Lucene search
+L
SnykMost viewed

42357 matches found

Snyk
Snyk
added 2026/05/07 6:30 p.m.38 views

Allocation of Resources Without Limits or Throttling

Overview youtube-regex is a The correct Youtube video id regex! Regex done right! Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the regex param. An attacker can cause excessive resource consumption by supplying crafted input that...

8.7CVSS5.8AI score0.00278EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/01 9:47 p.m.38 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Request.post function. An attacker can cause excessive memory allocation by sending a specially crafted multipart request containing large non-file fields. Remediation Upgrade...

6.9CVSS5.9AI score0.00384EPSS
SaveExploits0References2
Snyk
Snyk
added 2025/10/27 6:31 p.m.38 views

Relative Path Traversal

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Relative Path Traversal via the URL normalization. An attacker can bypass security constraints and access restricted directories such as /WEB-INF/ and /META-INF/...

7.7CVSS9.1AI score0.66535EPSS
SaveExploits4References2
Snyk
Snyk
added 2020/12/25 11:08 a.m.38 views

Cross-site Scripting (XSS)

Overview vis-timeline is a Timeline/Graph2D is an interactive visualization chart to visualize data in time Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker with the ability to control the items of a Timeline element can inject additional script code into...

6.8CVSS5.2AI score0.01444EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/27 11:00 p.m.37 views

Malicious Package

Overview bigops-watchdog-worker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 11:00 p.m.37 views

Malicious Package

Overview mcp-server-iehub-proxy is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 11:00 p.m.37 views

Malicious Package

Overview pfa-autotests-reporter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 8:43 p.m.38 views

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information due to the incorrect protocol check in the helmet middleware, which fails to set the Strict-Transport-Security header even when configured. An attacker can intercept and manipulate network...

6.3CVSS6AI score0.00178EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/01 10:17 p.m.37 views

Prototype Pollution

Overview jodit is a Jodit is awesome and usefully wysiwyg editor with filebrowser Affected versions of this package are vulnerable to Prototype Pollution via the ConfigMerge and ConfigProto helpers in the configuration code. An attacker can mutate Object.prototype by supplying user-controlled...

6.5CVSS6.5AI score0.00273EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 6:18 p.m.37 views

Deserialization of Untrusted Data

Overview ray is an A system for parallel and distributed Python that unifies the ML ecosystem. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the readwebdataset function. An attacker can execute arbitrary code on remote workers by supplying a specially...

8.8CVSS6.4AI score0.00553EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/23 5:24 p.m.37 views

Prototype Pollution

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to Prototype Pollution via the Microsoft SQL node’s createTableStruct and related table-grouping logic in MicrosoftSql.node.ts and GenericFunctions.ts. An authenticated user who can create or modify...

8.5CVSS6.6AI score0.00294EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 8:11 p.m.37 views

Improper Validation of Certificate with Host Mismatch

Overview Affected versions of this package are vulnerable to Improper Validation of Certificate with Host Mismatch in the serverhostname parameter handling during HTTPS connection reuse. An attacker can bypass intended TLS SNI checks by reusing an existing connection with a different...

7.5CVSS5.3AI score0.00266EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/11 6:01 a.m.37 views

Malicious Package

Overview crypto-javascript is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/10 2:30 p.m.37 views

Malicious Package

Overview nw-demo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.37 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.37 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/02 9:00 p.m.37 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.37 views

Malicious Package

Overview nottuff24 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate advertisin...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:09 a.m.37 views

Malicious Package

Overview cms-storehub is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 11:48 p.m.37 views

Creation of Temporary File With Insecure Permissions

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions via the...

7.8CVSS7.6AI score0.00215EPSS
SaveExploits2References2
Snyk
Snyk
added 2026/05/13 3:29 p.m.37 views

Deserialization of Untrusted Data

Overview langchain is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Deserialization of Untrusted Data when fetching and processing prompt manifests from external sources. An attacker can execute arbitrary code or manipulate application...

7.1CVSS6.2AI score0.00199EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/08 8:34 p.m.37 views

Type Confusion

Overview Affected versions of this package are vulnerable to Type Confusion in code compilation. An attacker can execute arbitrary code by providing malicious input. Notes: This is only exploitable if the system compiles untrusted or attacker-controlled code. Workaround This vulnerability can be...

8.2CVSS6.2AI score0.00125EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/08 6:46 p.m.37 views

Unsafe Dependency Resolution

Overview electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the handling of protocol URLs or command-line options. An attacker can execute arbitrary local code by enticing a user to click a...

9.6CVSS6.1AI score0.00363EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/04 8:14 p.m.37 views

Arbitrary Code Injection

Overview pyp2spec is a Generate a valid Fedora specfile from Python package from PyPI Affected versions of this package are vulnerable to Arbitrary Code Injection in the process of writing package metadata into the generated spec file without escaping RPM macro directives. An attacker can execute...

