request is a Theia Proxy-Aware Request Service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the request-service process. An attacker can access sensitive internal resources by sending crafted URLs to the backend, which then performs...

8.5CVSS5.9AI score0.00399EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 8:18 a.m.19 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the connection reuse process. An attacker can gain unauthorized access to resources or services by exploiting the reuse of an authenticated connection intended for a different service. Remediation Upgrade libcur...

8.1CVSS6AI score0.00543EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/03 8:18 a.m.19 views

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the Authorization header handling process. An attacker can cause sensitive authentication information to be sent to an unintended origin by reusing a handle for transfers to different HTTP origins...

9.8CVSS6AI score0.00604EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/02 8:25 p.m.19 views

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the HTTPArtifact::receive process. An attacker can gain unauthorized access to arbitrary user accounts by crafting a forged unsigned assertion from a malicious or lower-trust identity provider within t...

8.7CVSS6.1AI score0.00344EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/02 2:55 p.m.19 views

Malicious Package

Overview tailwind-animates is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 9:19 p.m.19 views

Directory Traversal

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Directory Traversal via the preprocess method in the FileExplorer component. An attacker can read arbitrary files outside the configured rootdir by...

8.7CVSS6.5AI score0.00933EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 9:19 p.m.19 views

Use of Cache Containing Sensitive Information

Overview api-platform/core is a builds a fully-featured hypermedia or GraphQL API in minutes. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the componentsCache process of the JSON:API and HAL item normalizers. An attacker can access attribute...

8.2CVSS6AI score0.00315EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 3:13 p.m.19 views

Malicious Package

Overview agent-starter-pack is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 2:23 p.m.19 views

Interpretation Conflict

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict in its parse, normalize, and equal functions, which call the nonexistent URL.domainToASCII static method and silently swallow the resulting...

8.7CVSS6.1AI score0.00384EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 1:00 p.m.19 views

Symlink Attack

Overview acl is a None Affected versions of this package are vulnerable to Symlink Attack. via the libacl functions. An attacker can gain unauthorized access to or modify access control lists by replacing a pathname component with a symbolic link, redirecting ACL read or write operations to...

8.4CVSS5.9AI score0.00153EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/28 7:36 p.m.19 views

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the decodedlta function. An attacker can cause memory corruption, potentially leading to information disclosure, data modification, or application crash by supplying a crafted media stream containing a malicious...

8.8CVSS7.9AI score0.00275EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 10:13 p.m.19 views

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection due to improper path validation in the AuthenticationFilter process. An attacker can execute arbitrary code with root privileges inside the worker container by bypassing authentication and creating or running workflows...

10CVSS6.3AI score0.01159EPSS
SaveExploits2References2
Snyk
Snyk
added 2026/06/26 2:08 a.m.19 views

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity in the Server.prototype.addContext method of lib/internal/tls/wrap.js, which builds the server name matching regular expression without the case-insensitive flag. An attacker can evade the TLS conte...

5.9CVSS6.5AI score0.00216EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 6:53 p.m.19 views

Allocation of Resources Without Limits or Throttling

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the TryDecompress process. An attacker can cause excessive memory allocation and potential...

7.5CVSS5.8AI score0.00405EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/25 5:07 p.m.19 views

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the token-read process. An attacker can generate unauthorized OAuth2 bearer tokens with arbitrary user, client, realm, and scope values by injecting attacker-controlled JSON into the...

7.1CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 5:46 a.m.19 views

Malicious Package

Overview ccl-component-resources is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/24 3:18 p.m.19 views

XML External Entity (XXE) Injection

Overview org.jenkins-ci.plugins:assembla is a plugin that integrates Jenkins with Assembla tickets during SCM update / Build. Affected versions of this package are vulnerable to XML External Entity XXE Injection via the XML parser. An attacker can extract sensitive information from the server or...

8.8CVSS6AI score0.00359EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/24 1:53 a.m.19 views

Malicious Package

Overview tailwind-textform-fill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/23 10:46 p.m.19 views

Open Redirect

Overview Flask-Security is a Simple security for Flask apps. Affected versions of this package are vulnerable to Open Redirect via the validateredirecturl function. An attacker can redirect users to an attacker-controlled domain by crafting a specially formatted URL containing a backslash in the...

5.3CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/22 9:20 a.m.19 views

SQL Injection

Overview doris-mcp-server is an Enterprise-grade Model Context Protocol MCP server implementation for Apache Doris Affected versions of this package are vulnerable to SQL Injection via the metadata query path. An attacker can gain unauthorized access to metadata outside the intended database scop...

8.1CVSS6AI score0.00561EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/20 9:00 p.m.19 views

Malicious Package

Overview @withgoogle/stitch-sdk is a malicious package. Although this package attempts to impersonate Google's Stitch AI design tool, there is no connection between Google and this package. By squatting the @withgoogle npm scope, a malicious actor published @withgoogle/stitch-sdk in an attempt to...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/19 9:42 p.m.19 views

External Control of File Name or Path

Overview network-ai is an AI agent orchestration framework for TypeScript/Node.js - 29 adapters LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Compu Affected version...

7.1CVSS6.1AI score
SaveExploits0References3
Snyk
Snyk
added 2026/06/19 8:47 p.m.19 views

Prototype Pollution

Overview flat-to-nested is a Convert a hierarchy from flat to nested representation. Affected versions of this package are vulnerable to Prototype Pollution in the convert function when processing input records containing specially crafted parent or id values such as proto. An attacker can inject...

8.7CVSS6.6AI score
SaveExploits0References3
Snyk
Snyk
added 2026/06/19 7:18 p.m.19 views

SQL Injection

Overview typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript ES5, ES6, ES7, ES8. Affected versions of this package are vulnerable to SQL Injection in the orderBy or...

8.8CVSS6.1AI score
SaveExploits0References2
Total number of security vulnerabilities5000