Lucene search
+L
SnykMost viewed

42356 matches found

Snyk
Snyk
added 2026/06/02 9:00 p.m.37 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that hides inside binary executable files triggered by a postinstall script. IronWorm is a sophisticated, Rust-based infostealer that functions as a self-replicating supply-chain attack. Its primary characteristi...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.37 views

Malicious Package

Overview nottuff24 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate advertisin...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:09 a.m.37 views

Malicious Package

Overview cms-storehub is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 11:48 p.m.37 views

Creation of Temporary File With Insecure Permissions

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Creation of Temporary File With Insecure Permissions via the...

7.8CVSS7.6AI score0.00215EPSS
SaveExploits2References2
Snyk
Snyk
added 2026/05/13 3:29 p.m.37 views

Deserialization of Untrusted Data

Overview langchain is a Building applications with LLMs through composability Affected versions of this package are vulnerable to Deserialization of Untrusted Data when fetching and processing prompt manifests from external sources. An attacker can execute arbitrary code or manipulate application...

7.1CVSS6.2AI score0.00199EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/08 8:34 p.m.37 views

Type Confusion

Overview Affected versions of this package are vulnerable to Type Confusion in code compilation. An attacker can execute arbitrary code by providing malicious input. Notes: This is only exploitable if the system compiles untrusted or attacker-controlled code. Workaround This vulnerability can be...

8.2CVSS6.2AI score0.00125EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/08 6:46 p.m.37 views

Unsafe Dependency Resolution

Overview electerm is an open-sourced terminal/ssh/telnet/serialport/sftp client Affected versions of this package are vulnerable to Unsafe Dependency Resolution in the handling of protocol URLs or command-line options. An attacker can execute arbitrary local code by enticing a user to click a...

9.6CVSS6.1AI score0.00363EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/04 8:14 p.m.37 views

Arbitrary Code Injection

Overview pyp2spec is a Generate a valid Fedora specfile from Python package from PyPI Affected versions of this package are vulnerable to Arbitrary Code Injection in the process of writing package metadata into the generated spec file without escaping RPM macro directives. An attacker can execute...

8.5CVSS6.1AI score0.00198EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/16 9:44 p.m.37 views

Arbitrary Code Injection

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Arbitrary Code Injection via the customReadCSVFunc process. An attacker can execute arbitrary code on the server by supplying malicious input that is interpolated and executed without proper sanitization...

9.9CVSS6.2AI score0.0145EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/08 8:13 p.m.37 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the GraphQL query batching endpoint. An attacker can exhaust server resources by sending a single HTTP request containing a large number of operations, bypassing per-query...

8.7CVSS5.8AI score0.00435EPSS
SaveExploits0References2
Snyk
Snyk
added 2020/12/25 11:08 a.m.37 views

Cross-site Scripting (XSS)

Overview vis-timeline is a Timeline/Graph2D is an interactive visualization chart to visualize data in time Affected versions of this package are vulnerable to Cross-site Scripting XSS. An attacker with the ability to control the items of a Timeline element can inject additional script code into...

6.8CVSS5.2AI score0.01444EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 11:00 p.m.36 views

Malicious Package

Overview dolyame-boxy-independent-bnpl-mobile-application is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 8:16 p.m.36 views

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' when dispatching HTTP requests to endpoint attributes via getattr. An attacker can invoke internal...

6.3CVSS5.5AI score0.00213EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/20 3:35 p.m.36 views

User Impersonation

Overview symfony/security-http is a provides an infrastructure for sophisticated authorization systems, which makes it possible to easily separate the actual authorization logic from so called user providers that hold the users credentials. Affected versions of this package are vulnerable to User...

9.1CVSS5.9AI score0.0033EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/30 5:25 p.m.36 views

Open Redirect

Overview jupyterlab is a JupyterLab computational environment. Affected versions of this package are vulnerable to Open Redirect in the CommandLinker class. An attacker can steal authentication tokens and gain unauthorized access to user accounts by convincing a user to open a malicious notebook...

8.8CVSS6AI score0.00476EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/04/18 3:22 a.m.36 views

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the XWD decoder when there is a type confusion between bitsperpixel and pixmapdepth during the byte-swap process. An attacker can achieve arbitrary code execution or cause a denial of service by providing a crafte...

9.8CVSS6.4AI score0.00332EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/16 1:20 a.m.36 views

Insertion of Sensitive Information into Log File

Overview langsmith is a Client library to connect to the LangSmith Observability and Evaluation Platform. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File through the Client handling of events. An attacker can bypass redaction controls and...

6.3CVSS5.8AI score0.00214EPSS
SaveExploits0References3
Snyk
Snyk
added 2025/11/24 8:33 p.m.36 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

9.8CVSS6.8AI score
SaveExploits0References3
Snyk
Snyk
added 2025/05/05 9:31 a.m.36 views

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection due to insufficient validation of XML input in crafted URL paths. An attacker can read files from the server's filesystem or perform denial-of-service attacks by supplying malicious XML content. Note:...

