Lucene search
+L
SnykMost viewed

42530 matches found

Snyk
Snyk
added 2026/07/10 6:30 p.m.18 views

Missing Authorization

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Missing Authorization via the rewrite process for the /codex path. An attacker can gain unauthorized access to backend LLM provider credentials and trigger upstream provider cal...

8.8CVSS6.1AI score0.00611EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 8:21 p.m.18 views

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free via the aggregate function callbacks in Databasecreateaggregate, createaggregatehandler, and Databasedefineaggregator. An attacker can trigger an invalid memory read and segmentation fault by keeping a prepared statement...

4.5CVSS6.1AI score0.00107EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 6:46 p.m.18 views

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the HashCollisionNode class in Immutable.Map and Immutable.Set. An attacker can cause excessive CPU consumption by supplying a large number of keys with identical 32-bit hashes, leading to degraded...

8.7CVSS6.1AI score0.00665EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/08 2:37 p.m.18 views

Command Injection

Overview check-peer-dependencies is a Checks peer dependencies of the current package. Offers solutions for any that are unmet. Affected versions of this package are vulnerable to Command Injection in the shelljs.exec function of the peerDependencies component in packageUtils.js. An attacker can...

6.5CVSS6.8AI score0.01817EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 8:57 p.m.18 views

Missing Authorization

Overview @better-auth/scim is a SCIM plugin for Better Auth Affected versions of this package are vulnerable to Missing Authorization in the management of non-organization SCIM providers when owner binding is not enforced. An attacker can gain unauthorized access to another user's provider,...

7.7CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
added 2026/07/07 6:41 p.m.18 views

Improper Check for Unusual or Exceptional Conditions

Overview phoenix is a The official JavaScript client for the Phoenix web framework. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the syncState and syncDiff presence reconciliation code in assets/js/phoenix/presence.js. An attacker ca...

7.5CVSS6.2AI score0.00778EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/06 9:37 p.m.18 views

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection in the renderObjectTemplate process. An attacker can execute arbitrary code by supplying malicious input in the HTTP Referer header when saving entries in the control...

9.9CVSS6.3AI score0.00412EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 8:42 p.m.18 views

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the PcfFontFile.loadbitmaps process. An attacker can cause excessive memory allocation by supplying crafted PCF font data that bypasses decompression bomb checks. Remediation Upgrade pillo...

8.7CVSS6AI score0.0041EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/06 7:00 p.m.18 views

Malicious Package

Overview winston-prism is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:58 p.m.18 views

Malicious Package

Overview tailwindcss-framer-motion is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:58 p.m.18 views

Malicious Package

Overview syncora is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:01 p.m.18 views

Malicious Package

Overview mongoose-lean-hooks is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 12:40 p.m.18 views

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the filter process. An attacker can bypass intended security restrictions by supplying specially crafted argument headers that are not properly validated...

7.3CVSS6AI score0.00692EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/04 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 9:00 p.m.18 views

Malicious Package

Overview @glitchpad/throttler is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 8:19 a.m.18 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to the omission of SSH host verification options in the --proto-default process. An attacker can intercept or impersonate an SSH server by exploiting the lack of host verification during connection establishmen...

7.5CVSS6AI score0.00339EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/02 9:48 a.m.18 views

Malicious Package

Overview vitest-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 9:19 p.m.18 views

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

6.9CVSS5.9AI score0.004EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 3:34 p.m.18 views

Improper Input Validation

Overview pretix is a Reinventing presales, one ticket at a time Affected versions of this package are vulnerable to Improper Input Validation via improper validation of session parameters in the payment integration plugins and the use of shared cryptographic keys and salts across unrelated...

9.9CVSS6AI score0.00382EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 11:20 p.m.18 views

Uncontrolled Search Path Element

Overview app-builder-bin is an app-builder precompiled binaries Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the execWine/executeAppBuilder command path in builder-util and app-builder-lib on non-Windows systems. An attacker can execute...

7.8CVSS6.3AI score0.00186EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/30 11:19 p.m.18 views

Heap-based Buffer Overflow

Overview json is a JSON implementation as a Ruby extension in C. Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the JSON.dump or JSON::Stategenerate process when streaming oversized attacker-controlled strings to an IO object. An attacker can cause a process...

6.3CVSS5.8AI score0.00382EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 11:16 p.m.18 views

Improper Privilege Management

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Privilege Management in the updatePermissions process. An attacker can gain unauthorized administrative privileges by assigning high-value...

8.8CVSS5.8AI score0.00442EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 10:20 p.m.18 views

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via the storescp process. An attacker can cause memory to be leaked by repeatedly sending crafted connection requests, which may result in the service being terminated and unavailable f...

8.7CVSS5.8AI score0.00646EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 12:24 p.m.18 views

Missing Authorization

Overview org.apache.activemq:activemq-all is a package that puts together an ActiveMQ jar bundle. Affected versions of this package are vulnerable to Missing Authorization in the process that manages temporary destinations. An attacker can gain unauthorized access to consume messages from another...

