Lucene search
+L
SnykMost viewed

42522 matches found

Snyk
Snyk
•added 2026/06/29 11:50 a.m.•18 views

Cross-site Scripting (XSS)

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the DBPost model without...

9.6CVSS7.8AI score0.0121EPSS
SaveExploits1References3
Snyk
Snyk
•added 2026/06/28 7:36 p.m.•18 views

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the decodedlta function. An attacker can cause memory corruption, potentially leading to information disclosure, data modification, or application crash by supplying a crafted media stream containing a malicious...

8.8CVSS7.9AI score0.00275EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/28 6:51 p.m.•18 views

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in scanner.rb. An attacker can cause a stack overflow and crash the application by supplying CSS input containing numerous adjacent comments. Remediation Upgrade crass to version 1.0.7 or higher. References -...

6.3CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/27 12:02 a.m.•18 views

External Control of File Name or Path

Overview @pnpm/installing.deps-installer is a Fast, disk space efficient installation engine Affected versions of this package are vulnerable to External Control of File Name or Path via the lockfile alias handling process. An attacker can overwrite files or directories outside the intended...

7.1CVSS5.8AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
•added 2026/06/26 11:55 p.m.•18 views

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the listDDNS and listNotification handlers, which return full resource objects including plaintext third-party API credentials such as API tokens, secret keys, and webhook URLs witho...

6.9CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/26 11:03 p.m.•18 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Glide process. An attacker can cause the server to make unauthorized HTTP requests to internal network addresses by supplying a crafted URL that exploits DNS rebinding. Remediation Upgrade...

4.9CVSS5.8AI score0.00226EPSS
SaveExploits0References3
Snyk
Snyk
•added 2026/06/26 9:29 p.m.•18 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the web UI handlers responsible for managing hosts and networks. An attacker can gain unauthorized access to sensitive information and perform destructive actions across resources owned by other operators by...

8.8CVSS5.8AI score0.00283EPSS
SaveExploits0References3
Snyk
Snyk
•added 2026/06/26 9:11 p.m.•18 views

Prototype Pollution

Overview n8n-workflow is a Workflow base code of n8n Affected versions of this package are vulnerable to Prototype Pollution via the deepCopy and replaceCircularReferences utilities in utils.ts. An attacker can inject crafted proto, constructor, or prototype fields in a public webhook payload tha...

6.4CVSS6.6AI score0.0028EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/26 9:03 p.m.•18 views

Prototype Pollution

Overview @deepstream/server is an a scalable server for realtime webapps Affected versions of this package are vulnerable to Prototype Pollution via the message processing pipeline. An attacker can escalate privileges and potentially gain unauthorized access or modify sensitive data by sending...

9.9CVSS6.5AI score0.0047EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/26 6:15 p.m.•18 views

Directory Traversal

Overview extract-zip is an unzip a zip file into a directory using 100% javascript Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that poin...

8.6CVSS6.5AI score0.00391EPSS
SaveExploits1References2
Snyk
Snyk
•added 2026/06/26 2:08 a.m.•18 views

Incorrect Default Permissions

Overview Affected versions of this package are vulnerable to Incorrect Default Permissions in the futimes function of lib/internal/fs/promises.js, which backs FileHandle.utimes and performs no file system permission check. An attacker who can execute code in a process running under the Permission...

4.8CVSS6.6AI score0.00185EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/25 9:25 p.m.•18 views

Allocation of Resources Without Limits or Throttling

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the Deserialize function. An attacker can cause excessive memory allocation or process...

7.5CVSS5.8AI score0.00405EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/25 6:35 p.m.•18 views

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' in the ReadDateTime function when processing a MessagePack timestamp...

8.2CVSS5.9AI score0.00437EPSS
SaveExploits0References6
Snyk
Snyk
•added 2026/06/25 5:20 p.m.•18 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the org.opencontainers.image.title annotation in the artifact manifest when downloading OCI artifacts. An attacker can cause files to be written to arbitrary locations on the host filesystem by supplying a crafte...

8.1CVSS6.6AI score0.00442EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/25 3:17 p.m.•18 views

Cross-site Scripting (XSS)

Overview pretix is a Reinventing presales, one ticket at a time Affected versions of this package are vulnerable to Cross-site Scripting XSS via the layout specification process of PDF ticket or badge layouts. An attacker can execute arbitrary JavaScript in the browser context of another backend...

