Lucene search
+L
SnykMost viewed

42513 matches found

Snyk
Snyk
added 2026/05/07 8:26 p.m.18 views

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the SWnentries function in the file SWapi.c. An attacker can achieve arbitrary code execution or cause a denial of service by providing a specially crafted HDF-EOS file with DimensionName argument that...

7.8CVSS6.6AI score0.00237EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/07 7:21 p.m.18 views

Infinite loop

Overview std/net/http is a Go standard library package std/net/http Affected versions of this package are vulnerable to Infinite loop. Go Vulnerability Report: When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a...

8.7CVSS5.8AI score0.00781EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/07 4:32 a.m.18 views

Improper Isolation or Compartmentalization

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization through the transformer fast-path in the source instrumentation logic. An attacker can expose the internal...

6.9CVSS5.9AI score0.00248EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/07 12:57 a.m.18 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through the FilterOutboundURL process. An attacker can access internal network resources and retrieve sensitive information by exploiting DNS rebinding to bypass outbound URL filtering. This is only...

6.9CVSS5.8AI score0.00192EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/05/07 12:18 a.m.18 views

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HttpObjectDecoder component. An attacker can manipulate...

9.8CVSS5.8AI score0.0063EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/06 11:50 p.m.18 views

Allocation of Resources Without Limits or Throttling

Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the bodyLimit function. An attacker can bypass request size restrictions by sending chunked or unknown-length requests, allowing...

8.7CVSS5.8AI score0.00219EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 9:43 p.m.18 views

Cross-site Scripting (XSS)

Overview @jupyterlab/apputils-extension is a JupyterLab - Application Utilities Extension Affected versions of this package are vulnerable to Cross-site Scripting XSS via the handling of data-commandlinker-command and data-commandlinker-args attributes in HTML content. An attacker can execute...

9.3CVSS5.9AI score0.00349EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 8:42 p.m.18 views

Brute Force

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Brute Force via the check process. An attacker can gain unauthorized administrative access by submitting arbitrary user-id and token values to the...

9.3CVSS5.9AI score0.00339EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 8:18 p.m.18 views

Cross-site Scripting (XSS)

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Cross-site Scripting XSS in the FAQ creation and update process. An attacker can execute arbitrary JavaScript in the browsers of users who view maliciou...

5.4CVSS5.8AI score0.00153EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/06 2:25 p.m.18 views

Access Control Bypass

Overview flowise is a Flowiseai Server Affected versions of this package are vulnerable to Access Control Bypass via the via POST /api/v1/account/login and POST /api/v1/account/invite endpoints. An attacker can gain access to arbitrary bcrypt password hash, tempToken, and tokenExpiry, including...

9.8CVSS6.1AI score0.49894EPSS
SaveExploits15References2
Snyk
Snyk
added 2026/05/05 10:19 p.m.18 views

Symlink Attack

Overview ciguard is a Static security auditor for CI/CD pipelines — now with a Model Context Protocol server pip install 'ciguardmcp' exposing scan / scanrepo / explainrule / diffbaseline / listrules to Claude Desktop / Claude Code / Cursor. Plus .ciguardignore rationale-required suppression,...

3.2CVSS6AI score0.00158EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 9:28 p.m.18 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the /pagepreview page. An attacker can execute arbitrary JavaScript in the context of the user's browser by injecting malicious scripts. Details Cross-site scripting or XSS is a code vulnerability that occurs...

6.1CVSS5.8AI score0.00194EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 8:53 p.m.18 views

Server-side Request Forgery (SSRF)

Overview magicmirror is a The open source modular smart mirror platform. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the cors endpoint, which acts as an open HTTP proxy without authentication or URL validation. An attacker can force the server to make...

9.2CVSS5.9AI score0.01623EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/05 8:31 p.m.18 views

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the User-Agent header being logged and later rendered in the admin event log interface without proper output encoding. An attacker can execute arbitrary JavaScript in an administrator's browser by submitting...

9.6CVSS5.8AI score0.00282EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 8:29 p.m.18 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the isSSRFSafeURL function. An attacker can access internal network resources and sensitive cloud metadata by submitting specially crafted URLs that use IPv4-mapped IPv6 notation, which bypasses the...

