Lucene search
+L
SnykMost viewed

42504 matches found

Snyk
Snyk
added 2026/07/07 8:56 p.m.17 views

Operation on a Resource after Expiration or Release

Overview @better-auth/scim is a SCIM plugin for Better Auth Affected versions of this package are vulnerable to Operation on a Resource after Expiration or Release in the deleteUser method when secondaryStorage is configured and session.storeSessionInDatabase is unset or set to false. An attacker...

5.9CVSS6.2AI score
SaveExploits0References4
Snyk
Snyk
added 2026/07/07 4:40 p.m.17 views

Use of Cache Containing Sensitive Information

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the UpdateCacheMiddleware and cachepage process when responses that vary on...

5.3CVSS6AI score0.00429EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 4:12 p.m.17 views

Malicious Package

Overview runtimedev-link is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 4:07 p.m.17 views

Malicious Package

Overview polytrade is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 4:00 p.m.17 views

Malicious Package

Overview zod-pino434 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 2:48 p.m.17 views

Malicious Package

Overview @sqlite-list/schema-generator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 2:48 p.m.17 views

Malicious Package

Overview @sqlite-access/nodesql is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 1:59 p.m.17 views

Malicious Package

Overview mcp-server-pg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 9:13 p.m.17 views

Command Injection

Overview linuxfabrik-lib is a Python libraries used in various Linuxfabrik projects, including the 'Linuxfabrik Monitoring Plugins' project. Affected versions of this package are vulnerable to Command Injection via the shellexec function. An attacker can execute arbitrary commands with elevated...

8.5CVSS6.2AI score0.00197EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 8:42 p.m.17 views

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value via the PcfFontFile.loadbitmaps process. An attacker can cause excessive memory allocation by supplying crafted PCF font data that bypasses decompression bomb checks. Remediation Upgrade pillo...

8.7CVSS6AI score0.0041EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/06 6:58 p.m.17 views

Malicious Package

Overview tailwindcss-framer-motion is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:58 p.m.17 views

Malicious Package

Overview syncora is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:57 p.m.17 views

Malicious Package

Overview react-svg-render is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:57 p.m.17 views

Malicious Package

Overview react-native-template-my-starter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:01 p.m.17 views

Malicious Package

Overview mongoose-lean-hooks is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 10:35 a.m.17 views

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation through CometdBinding.populateExchangeFromMessage in camel-cometd. An attacker can inject Camel control headers into a CometD message by supplying an ext.CamelHeaders map when publishing to a CometD endpoint. T...

9.8CVSS6.1AI score0.00827EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/04 9:00 p.m.17 views

Malicious Package

Overview @frostnode/waitfor is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 8:18 p.m.17 views

Out-of-bounds Read

Overview onnx is an Open Neural Network Exchange Affected versions of this package are vulnerable to Out-of-bounds Read through convPoolShapeInferenceopset19 in onnx/defs/nn/old.cc. An attacker can trigger the flaw by supplying a malformed convolution or pooling model that reaches the...

5.3CVSS6.2AI score0.0043EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 3:12 a.m.17 views

Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the makelabel function in the reduce method. An attacker can execute arbitrary commands by crafting...

8.1CVSS6.2AI score0.00431EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 8:18 a.m.17 views

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the udpreceive process. An attacker can cause the client to enter a busy-loop and become unresponsive by continuously sending zero-length UDP datagrams from a malicious HTTP/3 server. Remediation Upgrade libcurl to...

8.7CVSS6.2AI score0.0101EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/02 9:13 p.m.17 views

User Impersonation

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to User Impersonation via the isLocalRequest function. An attacker can gain unauthorized access to restricted routes and interact with child processes by spoofing the Host and Orig...

8.3CVSS6AI score0.00357EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/02 8:23 p.m.17 views

Arbitrary Argument Injection

Overview linuxfabrik-lib is a Python libraries used in various Linuxfabrik projects, including the 'Linuxfabrik Monitoring Plugins' project. Affected versions of this package are vulnerable to Arbitrary Argument Injection in the configuration of the sudoers file, which allows arbitrary arguments ...

