Lucene search
+L
SnykMost viewed

42522 matches found

Snyk
Snyk
added 2026/05/18 8:33 p.m.18 views

Improper Validation of Array Index

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

5.1CVSS5.8AI score0.0012EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 8:33 p.m.18 views

Improper Validation of Array Index

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

5.1CVSS5.8AI score0.0012EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 5:53 p.m.18 views

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-HDRI-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

7.5CVSS5.8AI score0.00495EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 5:53 p.m.18 views

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

7.5CVSS5.8AI score0.00495EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 5:48 p.m.18 views

Off-by-one Error

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

6.9CVSS5.8AI score0.0024EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 5:48 p.m.18 views

Off-by-one Error

Overview Magick.NET-Q16-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

6.9CVSS5.8AI score0.0024EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 5:48 p.m.18 views

Improper Validation of Array Index

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

7.1CVSS5.9AI score0.00122EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 5:48 p.m.18 views

Improper Validation of Array Index

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

7.1CVSS5.9AI score0.00122EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 4:21 p.m.18 views

External Control of File Name or Path

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to External Control of File Name or Path through the deleteFileOrFolder and renameFile processes. An attacker can remove or rename critical application files by sending craft...

7CVSS5.8AI score0.00479EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 3:31 p.m.18 views

Integer Underflow (Wrap or Wraparound)

Overview Magick.NET-Q8-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

5.1CVSS5.8AI score0.0012EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 3:31 p.m.18 views

Integer Underflow (Wrap or Wraparound)

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

5.1CVSS5.8AI score0.0012EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 3:31 p.m.18 views

Integer Underflow (Wrap or Wraparound)

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

5.1CVSS5.8AI score0.0012EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 3:31 p.m.18 views

Integer Underflow (Wrap or Wraparound)

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

5.1CVSS5.8AI score0.0012EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/18 11:47 a.m.18 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the Host header when constructing response URLs for custom slash commands. An attacker can redirect responses to a server under their control by sending a specially crafted request with a spoofed Hos...

5CVSS5.8AI score0.00137EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 9:31 a.m.18 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the start meeting API endpoint when the size of the request body is not limited. An attacker can exhaust system resources or disrupt service availability by sending crafted...

7.1CVSS5.5AI score0.0024EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/18 1:32 a.m.18 views

Server-side Request Forgery (SSRF)

Overview ai is an AI SDK by Vercel - The AI Toolkit for TypeScript and JavaScript Affected versions of this package are vulnerable to Server-side Request Forgery SSRF due to the order of operations in the validateDownloadUrl implementation in download-blob.ts and download.ts. The fetch operation...

7.5CVSS7.2AI score0.00458EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/17 9:00 p.m.18 views

Malicious Package

Overview axois-utils is a malicious package. This package contains malicious code that includes infostealer malware, one of which is a Shai-Hulud clone following the TeamPCP open source release, and one DDoS botnet package. While this package might be attempting to impersonate a valid organizatio...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/15 6:30 p.m.18 views

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the discovery document retrieval process via uripukidpenc and uripukidpsig properties. An attacker can intercept and modify the TLS connection to substitute a forged discovery document...

9.1CVSS5.4AI score0.00118EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/15 5:47 p.m.18 views

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the processUrlFile function. An attacker can access internal network resources and sensitive cloud metadata by supplying crafted URLs that target internal or...

7.7CVSS5.8AI score0.00258EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/15 10:43 a.m.18 views

Malicious Package

Overview jenkins-for-jira is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/15 10:43 a.m.18 views

Malicious Package

Overview browser-interaction-time-demo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 9:25 p.m.18 views

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation due to improper validation of JWT aud and iss claims in the Windows MDM authentication flow. An attacker can enroll unauthorized devices by presenting a valid Microsoft-signed Azure AD token from any tenant. This is...

8.2CVSS5.5AI score0.00381EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 9:21 p.m.18 views

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the QueryRGBBufferSizeInternal function when processing crafted DPX image files. An attacker can cause a heap-based out-of-bounds write by supplying a specially crafted DPX file that triggers an integer...

8.3CVSS6.3AI score0.0037EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/14 8:55 p.m.18 views

Server-side Request Forgery (SSRF)

Overview @utcp/http is a HTTP utilities for UTCP Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenApiConverter process. An attacker can access internal network resources and sensitive metadata endpoints by supplying a malicious OpenAPI specification...

4.7CVSS5.8AI score0.00122EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 6:25 p.m.18 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal due to insufficient path sanitization in the osfs.ChrootOS component. An attacker can gain unauthorized access to unintended filesystem locations by supplying crafted paths containing directory traversal sequences...

8.6CVSS6.3AI score0.0031EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 4:19 p.m.18 views

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes in the Object.assign process. An attacker can gain unauthorized access to and control over assistants across different workspac...

7.7CVSS5.8AI score0.00335EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 4:18 p.m.18 views

Authorization Bypass Through User-Controlled Key

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the OAuth1 and OAuth2 credential reconnect endpoints. A user with readonly access to shared credentials can overwrite stored OAuth token material...

8.5CVSS5.9AI score0.0035EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 3:49 p.m.18 views

Malicious Package

Overview deltaprime-primeloans is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 3:49 p.m.18 views

Malicious Package

Overview solidity-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 3:23 p.m.18 views

Covert Timing Channel

Overview Affected versions of this package are vulnerable to Covert Timing Channel via the authentication process. An attacker can recover user credentials by exploiting timing differences during MD5-hashed password comparison. This is only exploitable if the database contains MD5-hashed password...

8.2CVSS6.6AI score0.00558EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/14 3:23 p.m.18 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the CREATE TYPE process. An attacker can execute arbitrary SQL functions of their choice by hijacking queries that use searchpath to locate user-defined types, including those defined by extensions. Remediation...

5.4CVSS6.3AI score0.00159EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/13 8:02 p.m.18 views

Insufficient Session Expiration

Overview @strapi/admin is a Strapi Admin Affected versions of this package are vulnerable to Insufficient Session Expiration in the password reset or change operation. An attacker can maintain unauthorized access by continuing to use a previously obtained refresh token to generate new access...

6.9CVSS5.8AI score0.00272EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/13 8:02 p.m.18 views

SQL Injection

Overview @strapi/plugin-content-type-builder is a Strapi plugin to create content type Affected versions of this package are vulnerable to SQL Injection via the column.defaultTo attribute in the content type creation or modification. An attacker can execute arbitrary database statements by...

9.3CVSS6.7AI score0.01178EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/13 2:03 p.m.18 views

Malicious Package

Overview chai-as-streamed is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/12 9:20 p.m.18 views

Improper Authorization

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Authorization via improper authorization checks in the access control process. An attacker can gain unauthorized write access by tricking a user into visiting a...

5.3CVSS5.8AI score0.00393EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/12 5:22 p.m.18 views

Improper Authorization

Overview org.apache.tomcat:catalina is a Servlet Engine Core Classes and Standard implementations. Affected versions of this package are vulnerable to Improper Authorization in the processing of security constraints when multiple method constraints define an HTTP method for the same extension. An...

9.1CVSS5.8AI score0.01136EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/12 11:23 a.m.18 views

Malicious Package

Overview jwscube is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview mistralai is a Mistral Python Client Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack...

9.8CVSS5.8AI score0.00276EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 5:18 p.m.18 views

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the Config::toArray function. An attacker can access sensitive configuration data, including plugin secrets, by...

7.7CVSS5.8AI score0.00276EPSS
SaveExploits1References2
Total number of security vulnerabilities5000