8.8CVSS5.9AI score0.00425EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/25 5:46 a.m.•18 views

Malicious Package

Overview ccl-component-resources is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/23 11:06 p.m.•18 views

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization due to insufficient permission checks in the store method of the UsersController. An attacker can assign full administrative privileges to a newly...

7.1CVSS5.8AI score0.00303EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/23 7:19 p.m.•18 views

Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function in the get method of the Konnected integration's HTTP endpoint, which does not enforce authentication. An attacker can access sensitive information about the alarm-panel switch state and zone...

7.6CVSS5.8AI score0.00308EPSS
SaveExploits1References2
Snyk
Snyk
•added 2026/06/22 11:18 p.m.•18 views

Improper Enforcement of Behavioral Workflow

Overview filament/filament is an A collection of full-stack components for accelerated Laravel app development. Affected versions of this package are vulnerable to Improper Enforcement of Behavioral Workflow through the improper handling of recovery codes in app-based multi-factor authentication...

9.1CVSS5.9AI score0.00296EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/22 11:16 p.m.•18 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the navigateTo open option. An attacker can execute arbitrary scripts in the application's origin by supplying a crafted open parameter containing a script-capable URL. Details Cross-site scripting or XSS is...

9.6CVSS5.9AI score0.00413EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/22 11:08 p.m.•18 views

Cross-site Request Forgery (CSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the handoffChatLinkSession process. An attacker can gain unauthorized access to another user's account by crafting a malicious link containing their own...

8.5CVSS5.8AI score0.00192EPSS
SaveExploits1References3
Snyk
Snyk
•added 2026/06/22 4:29 p.m.•18 views

Directory Traversal

Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Directory Traversal via the DiskIOStore.make process. An attacker can access or modify files outside the intended directory by supplying specially crafted layer names...

6.1CVSS7AI score0.00384EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/21 9:00 p.m.•18 views

Malicious Package

Overview apintergrationpost is a malicious package. This package conceals a Linux remote access trojan RAT called MYRA. The package's documentation claims it is designed for "authorized red team exercises and EDR validation." Regardless of the publisher's intent, it should be treated as malicious...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/21 11:10 a.m.•18 views

Incorrect Authorization

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Incorrect Authorization in the BannedKeywords enterprise and AzureContentSafety hooks of the Completions Interface. An attacker can gain unauthorized access to restricted...

6.5CVSS6.6AI score0.004EPSS
SaveExploits1References2
Snyk
Snyk
•added 2026/06/21 11:10 a.m.•18 views

Server-side Request Forgery (SSRF)

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the loadopenapispecasync function of the MCP OpenAPI Spec Loader component when processing the specpath argument. An attacker can access...

6.5CVSS6.6AI score0.004EPSS
SaveExploits1References2
Snyk
Snyk
•added 2026/06/21 2:39 a.m.•18 views

Insufficient Session Expiration

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Insufficient Session Expiration in the authenticateuser function. An attacker can gain unauthorized access or maintain access to sensitive information by exploiting session...

7.1CVSS6.6AI score0.004EPSS
SaveExploits1References2
Snyk
Snyk
•added 2026/06/19 10:08 p.m.•18 views

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview ChatterBot is a ChatterBot is a machine learning, conversational dialog engine Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the extract function. An attacker can cause arbitrary files to be written to a directory of their choice ...

6.8CVSS5.9AI score0.00123EPSS
SaveExploits0References3
Snyk
Snyk
•added 2026/06/19 9:43 p.m.•18 views

Directory Traversal

Overview everos is an EverOS — local-first markdown memory framework for AI agents and user chats; lightweight, dev-friendly, small-team Affected versions of this package are vulnerable to Directory Traversal via the senderid field in the POST /api/v1/memory/add endpoint. An attacker can create o...

8.8CVSS6.5AI score0.00537EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/19 9:42 p.m.•18 views

Insertion of Sensitive Information Into Sent Data

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data disclosure through the ParseLiveQueryServer event serialization in...

5.1CVSS6AI score0.00527EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/19 9:42 p.m.•18 views

External Control of File Name or Path

Overview network-ai is an AI agent orchestration framework for TypeScript/Node.js - 29 adapters LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Compu Affected version...

7.1CVSS6.1AI score
SaveExploits0References3
Snyk
Snyk
•added 2026/06/19 7:18 p.m.•18 views

SQL Injection

Overview typeorm is an ORM that can run in NodeJS, Browser, Cordova, PhoneGap, Ionic, React Native, NativeScript, Expo, and Electron platforms and can be used with TypeScript and JavaScript ES5, ES6, ES7, ES8. Affected versions of this package are vulnerable to SQL Injection in the orderBy or...