8.2CVSS5.8AI score0.00563EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:51 p.m.18 views

Malicious Package

Overview autotel-devtools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:44 p.m.18 views

Malicious Package

Overview @source-row/source-container is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:44 p.m.18 views

Malicious Package

Overview player-core-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 2:18 p.m.18 views

Malicious Package

Overview quirky-token is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 11:50 a.m.18 views

Cross-site Scripting (XSS)

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the DBPost model without...

9.6CVSS7.8AI score0.0121EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/28 7:34 p.m.18 views

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the GoTarget function in the gofmt component. An attacker can execute arbitrary system commands by manipulating input passed to this function from a local environment. Remediation There is no fixed versio...

5.3CVSS6.3AI score0.0118EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/28 6:51 p.m.18 views

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in scanner.rb. An attacker can cause a stack overflow and crash the application by supplying CSS input containing numerous adjacent comments. Remediation Upgrade crass to version 1.0.7 or higher. References -...

6.3CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/27 12:02 a.m.18 views

External Control of File Name or Path

Overview @pnpm/installing.deps-installer is a Fast, disk space efficient installation engine Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended...

7.1CVSS5.8AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/26 11:55 p.m.18 views

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the listDDNS and listNotification handlers, which return full resource objects including plaintext third-party API credentials such as API tokens, secret keys, and webhook URLs witho...

6.9CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 11:03 p.m.18 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Glide process. An attacker can cause the server to make unauthorized HTTP requests to internal network addresses by supplying a crafted URL that exploits DNS rebinding. Remediation Upgrade...

4.9CVSS5.8AI score0.00226EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/26 9:29 p.m.18 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the web UI handlers responsible for managing hosts and networks. An attacker can gain unauthorized access to sensitive information and perform destructive actions across resources owned by other operators by...

8.8CVSS5.8AI score0.00283EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/26 9:11 p.m.18 views

Prototype Pollution

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Prototype Pollution via the deepCopy and replaceCircularReferences utilities in utils.ts. An attacker can inject crafted proto, constructor, or prototype fields in a public webhook payload tha...

6.4CVSS6.6AI score0.0028EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 9:03 p.m.18 views

Prototype Pollution

Overview @deepstream/server is an a scalable server for realtime webapps Affected versions of this package are vulnerable to Prototype Pollution via the message processing pipeline. An attacker can escalate privileges and potentially gain unauthorized access or modify sensitive data by sending...

9.9CVSS6.5AI score0.0047EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 6:15 p.m.18 views

Directory Traversal

Overview extract-zip is an unzip a zip file into a directory using 100% javascript Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that poin...

8.6CVSS6.5AI score0.00391EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/26 2:08 a.m.18 views

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the futimes function of lib/internal/fs/promises.js, which backs FileHandle.utimes and performs no file system permission check. An attacker who can execute code in a process running under the Permission...

4.8CVSS6.6AI score0.00185EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 9:25 p.m.18 views

Allocation of Resources Without Limits or Throttling

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Deserialize function. An attacker can cause excessive memory allocation or process...

7.5CVSS5.8AI score0.00405EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 6:35 p.m.18 views

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' in the ReadDateTime function when processing a MessagePack timestamp...

8.2CVSS5.9AI score0.00437EPSS
SaveExploits0References6
Snyk
Snyk
added 2026/06/25 5:20 p.m.18 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the org.opencontainers.image.title annotation in the artifact manifest when downloading OCI artifacts. An attacker can cause files to be written to arbitrary locations on the host filesystem by supplying a crafte...

8.1CVSS6.6AI score0.00442EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 3:17 p.m.18 views

Cross-site Scripting (XSS)

Overview pretix is a Reinventing presales, one ticket at a time Affected versions of this package are vulnerable to Cross-site Scripting XSS via the layout specification process of PDF ticket or badge layouts. An attacker can execute arbitrary JavaScript in the browser context of another backend...

8.8CVSS5.9AI score0.00425EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/23 11:06 p.m.18 views

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission checks in the store method of the UsersController. An attacker can assign full administrative privileges to a newly...

7.1CVSS5.8AI score0.00303EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/23 7:19 p.m.18 views

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the get method of the Konnected integration's HTTP endpoint, which does not enforce authentication. An attacker can access sensitive information about the alarm-panel switch state and zone...

7.6CVSS5.8AI score0.00308EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/22 11:18 p.m.18 views

Improper Enforcement of Behavioral Workflow

Overview filament/filament is an A collection of full-stack components for accelerated Laravel app development. Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow through the improper handling of recovery codes in app-based multi-factor authentication...

9.1CVSS5.9AI score0.00296EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/22 11:16 p.m.18 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the navigateTo open option. An attacker can execute arbitrary scripts in the application's origin by supplying a crafted open parameter containing a script-capable URL. Details Cross-site scripting or XSS is...

9.6CVSS5.9AI score0.00413EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/22 11:08 p.m.18 views

Cross-site Request Forgery (CSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the handoffChatLinkSession process. An attacker can gain unauthorized access to another user's account by crafting a malicious link containing their own...

8.5CVSS5.8AI score0.00192EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/22 4:29 p.m.18 views

Directory Traversal

Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Directory Traversal via the DiskIOStore.make process. An attacker can access or modify files outside the intended directory by supplying specially crafted layer names...

6.1CVSS7AI score0.00384EPSS
SaveExploits0References2
Total number of security vulnerabilities5000