Lucene search
+L
SnykMost viewed

42522 matches found

Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS6AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 9:00 p.m.18 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a credential stealer worm. A malicious actor managed to extract a GitHub Actions OIDC token from the runner process and publish tampered versions of 42 @tanstack/ packages to npm, which then spread ...

9.8CVSS5.8AI score0.02342EPSS
SaveExploits3References2
Snyk
Snyk
added 2026/05/11 5:18 p.m.18 views

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection via the Config::toArray function. An attacker can access sensitive configuration data, including plugin secrets, by...

7.7CVSS5.8AI score0.00276EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/11 3:57 p.m.18 views

Cross-site Scripting (XSS)

Overview next is a react framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the CSP nonce headers. An attacker can inject malicious scripts into cached HTML responses by supplying malformed nonce values, which may then be executed in the browsers of...

4.7CVSS5.5AI score0.00222EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/11 2:25 p.m.18 views

Authorization Bypass Through User-Controlled Key

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the memories API endpoints. An attacker can access, delete, restore, and view the contents of other users' data by sending crafted requests to endpoints suc...

8.3CVSS5.8AI score0.00294EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/11 2:05 p.m.18 views

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the updatemessagebyid process. An attacker can modify messages authored by other users by sending a request to the message update endpoint with only read permissions in a standard...

7.1CVSS5.8AI score0.00277EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/08 10:52 p.m.18 views

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the RemoveAmfSubscriptionsInfoProcedure process. An attacker can cause the application to panic and disrupt service availability by sending a crafted DELETE request with a nonexistent subsId after creating a...

6.5CVSS5.8AI score0.0035EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/08 6:19 p.m.18 views

Infinite loop

Overview justhtml is an A pure Python HTML5 parser that just works. Affected versions of this package are vulnerable to Infinite loop in the handling of CSS selectors and linkification processes. An attacker can cause excessive CPU or memory consumption by supplying specially crafted selector...

8.7CVSS5.8AI score
SaveExploits0References3
Snyk
Snyk
added 2026/05/08 6:32 a.m.18 views

Cross-site Scripting (XSS)

Overview org.opencms:opencms-core is a Java open source content management system by Alkacon Software. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the cmis-online/type process. An attacker can execute arbitrary scripts in the context of a user's browser by...

6.1CVSS5.9AI score0.0059EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/08 12:00 a.m.18 views

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the MilvusVectorStoredoDeleteList implementation. An attacker can inject filter expressions by supplying crafted document IDs that are not properly sanitized before bei...

8.8CVSS5.7AI score0.00353EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/07 8:26 p.m.18 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the SWnentries function in the file SWapi.c. An attacker can achieve arbitrary code execution or cause a denial of service by providing a specially crafted HDF-EOS file with DimensionName argument that...

7.8CVSS6.6AI score0.00237EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/07 7:21 p.m.18 views

Infinite loop

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Infinite loop. Go Vulnerability Report: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a...

8.7CVSS5.8AI score0.00781EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/07 4:32 a.m.18 views

Improper Isolation or Compartmentalization

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through the transformer fast-path in the source instrumentation logic. An attacker can expose the internal...

6.9CVSS5.9AI score0.00248EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/07 12:57 a.m.18 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the FilterOutboundURL process. An attacker can access internal network resources and retrieve sensitive information by exploiting DNS rebinding to bypass outbound URL filtering. This is only...

6.9CVSS5.8AI score0.00192EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/05/07 12:18 a.m.18 views

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HttpObjectDecoder component. An attacker can manipulate...

9.8CVSS5.8AI score0.0063EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/06 11:50 p.m.18 views

Allocation of Resources Without Limits or Throttling

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the bodyLimit function. An attacker can bypass request size restrictions by sending chunked or unknown-length requests, allowing...

8.7CVSS5.8AI score0.00219EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 9:43 p.m.18 views

Cross-site Scripting (XSS)

Overview @jupyterlab/apputils-extension is a JupyterLab - Application Utilities Extension Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute...

9.3CVSS5.9AI score0.00349EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 8:42 p.m.18 views

Brute Force

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the check process. An attacker can gain unauthorized administrative access by submitting arbitrary user-id and token values to the...

9.3CVSS5.9AI score0.00339EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 8:18 p.m.18 views

Cross-site Scripting (XSS)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS in the FAQ creation and update process. An attacker can execute arbitrary JavaScript in the browsers of users who view maliciou...

5.4CVSS5.8AI score0.00153EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 2:25 p.m.18 views

Access Control Bypass

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Access Control Bypass via the via POST /api/v1/account/login and POST /api/v1/account/invite endpoints. An attacker can gain access to arbitrary bcrypt password hash, tempToken, and tokenExpiry, including...

9.8CVSS6.1AI score0.49894EPSS
SaveExploits15References2
Snyk
Snyk
added 2026/05/05 10:19 p.m.18 views

Symlink Attack

Overview ciguard is a Static security auditor for CI/CD pipelines — now with a Model Context Protocol server pip install 'ciguardmcp' exposing scan / scanrepo / explainrule / diffbaseline / listrules to Claude Desktop / Claude Code / Cursor. Plus .ciguardignore rationale-required suppression,...

3.2CVSS6AI score0.00158EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 9:28 p.m.18 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the /pagepreview page. An attacker can execute arbitrary JavaScript in the context of the user's browser by injecting malicious scripts. Details Cross-site scripting or XSS is a code vulnerability that occurs...