8.8CVSS5.8AI score0.00226EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/05 8:13 p.m.18 views

Server-side Request Forgery (SSRF)

Overview link-preview-js is a Javascript module to extract and fetch HTTP link information from blocks of text. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of IPv6 and internal addresses during the DNS resolution process. An attacke...

8.7CVSS5.8AI score0.00536EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 6:42 p.m.18 views

Insufficient Session Expiration

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Session Expiration in the webhook authentication process. An attacker can continue to access protected webhook routes using a previously valid secret even after the secret ha...

7CVSS5.8AI score0.00289EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 6:13 p.m.18 views

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Overview inngest is an Official SDK for Inngest.com. Inngest is the reliability layer for modern applications. Inngest combines durable execution, events, and queues into a zero-infra platform with built-in observability. Affected versions of this package are vulnerable to Exposure of Sensitive...

8.7CVSS5.8AI score0.00383EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 5:03 p.m.18 views

Insufficient Session Expiration

Overview Affected versions of this package are vulnerable to Insufficient Session Expiration due to jupytercookiesecret never being automatically rotated or cleared. An attacker can keep or reuse authenticated session cookies after a password change by presenting a cookie signed with a secret tha...

7.6CVSS5.8AI score0.00308EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/05 3:33 p.m.18 views

Malicious Package

Overview generator-go-circleci is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 3:27 p.m.18 views

Malicious Package

Overview @infinid-indonesia/ui-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 1:35 p.m.18 views

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the Microsoft Teams SSO invoke handler. An attacker can gain unauthorized access to Teams SSO signin functionality by sending specially crafted SSO invoke reques...

6.3CVSS5.8AI score0.00231EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/05 12:18 a.m.18 views

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution when the Object.prototype has been polluted via a different exploit. The following properties in the HTTP adapter configuration may be manipulated, as...

9.1CVSS6.3AI score0.00715EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/05/04 9:30 p.m.18 views

Access Control Bypass

Overview rdiffweb is an A web interface to rdiff-backup repositories. Affected versions of this package are vulnerable to Access Control Bypass via the API authentication process. An attacker can gain unauthorized access to other users' data and perform actions on their behalf by using any valid ...

8.6CVSS5.8AI score0.00245EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/04 8:23 p.m.18 views

Information Exposure

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Information Exposure in the analysis of allowlisted commands containing unquoted heredocs. An attacker can cause unintended shell expansion by crafting a command that hides malicious code...

8.8CVSS5.9AI score0.00362EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/05/04 5:20 p.m.18 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization when handling HTTP request paths that have had normalizedPath applied. An attacker can gain unauthorized access to protected resources by appending a semicolon and arbitrary text to the request URL, exploiting...

8.8CVSS6AI score0.00484EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/05/04 12:01 a.m.18 views

Malicious Package

Overview @w3m-app/isconnected is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/29 9:03 p.m.18 views

SQL Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to SQL Injection via the process of constructing SQL queries in the Snowflake and legacy MySQL v1 nodes when user-controlled input is directly interpolated into identifier fields such as table name,...

8.8CVSS5.9AI score0.00254EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/26 3:10 p.m.18 views

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via the DsSpelExpressionProcessor in the datasource key resolution path. An attacker can trigger arbitrary expression evaluation by supplying a datasource key expression th...

6.5CVSS7.3AI score0.00237EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/25 11:50 p.m.18 views

Insufficiently Protected Credentials

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the MINIMAXAPIHOST environment variable injection in workspace dotenv files. An attacker can intercept sensitive API credentials by redirecting...

6.8CVSS5.5AI score0.00119EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/04/24 7:21 p.m.18 views

Improper Encoding or Escaping of Output

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output through the encode function in AxiosURLSearchParams. An attacker can smuggle a NUL byte into serialized query strings by supplying...

6.3CVSS5.5AI score0.00217EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/24 4:34 p.m.18 views

Arbitrary Command Injection

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Arbitrary Command Injection via...

8.8CVSS6AI score0.00314EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/23 12:00 a.m.18 views

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack due to insecure handling of Process ID PID files. When an application uses the ApplicationPidFileWriter, it writes its PID to a predictable file system path. A local attacker with write access to the PID file's directory...