8.4CVSS6.2AI score0.00188EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/02 9:48 a.m.17 views

Malicious Package

Overview vitest-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 9:19 p.m.17 views

Access of Resource Using Incompatible Type ('Type Confusion')

Overview api-platform/core is a builds a fully-featured hypermedia or GraphQL API in minutes. Affected versions of this package are vulnerable to Access of Resource Using Incompatible Type 'Type Confusion' through the getResourceFromIri process. An attacker can assign a resource of an unintended...

7.1CVSS6AI score0.00336EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 7:00 p.m.17 views

Arbitrary Argument Injection

Overview repomix is an A tool to pack repository contents to single file for AI consumption Affected versions of this package are vulnerable to Arbitrary Argument Injection via unsanitized input to the remoteBranch parameter in the execGitShallowClone process. An attacker can execute arbitrary...

8.8CVSS6.2AI score0.00539EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/01 6:19 p.m.17 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the HTTP/1.1 message parsing process. An attacker can exhaust system memory by sending messages with an excessive number of headers or excessively long headers. Remediation Upgrad...

7.5CVSS6AI score0.0087EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 4:19 p.m.17 views

Deserialization of Untrusted Data

Overview megatron-bridge is a Megatron Bridge: Training Recipes for Megatron-based LLM and VLM models Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the deserialization process. An attacker can execute arbitrary code, escalate privileges, tamper with dat...

8.5CVSS6AI score0.00431EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 4:19 p.m.17 views

Deserialization of Untrusted Data

Overview megatron-bridge is a Megatron Bridge: Training Recipes for Megatron-based LLM and VLM models Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the process responsible for dynamically managing code resources. An attacker can execute arbitrary code,...

8.5CVSS5.9AI score0.00405EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 4:19 p.m.17 views

Arbitrary Code Injection

Overview megatron-bridge is a Megatron Bridge: Training Recipes for Megatron-based LLM and VLM models Affected versions of this package are vulnerable to Arbitrary Code Injection via the deserialization process. An attacker can execute arbitrary code, escalate privileges, tamper with data, and...

8.5CVSS5.8AI score0.00227EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 1:18 p.m.17 views

Interpretation Conflict

Overview @fastify/middie is a Middleware engine for Fastify Affected versions of this package are vulnerable to Interpretation Conflict via the path parameter handling process. An attacker can gain unauthorized access to protected route handlers by sending a crafted URL containing an encoded slas...

9.3CVSS6AI score0.00517EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 12:28 p.m.17 views

Incorrect Privilege Assignment

Amendment This was deemed not a vulnerability. Overview foreman is a complete lifecycle management tool for physical and virtual servers. Affected versions of this package are vulnerable to Incorrect Privilege Assignment via manipulation of the Usergroup process. An attacker can gain...

8.8CVSS6AI score0.00555EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 11:20 p.m.17 views

Incomplete List of Disallowed Inputs

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the reduce method during deserialization. An attacker can execute arbitrary operating system commands ...

7.6CVSS6.2AI score0.00577EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 3:27 p.m.17 views

Incorrect Behavior Order

Overview @fastify/express is an Express compatibility layer for Fastify Affected versions of this package are vulnerable to Incorrect Behavior Order due to incorrect mount path prefix rewriting in the use middleware handling. An attacker can reach protected routes without the intended middleware ...

9.1CVSS6AI score0.00522EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 12:24 p.m.17 views

Missing Authorization

Overview org.apache.activemq:activemq-all is a package that puts together an ActiveMQ jar bundle. Affected versions of this package are vulnerable to Missing Authorization in the process that manages temporary destinations. An attacker can gain unauthorized access to consume messages from another...