9.1CVSS7.5AI score0.01287EPSS
SaveExploits0References2
Snyk
Snyk
added 2025/04/25 3:02 p.m.36 views

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection via the template rendering engine. An attacker can execute arbitrary code on the server by injecting malicious code into templates that are then executed by the serve...

10CVSS8AI score0.99837EPSS
SaveExploits18References2
Snyk
Snyk
added 2026/08/07 3:33 p.m.35 views

Malicious Package

Overview @aster110/cc2wechat is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.35 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.35 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.35 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/08/03 9:00 p.m.35 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/30 9:43 p.m.35 views

Malicious Package

Overview @ethers-sdk/ethers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 11:00 p.m.35 views

Malicious Package

Overview shopping-shared-atom-mobile-cart-counter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizati...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 10:35 p.m.35 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the CombinedResourceInfo process. An attacker can cause excessive memory consumption and potentially exhaust server resources by submitting forged combined-resource IDs that inflate to large outputs and are...

8.7CVSS5.9AI score
SaveExploits0References5
Snyk
Snyk
added 2026/07/24 9:12 p.m.35 views

Incorrect Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization via the assign process. An attacker can gain unauthorized access to other applications and assign elevated roles to themselves or other users by exploiting insufficient...

8.8CVSS5.9AI score
SaveExploits0References4
Snyk
Snyk
added 2026/07/22 10:59 p.m.35 views

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the areAllActionIdsValid validation in server action form submission handling. An attacker can exhaust CPU and block other requests in the same...

8.2CVSS5.9AI score0.00599EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/21 7:36 p.m.35 views

Missing Authorization

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization through the built-in browser commands in @vitest/browser and the browser provider RPC handlers. An attacker can read, create, overwrite, or delete local files by...

9.2CVSS6AI score
SaveExploits0References4
Snyk
Snyk
added 2026/07/13 8:17 a.m.35 views

Malicious Package

Overview prettier-plugin-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 9:29 p.m.35 views

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CraftSupportWidget.js process. An attacker can execute arbitrary JavaScript code in the admin's control panel session by crafting a malicious GitHub issue tit...

7.4CVSS5.8AI score0.00311EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/24 10:17 p.m.35 views

Incomplete Filtering of Special Elements

Overview angular is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this package...

7.6CVSS5.8AI score0.00333EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/16 2:32 p.m.35 views

Insufficient Verification of Data Authenticity

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in the Body Limit Middleware. An attacker can cause the application to process payloads larger than the configured maximum by understating t...

6.9CVSS5.9AI score0.00147EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 8:38 p.m.35 views

Use of Incorrectly-Resolved Name or Reference

Overview starlette is a The little ASGI library that shines. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference in the reconstruction of request.url when the HTTP request path does not begin with /. An attacker can mislead the application into trusti...

8.3CVSS5.3AI score0.00187EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 8:09 p.m.35 views

Insufficiently Protected Credentials

Overview Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the DigestAuthMiddleware class when authentication responses are sent after following cross-origin redirects. An attacker can obtain authentication digests by leveraging an open redirect or simil...

6.3CVSS5.9AI score0.00178EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/09 6:33 p.m.35 views

Improper Validation of Integrity Check Value

Overview Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value when processing cipher and tag-length fields of CMS AuthEnvelopedData containers. An attacker can bypass message integrity via replay attack. A non AEAD cipher is permitted in...

9.1CVSS6.5AI score0.00368EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/03 9:14 p.m.35 views

Directory Traversal

Overview docling is a SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Directory Traversal via the LaTeX backend's handling of \includegraphics...

6.8CVSS6.2AI score0.00163EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/01 9:00 p.m.35 views

Malicious Package

Overview speed1 is a malicious package. This package is part of a malicious npm campaign that abused the registry to distribute ad-supported web proxy applications disguised as educational websites. The package contains web assets intended to bypass network restrictions and generate advertising...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/29 10:02 p.m.35 views

Malicious Package

Overview deepl-sync is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/29 5:21 p.m.35 views

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization in the QQBot native approval buttons process. An attacker can gain unauthorized access to resolve pending exec or plugin approval requests by interacting with approv...

8.6CVSS5.8AI score0.00206EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/27 10:49 p.m.35 views

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via the dynamic evaluation of user-supplied algorithm code in the script evaluation engine. An attacker can execute arbitrary operating system commands by injecting malicious Jython code through the REST API whe...

9.4CVSS6AI score0.00998EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/25 8:54 a.m.35 views

Malicious Package

Overview webservices.rest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/22 8:07 p.m.35 views

SQL Injection

Overview @nocobase/plugin-collection-sql is a Provides SQL collection template Affected versions of this package are vulnerable to SQL Injection through the update handler in the collection SQL resource. An attacker can submit a malicious sql value while updating a SQL-backed collection and have ...

8.6CVSS5.9AI score0.01833EPSS
SaveExploits1References2
Total number of security vulnerabilities5000