6.7CVSS5.4AI score0.00112EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/22 1:29 a.m.18 views

Malicious Package

Overview @bitunix/test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/21 7:17 p.m.18 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Webroot HTTP-01 challenge provider. An attacker can write arbitrary files to the filesystem by supplying crafted challenge tokens containing directory traversal sequences. Details A Directory Traversal attack...

8.8CVSS6.5AI score0.0034EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/21 5:17 p.m.18 views

Regular Expression Denial of Service (ReDoS)

Overview signalk-server is an An implementation of a Signal K server for boats. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the contextMatcher and pathMatcher functions. An attacker can cause the server to become unresponsive and exhaust CPU...

8.7CVSS5.8AI score0.00427EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/04/21 12:00 a.m.18 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Optimizer component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network. Remediation Upgrade libmysqlclient to version...

6.9CVSS5.5AI score0.00323EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/21 12:00 a.m.18 views

Insertion of Sensitive Information into Externally-Accessible File or Directory

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Externally-Accessible File or Directory via the Information Schema component. An attacker can gain unauthorized access to sensitive data by sending crafted requests over the network with high...

5.1CVSS7.7AI score0.00259EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/21 12:00 a.m.18 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the InnoDB component. An attacker can cause the server to hang or crash repeatedly by sending crafted requests over the network with high privileges. Remediation Upgrade...

6.9CVSS7.7AI score0.00242EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/20 6:15 a.m.18 views

Malicious Package

Overview @kjma/mailcraft is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.7AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/20 6:13 a.m.18 views

Arbitrary Code Injection

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Arbitrary Code Injection via the executeshellcommand function. An attacker can execute arbitrary code by supplying crafted input remotely. Remediation There is no...

7.5CVSS7.9AI score0.00311EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/18 1:25 a.m.18 views

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read in the ptpunpackSonyDPD function when parsing the FormFlag field due to missing bounds checking before reading data. An attacker can cause information disclosure or application instability by supplying crafted input...

5.2CVSS5.8AI score0.00198EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/17 10:33 p.m.18 views

External Control of File Name or Path

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to External Control of File Name or Path via improper validation of file paths in the media embedding. An attacker can access arbitrary files on the host system or trigger network credential...

7.1CVSS5.9AI score0.00264EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/04/17 10:31 p.m.18 views

Arbitrary Code Injection

Overview math-codegen is a Generates code from mathematical expressions Affected versions of this package are vulnerable to Arbitrary Code Injection via the parse function. An attacker can execute arbitrary code by supplying crafted input that is injected directly into a dynamically created...

9.8CVSS6.2AI score0.00393EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/17 9:53 p.m.18 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the /dreaming path in the operator.write. An attacker can modify persistent memory dreaming settings by sending write-scoped gateway requests, resulting in...

7.1CVSS5.7AI score0.00213EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/04/16 10:48 p.m.18 views

Insufficient Verification of Data Authenticity

Overview Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity via the decidedByUserId field in approval-related endpoints. An attacker can forge decision attribution by supplying an arbitrary user identifier in the request body, causing the system to...

5.3CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/16 10:48 p.m.18 views

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the cleanupCommand field in the PATCH /api/execution-workspaces/:id endpoint, which is stored and later executed by the server without input validation or sanitization. An attacker can execute arbitrary system...

9.2CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/16 10:46 p.m.18 views

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the spawn function. An attacker can execute arbitrary shell commands on the server and access sensitive environment variables, including API keys, authentication secrets, and database credentials, by...

8.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/04/15 9:25 p.m.18 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the namespace parameter in the Ruler API endpoint after double URL encoding. An attacker can access arbitrary files by sending specially crafted requests. Details A Directory Traversal attack also known as path...

6.9CVSS6.5AI score0.00409EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/04/15 10:13 a.m.18 views

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature due to the verifybyte expected function in JcaContentVerifierProviderBuilder. An attacker can forge a protected CMP/PKI message by supplying an empty composite signature sequence that...

9.2CVSS5.7AI score0.0064EPSS
SaveExploits0References3
Total number of security vulnerabilities5000