6.1CVSS5.8AI score0.00194EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 8:53 p.m.18 views

Server-side Request Forgery (SSRF)

Overview magicmirror is a The open source modular smart mirror platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the cors endpoint, which acts as an open HTTP proxy without authentication or URL validation. An attacker can force the server to make...

9.2CVSS5.9AI score0.01623EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/05 8:31 p.m.18 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the User-Agent header being logged and later rendered in the admin event log interface without proper output encoding. An attacker can execute arbitrary JavaScript in an administrator's browser by submitting...

9.6CVSS5.8AI score0.00282EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 8:29 p.m.18 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the isSSRFSafeURL function. An attacker can access internal network resources and sensitive cloud metadata by submitting specially crafted URLs that use IPv4-mapped IPv6 notation, which bypasses the...

8.8CVSS5.8AI score0.00226EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/05 8:13 p.m.18 views

Server-side Request Forgery (SSRF)

Overview link-preview-js is a Javascript module to extract and fetch HTTP link information from blocks of text. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of IPv6 and internal addresses during the DNS resolution process. An attacke...

8.7CVSS5.8AI score0.00536EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 6:42 p.m.18 views

Insufficient Session Expiration

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Session Expiration in the webhook authentication process. An attacker can continue to access protected webhook routes using a previously valid secret even after the secret ha...

7CVSS5.8AI score0.00289EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 6:13 p.m.18 views

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview inngest is an Official SDK for Inngest.com. Inngest is the reliability layer for modern applications. Inngest combines durable execution, events, and queues into a zero-infra platform with built-in observability. Affected versions of this package are vulnerable to Exposure of Sensitive...

8.7CVSS5.8AI score0.00383EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 5:03 p.m.18 views

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to jupytercookiesecret never being automatically rotated or cleared. An attacker can keep or reuse authenticated session cookies after a password change by presenting a cookie signed with a secret tha...

7.6CVSS5.8AI score0.00308EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/05 3:33 p.m.18 views

Malicious Package

Overview generator-go-circleci is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 3:27 p.m.18 views

Malicious Package

Overview @infinid-indonesia/ui-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 1:35 p.m.18 views

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the Microsoft Teams SSO invoke handler. An attacker can gain unauthorized access to Teams SSO signin functionality by sending specially crafted SSO invoke reques...

6.3CVSS5.8AI score0.00231EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 12:18 a.m.18 views

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution when the Object.prototype has been polluted via a different exploit. The following properties in the HTTP adapter configuration may be manipulated, as...

9.1CVSS6.3AI score0.00715EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/04 9:30 p.m.18 views

Access Control Bypass

Overview rdiffweb is an A web interface to rdiff-backup repositories. Affected versions of this package are vulnerable to Access Control Bypass via the API authentication process. An attacker can gain unauthorized access to other users' data and perform actions on their behalf by using any valid ...

8.6CVSS5.8AI score0.00245EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/04 8:23 p.m.18 views

Information Exposure

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Information Exposure in the analysis of allowlisted commands containing unquoted heredocs. An attacker can cause unintended shell expansion by crafting a command that hides malicious code...

8.8CVSS5.9AI score0.00362EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/04 5:20 p.m.18 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when handling HTTP request paths that have had normalizedPath applied. An attacker can gain unauthorized access to protected resources by appending a semicolon and arbitrary text to the request URL, exploiting...

8.8CVSS6AI score0.00484EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/04 12:01 a.m.18 views

Malicious Package

Overview @w3m-app/isconnected is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/29 9:03 p.m.18 views

SQL Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to SQL Injection via the process of constructing SQL queries in the Snowflake and legacy MySQL v1 nodes when user-controlled input is directly interpolated into identifier fields such as table name,...

8.8CVSS5.9AI score0.00254EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/26 3:10 p.m.18 views

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the DsSpelExpressionProcessor in the datasource key resolution path. An attacker can trigger arbitrary expression evaluation by supplying a datasource key expression th...

6.5CVSS7.3AI score0.00237EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/25 11:50 p.m.18 views

Insufficiently Protected Credentials

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the MINIMAXAPIHOST environment variable injection in workspace dotenv files. An attacker can intercept sensitive API credentials by redirecting...

6.8CVSS5.5AI score0.00119EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/04/24 7:21 p.m.18 views

Improper Encoding or Escaping of Output

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the encode function in AxiosURLSearchParams. An attacker can smuggle a NUL byte into serialized query strings by supplying...

6.3CVSS5.5AI score0.00217EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/24 4:34 p.m.18 views

Arbitrary Command Injection

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Arbitrary Command Injection via...

8.8CVSS6AI score0.00314EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/23 12:00 a.m.18 views

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack due to insecure handling of Process ID PID files. When an application uses the ApplicationPidFileWriter, it writes its PID to a predictable file system path. A local attacker with write access to the PID file's directory...

6.7CVSS5.4AI score0.00112EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/22 1:29 a.m.18 views

Malicious Package

Overview @bitunix/test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/21 7:17 p.m.18 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Webroot HTTP-01 challenge provider. An attacker can write arbitrary files to the filesystem by supplying crafted challenge tokens containing directory traversal sequences. Details A Directory Traversal attack...

8.8CVSS6.5AI score0.0034EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/21 5:17 p.m.18 views

Regular Expression Denial of Service (ReDoS)

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the contextMatcher and pathMatcher functions. An attacker can cause the server to become unresponsive and exhaust CPU...

8.7CVSS5.8AI score0.00427EPSS
SaveExploits1References2
Total number of security vulnerabilities5000