8.5CVSS6.1AI score0.00198EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/16 9:44 p.m.37 views

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the customReadCSVFunc process. An attacker can execute arbitrary code on the server by supplying malicious input that is interpolated and executed without proper sanitization...

9.9CVSS6.2AI score0.0145EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/08 8:13 p.m.37 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the GraphQL query batching endpoint. An attacker can exhaust server resources by sending a single HTTP request containing a large number of operations, bypassing per-query...

8.7CVSS5.8AI score0.00435EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/30 8:13 p.m.36 views

Malicious Package

Overview streak-metrics-math is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 10:35 p.m.36 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the CombinedResourceInfo process. An attacker can cause excessive memory consumption and potentially exhaust server resources by submitting forged combined-resource IDs that inflate to large outputs and are...

8.7CVSS5.9AI score
SaveExploits0References5
Snyk
Snyk
added 2026/07/21 7:36 p.m.36 views

Missing Authorization

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization through the built-in browser commands in @vitest/browser and the browser provider RPC handlers. An attacker can read, create, overwrite, or delete local files by...

9.2CVSS6AI score
SaveExploits0References4
Snyk
Snyk
added 2026/07/13 8:17 a.m.36 views

Malicious Package

Overview prettier-plugin-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 8:16 p.m.36 views

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' when dispatching HTTP requests to endpoint attributes via getattr. An attacker can invoke internal...

6.3CVSS5.5AI score0.00213EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 8:09 p.m.36 views

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the DigestAuthMiddleware class when authentication responses are sent after following cross-origin redirects. An attacker can obtain authentication digests by leveraging an open redirect or simil...

6.3CVSS5.9AI score0.00178EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/06 9:00 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code containing a malicious binding.gyp file that drops and runs a self-propagating cloud secret stealer. The malicious code attempts to exfiltrate AWS, GCP, Azure, Vault, and Kubernetes credentials, as well as npm an...

9.8CVSS5.6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/20 3:35 p.m.36 views

User Impersonation

Overview symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. Affected versions of this package are vulnerable to User...

9.1CVSS5.9AI score0.0033EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/30 5:25 p.m.36 views

Open Redirect

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Open Redirect in the CommandLinker class. An attacker can steal authentication tokens and gain unauthorized access to user accounts by convincing a user to open a malicious notebook...

8.8CVSS6AI score0.00476EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/04/18 3:22 a.m.36 views

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the XWD decoder when there is a type confusion between bitsperpixel and pixmapdepth during the byte-swap process. An attacker can achieve arbitrary code execution or cause a denial of service by providing a crafte...

9.8CVSS6.4AI score0.00332EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/16 1:20 a.m.36 views

Insertion of Sensitive Information into Log File

Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File through the Client handling of events. An attacker can bypass redaction controls and...

6.3CVSS5.8AI score0.00214EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/04/10 5:06 p.m.36 views

Improper Output Neutralization for Logs

Overview org.apache.logging.log4j:log4j-core is a logging library for Java. Affected versions of this package are vulnerable to Improper Output Neutralization for Logs in the Rfc5424Layout plugin due to newLineEscape and useTlsMessageFormat configuration attributes being silently renamed, leading...

7.7CVSS5.7AI score0.00831EPSS
SaveExploits0References2
Snyk
Snyk
added 2025/11/24 8:33 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

9.8CVSS6.8AI score
SaveExploits0References3
Snyk
Snyk
added 2025/05/05 9:31 a.m.36 views

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to insufficient validation of XML input in crafted URL paths. An attacker can read files from the server's filesystem or perform denial-of-service attacks by supplying malicious XML content. Note:...

9.1CVSS7.5AI score0.01287EPSS
SaveExploits0References2
Snyk
Snyk
added 2025/04/25 3:02 p.m.36 views

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection via the template rendering engine. An attacker can execute arbitrary code on the server by injecting malicious code into templates that are then executed by the serve...

10CVSS8AI score0.99837EPSS
SaveExploits18References2
Snyk
Snyk
added 2026/07/30 10:51 p.m.35 views

Malicious Package

Overview ethers.json is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/30 10:07 p.m.35 views

Malicious Package

Overview @nordea-web/ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/30 10:02 p.m.35 views

Malicious Package

Overview chalk-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/30 9:43 p.m.35 views

Malicious Package

Overview @ethers-sdk/ethers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/29 3:04 p.m.35 views

Malicious Package

Overview ts-bn-proto is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 11:00 p.m.35 views

Malicious Package

Overview cccmyssr3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 9:12 p.m.35 views

Incorrect Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization via the assign process. An attacker can gain unauthorized access to other applications and assign elevated roles to themselves or other users by exploiting insufficient...

8.8CVSS5.9AI score
SaveExploits0References4
Snyk
Snyk
added 2026/07/22 10:59 p.m.35 views

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the areAllActionIdsValid validation in server action form submission handling. An attacker can exhaust CPU and block other requests in the same...

8.2CVSS5.9AI score0.00599EPSS
SaveExploits0References2
Total number of security vulnerabilities5000