8.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/19 3:41 p.m.•18 views

Missing Authorization

Overview silverstripe/framework is a PHP framework forming the base for the SilverStripe CMS. Affected versions of this package are vulnerable to Missing Authorization via the buildDefaults action in DevelopmentAdmin. An attacker can perform unauthorized database modifications and obtain...

5.4CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
•added 2026/06/19 3:12 p.m.•18 views

Command Injection

Overview agentic-flow is a The agentic meta-harness — freeze the model, evolve the harness. An open runtime that routes each query to the cost-optimal model, evolves its own harness planner/context/reviewer/retry/tool/memory/score policy and autonomously repairs code, then orches Affected version...

8.8CVSS6.2AI score0.00866EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/19 3:11 p.m.•18 views

Cross-site Scripting (XSS)

Overview @jupyterlab/extensionmanager is a JupyterLab - Extension Manager Affected versions of this package are vulnerable to Cross-site Scripting XSS via unsanitized handling of the homepageurl field in the extension manager. An attacker can execute arbitrary JavaScript in the context of the...

8.3CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/19 8:08 a.m.•18 views

Malicious Package

Overview ethereum-gas-reporter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/18 8:33 p.m.•18 views

Untrusted Search Path

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Untrusted Search Path via the npmexecpath environment variable in a workspace .env file, which can influence the executable path used during bundled runtime dependency installation. An...

7.1CVSS5.9AI score0.00118EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/18 8:32 p.m.•18 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the BlueBubbles process. An attacker can gain unauthorized access to restricted agent responses by manipulating conversation-level identifiers to match allowli...

5.4CVSS5.9AI score0.00171EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/18 5:18 p.m.•18 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass via the process.report.writeReport function. An attacker can bypass intended security restrictions by exploiting path misvalidation. Note: This is only exploitable if the Node.js Permission Model is enabled and...

8.2CVSS5.4AI score0.00317EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/18 2:26 p.m.•18 views

Incorrect Authorization

Overview praisonai is a PraisonAI TypeScript AI Agents Framework - Node.js, npm, and Javascript AI Agents Framework Affected versions of this package are vulnerable to Incorrect Authorization via the shell function. An attacker can execute arbitrary shell commands with the privileges of the runni...

8.8CVSS6AI score
SaveExploits0References4
Snyk
Snyk
•added 2026/06/18 1:55 p.m.•18 views

Incorrect Authorization

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

8.8CVSS6.1AI score
SaveExploits0References3
Snyk
Snyk
•added 2026/06/18 1:52 p.m.•18 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the CodeExchange and RefreshToken processes. An attacker can gain unauthorized access to user accounts or maintain persistent access from an unauthorized client by presenting intercepted authorization codes or...

9.1CVSS6AI score0.00433EPSS
SaveExploits0References3
Snyk
Snyk
•added 2026/06/18 1:05 p.m.•18 views

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the YAML unmarshalling process of the io.docker.server.metadata OCI image label into the catalog.Server struct. An attacker can execute arbitrary code as root on the host system by crafting a malicious O...

8.7CVSS6.2AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/18 4:05 a.m.•18 views

Malicious Package

Overview intquery is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/18 3:27 a.m.•18 views

Malicious Package

Overview npm-sandbox-ping-c8f2a is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/18 12:20 a.m.•18 views

Exposure of Resource to Wrong Sphere

Overview Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the TokenKeyResolver function. An attacker can bypass authentication and gain unauthorized access by exploiting the shared static JWKS cache across multiple schemes, allowing a key fetched for one...

7.4CVSS5.9AI score0.0029EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/16 11:38 p.m.•18 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the NoScript component when untrusted input is interpolated into its slot content. An attacker can inject malicious HTML or scripts by supplying specially crafted data that is rendered unescaped in the...

6.1CVSS6AI score0.00342EPSS
SaveExploits0References2
Snyk
Snyk
•added 2026/06/16 9:00 p.m.•18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/16 9:00 p.m.•18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/16 9:00 p.m.•18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
•added 2026/06/16 9:00 p.m.•18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. An attacker using the npm account ehindero hijacked the @mastra npm organization and, in a roughly 30–45 minute burst starting around 01:12 UTC, republished the entire @mastra catalog. The Mastra source code was...

9.8CVSS6AI score
SaveExploits0References2
Total number of security vulnerabilities5000