Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package was involved in a supply chain compromise that affected multiple namespaces on the npm registry, including popular caching and key-value storage utilities. A malicious actor compromised a maintainer...

Cross-site Scripting (XSS)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Cross-site Scripting XSS in the bundled domino DOM serializer, which does not escape text nodes inside the fallback raw-content elements , , , and during SSR...

Malicious Package

Overview asdsafsadad is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview express-sequelize-wrapper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview rshell is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview merg-descripters is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview ecto-logger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Insufficiently Protected Credentials

Overview flyto-core is an A workflow engine with 412 built-in modules. Trace every step. Replay from any point. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via the baseurl parameter in the llm.chat, ai.model, llm.agent, and vector.connector processes. ...

Out-of-bounds Read

Overview Magick.NET-Q8-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Server-side Request Forgery (SSRF)

Overview datamodel-code-generator is a Datamodel Code Generator Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the getbody function when processing URLs provided via the --url argument, as there is no validation of host or IP addresses and redirects are...

Malicious Package

Overview streak-core-math is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview fluid-type-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview json-schema-inspector is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Allocation of Resources Without Limits or Throttling

Overview pterodactyl/panel is a game management panel. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the use of a shared global rate-limit key in the authentication. An attacker can cause a denial of service for all users by sendin...

Malicious Package

Overview aone-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview local-mcp is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview mcp-server-supabase is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview npm-bug-bounty-test1-rhyselsmore is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview sysau is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Resources Downloaded over Insecure Protocol

Overview thorsten/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Resources Downloaded over Insecure Protocol through the configuration API. An attacker can execute arbitrary PHP code by uploading a malicious ZIP file ...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the configinput and denoisespatial functions of the vfhqdn3d filter, which sizes its working buffers for the initial frame dimensions and does not resize them when a later frame is larger. An attacker can...

Malicious Package

Overview @array-util/subsearch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the untransform function of the THeaderTransport process. An attacker can achieve arbitrary code execution or cause a denial of service by sending specially crafted data that triggers a heap buffer overflow...

Malicious Package

Overview font-huge is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the zlib transport message-size tracking. An attacker can bypass the configured maxMessageSize/remainingmessagesize limits by sending a highly compressible message and forcing repeated decompressed read...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview thrift is a Ruby bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the ZLIB transform in lib/rb/lib/thrift/transport/headertransport.rb. An attacker can trigger memory and CPU...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview thrift is a Python bindings package for Apache Thrift. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification through the ZLIB read path in thrift.transport.THeaderTransport.THeaderTransport. An attacker can force excessive memo...

Malicious Package

Overview npx-whoami-demo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @thone33/core-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview chai-log is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview permcarmserver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview sixbails is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @wrenfield/abitype is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview express-self-destruct1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview mrmustard is a malicious package. This package contains malicious code, and its content was quarantined by the official package manager. Version 0.7.4 was published to PyPI using stolen maintainer credentials and contained an injected credential stealer. The malicious code ran upon impor...

Malicious Package

Overview @akunsansan0/pucuk12 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the defaultContentParameterDecoder function. An attacker can cause the application to crash or abort request processing by sending a crafted HTTP request that targets an OpenAPI operation with a content...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the authentication process when handling OIDC subject identifiers due to the use of an accent-insensitive collation in the database. An attacker can gain unauthorized access to another user's account by...

SQL Injection

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to SQL Injection via the DESCRIBE process. An attacker can execute arbitrary SQL commands by creating a table with a specially crafted name containing backticks and semicolons, which are not proper...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the metadata endpoints, which fail to sanitize sensitive fields from user profiles. An attacker can obtain OAuth2 access and refresh tokens belonging to other users by...

Allocation of Resources Without Limits or Throttling

Overview react-server-dom-webpack is a React Server Components bindings for DOM using Webpack. This is intended to be integrated into meta-frameworks. It is not intended to be imported directly. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttli...

Improper Check for Unusual or Exceptional Conditions

Overview @auth/core is an Authentication for the Web. Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions via the getToken function. An attacker can cause the application to throw an unhandled exception and disrupt service availability by sendi...

Malicious Package

Overview xrblocks-remote-control is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview da-sc-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

External Control of File Name or Path

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to External Control of File Name or Path via the Edit Image. An attacker can write arbitrary files outside the intended directory by supplying crafted values to the output format parameter. Workaround...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the Bzip2Decoder handler's run-length encoding state machine. An attacker can cause the event-loop thread to hang indefinitely by supplying a specially crafted bzip2 stream that triggers an infinite loop during...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through modRMRequired and decode in arch/X86/X86DisassemblerDecoder.c. An attacker can crash any application using a reduced X86 Capstone build by supplying crafted x86/x86-64 input containing a 3DNow! opcode...