8.2CVSS5.8AI score0.00563EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 11:25 a.m.17 views

Inefficient Algorithmic Complexity

Overview brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the expand function. An attacker can cause excessive CPU consumption and block the event loop by supplying a specially crafted string...

8.7CVSS6.3AI score0.00364EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 7:29 p.m.17 views

Incorrect Authorization

Overview mythic is an Interact with Mythic C2 Framework Instances Affected versions of this package are vulnerable to Incorrect Authorization due to a broken permission filter in the payloadbuildstep table, which uses an always-satisfied or condition that bypasses operation-scoped access controls...

7.1CVSS6AI score0.00434EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 2:18 p.m.17 views

Malicious Package

Overview quirky-token is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/28 7:34 p.m.17 views

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the GoTarget function in the gofmt component. An attacker can execute arbitrary system commands by manipulating input passed to this function from a local environment. Remediation There is no fixed versio...

5.3CVSS6.3AI score0.0118EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/27 12:12 a.m.17 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the patch-remove process. An attacker can cause deletion of arbitrary files outside the intended directory by crafting a patch entry that resolves outside the configured patches directory...

7.1CVSS5.9AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/26 5:32 p.m.17 views

Insecure Default Initialization of Resource

Overview Affected versions of this package are vulnerable to Insecure Default Initialization of Resource via the MSISDN authentication process. An attacker can gain unauthorized access to arbitrary user sessions by injecting crafted input into the LDAP search filter. This is only exploitable if t...

8.7CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
added 2026/06/25 9:26 p.m.17 views

Allocation of Resources Without Limits or Throttling

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the deserialization process for multi-dimensional arrays. An attacker can cause excessive memor...

7.5CVSS5.8AI score0.00405EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 7:36 p.m.17 views

Inefficient Algorithmic Complexity

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the ExpandoObjectFormatter.Deserialize process. An attacker can cause excessive CPU consumption and memory...

7.5CVSS5.8AI score0.00405EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 7:19 p.m.17 views

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via the Hook Authentication process. An attacker can execute arbitrary operating system commands by injecting shell metacharacters into the username or password fields during login. Remediation There is no fixed versio...

9.8CVSS6.1AI score0.00764EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 7:19 p.m.17 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through the RemoveAll process during upload failure-cleanup. An attacker can delete files outside their authorized directory by leveraging a symlink within their permitted scope, thereby bypassing intended access...

8.2CVSS6.5AI score0.00494EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/24 7:15 p.m.17 views

Arbitrary Argument Injection

Overview Jellyfin.Common is an a Free Software Media System that puts you in control of managing and streaming your media. Affected versions of this package are vulnerable to Arbitrary Argument Injection via the SubtitleEncoder.ConvertTextSubtitleToSrtInternal process. An attacker can achieve...

8.8CVSS6AI score0.00664EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/24 3:18 p.m.17 views

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection due to build operations being performed on the Jenkins controller instead of the assigned agent. An attacker can execute arbitrary code on the Jenkins controller by obtaining Item/Configure permission. Remediati...

9.2CVSS6.2AI score0.00627EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/24 1:53 a.m.17 views

Malicious Package

Overview tailwind-textform-fill is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/23 10:11 p.m.17 views

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization in the selectlist API endpoint due to missing authorization checks. An attacker can enumerate all active user accounts, harvest usernames, collect...

7.1CVSS5.8AI score0.00385EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/23 9:17 p.m.17 views

Cross-site Scripting (XSS)

Overview @mariozechner/pi-coding-agent is a Coding agent CLI with read, bash, edit, write tools and session management Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper sanitization of Markdown link and image URLs during HTML session export. An attacker can...

2.5CVSS6AI score0.00172EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/22 11:33 p.m.17 views

Symlink Attack

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Symlink Attack via the processPWAZip process. An attacker can access sensitive files on the server by uploading a crafted zip archive containing symbolic links that point to arbitrary files, whi...

9.6CVSS5.9AI score0.00494EPSS
SaveExploits1References3
Total number of security vulnerabilities5000