Arbitrary Argument Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Arbitrary Argument Injection via the checkunsafeoptions process. An attacker can execute arbitrary commands by smuggling a malicious option token inside the value of a...

Out-of-bounds Write

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via error messages generated during GraphQL validation and input-coercion. An attacker can obtain...

Incorrect Authorization

Overview @better-auth/stripe is a Stripe plugin for Better Auth Affected versions of this package are vulnerable to Incorrect Authorization through the handling of organization subscription actions when the authorizeReference callback is used and both subscription.enabled and organization.enabled...

Incorrect Authorization

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the filterframe process. An attacker can corrupt heap memory and potentially execute arbitrary code by supplying a dynamically sized video stream with filtergraph reinitialization disabled, causing the allocation...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the tdscparsetdsf function. An attacker can achieve heap corruption and potentially execute arbitrary code by supplying a crafted AVI file that manipulates frame dimensions across TDSF frames, leading tdscblit and...

Malicious Package

Overview eth-base is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Incorrect Behavior Order: Validate Before Canonicalize

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

Incorrect Behavior Order: Validate Before Canonicalize

Overview next-auth is an Authentication for Next.js Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize in the email/magic-link sign-in process. An attacker can gain unauthorized access to a victim's account by submitting an email address...

Improper Verification of Source of a Communication Channel

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Improper Verification of Source of a Communication Channel via improper binding of OAuth check cookies to the provider that created them. An attacker can gain unauthorized access to a victim'...

Malicious Package

Overview da-sc-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @bcryptln/bcryptjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Allocation of Resources Without Limits or Throttling

Overview next is a react framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the handleAction Server Actions path in the App Router Edge runtime. An attacker can exhaust server memory by sending an oversized Server Action request...

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the process that handles credential domain restrictions when user-supplied base or endpoint URLs are set. An attacker can exfiltrate credential secrets by configuring...

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the authentication when the embed login feature is enabled and at least one trusted key source is configured. An attacker can gain unauthorized access to any existing user...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the heifimagehandlegetimagetiling function when processing a malformed uncompressed HEIF image item that has an associated uncC property but lacks an associated ispe property. An attacker can cause a crash by...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the HAProxyMessageDecoder. An attacker can cause unbounded memory allocation by sending a specially crafted PROXY protocol v2 binary prefix with a version byte of 0xFF, which...

Command Injection

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Command Injection via the canonicalizeoptionname function in git/cmd.py. An attacker can execute a local helper command by supplying joined short clone options such as...

Malicious Package

Overview adent-core-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Cross-site Request Forgery (CSRF)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the security.checkOrigin logic when middleware is absent or mounted after actions or pages in the...

Malicious Package

Overview @gocortexio/npmgremlinbox-unlicense is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview zzfadgivar05 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview zzjinavcsgit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Allocation of Resources Without Limits or Throttling

Overview mcp is a The official Ruby SDK for Model Context Protocol servers and clients Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the handlepost method of lib/mcp/server/transports/streamablehttptransport.rb, which reads the entire...

DNS Rebinding

Overview mcp is a The official Ruby SDK for Model Context Protocol servers and clients Affected versions of this package are vulnerable to DNS Rebinding in the handlepost method of MCP::Server::Transports::StreamableHTTPTransport in lib/mcp/server/transports/streamablehttptransport.rb, which...

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization in the message actions. An attacker can perform unauthorized actions by sending requests as a lower-trust user or through a configured input path when the feature is...

Server-side Request Forgery (SSRF)

Overview @directus/api is a real-time API and App dashboard for managing SQL database content Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the file-import-from-URL. An attacker can access internal network resources by supplying the address 0.0.0.0 to th...

Arbitrary Code Injection

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Incorrect Authorization

Overview n8n-mcp is an Integration between n8n workflow automation and Model Context Protocol MCP Affected versions of this package are vulnerable to Incorrect Authorization in the workflowversions. An attacker can access or delete sensitive workflow-version backups by sending crafted requests in...

Use After Free

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the CopyDelegateFile path in the VIDEO/APNG delegate code. An attacker can write output to a disallowed path by supplying a delegate-driven image write that copies a generated file to a destination the policy shou...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime through the WriteVIFFImage encoder in coders/viff.c. An attacker can consume memory by causing the VIFF encoder to hit an allocation failure while processing an image with a color map...

Missing Authorization

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Missing Authorization via the rewrite process for the /codex path. An attacker can gain unauthorized access to backend LLM provider credentials and trigger upstream provider cal...

Malicious Package

Overview nodemon-slint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Directory Traversal

Overview @appium/storage-plugin is a Server-side storage plugin for Appium Affected versions of this package are vulnerable to Directory Traversal via the POST /storage/delete handler, which passes user-supplied input directly into path.join and fs.rimraf without proper path sanitization. An...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to improper enforcement of the Certificate Revocation List on the gRPC listener when separate listeners are configured for HTTP and gRPC client endpoints. An attacker can gain unauthorized access and...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via the aggregate function callbacks in Databasecreateaggregate, createaggregatehandler, and Databasedefineaggregator. An attacker can trigger an invalid memory read and segmentation fault by keeping a prepared statement...

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the evaluations test run creation endpoint POST /workflows/workflowId/test-runs/new, which authorizes against the workflow:read scope instead of workflow:execute. A user...

Improper Following of Specification by Caller

Overview Affected versions of this package are vulnerable to Improper Following of Specification by Caller due to the GSSAPIStrictAcceptorCheck process when the server operates in a Windows Active Directory environment. An attacker can bypass intended authentication checks by exploiting this...

Buffer Access with Incorrect Length Value

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Buffer Access with Incorrect Length Value in the GDALRaster process when constructed from a bytes object. An attacker can access...

Improper Neutralization

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Improper Neutralization via the DomainNameValidator process. An attacker can inject arbitrary HTTP headers by submitting input...

Cross-site Scripting (XSS)

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the ElementTableSorter.js process when a user with sufficient permissions drags an entry under a maliciously crafted entry in table view. An attacker can execute...

Insecure Temporary File

Overview linuxfabrik-lib is a Python libraries used in various Linuxfabrik projects, including the 'Linuxfabrik Monitoring Plugins' project. Affected versions of this package are vulnerable to Insecure Temporary File in the process that creates SQLite databases at predictable paths in /tmp. An...

Malicious Package

Overview winston-prism is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview weasyprint is a The Awesome Document Factory Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' in the processing of presentational hints when unescaped attribute values are embedded into CS...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to the omission of SSH host verification options in the --proto-default process. An attacker can intercept or impersonate an SSH server by exploiting the lack of host verification during connection establishmen...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness due to incomplete matching of mTLS configuration options during connection reuse in the connection process. An attacker can cause connections to be reused with incorrect client certificate...