Lucene search
+L
SnykMost viewed

47469 matches found

Snyk
Snyk
added 2026/07/27 1:18 a.m.20 views

Malicious Package

Overview chai-log is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 1:10 a.m.20 views

Malicious Package

Overview sixbails is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 1:07 a.m.20 views

Malicious Package

Overview @wrenfield/abitype is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/27 12:55 a.m.20 views

Malicious Package

Overview express-timer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/26 12:25 p.m.20 views

Malicious Package

Overview @akunsansan0/pucuk11 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/26 12:25 p.m.20 views

Malicious Package

Overview @akunsansan0/jorelat5 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/25 12:44 p.m.20 views

Malicious Package

Overview -pem-misa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 10:28 p.m.20 views

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

8.7CVSS5.4AI score0.00346EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 9:42 p.m.20 views

Cross-site Request Forgery (CSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the confirmChatLinkSession process. An attacker can gain unauthorized access to another user's permissions and perform actions as that user by inducing th...

7.7CVSS5.9AI score
SaveExploits0References4
Snyk
Snyk
added 2026/07/24 9:17 p.m.20 views

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch...

8.5CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 9:17 p.m.20 views

Server-side Request Forgery (SSRF)

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by...

8.5CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 9:17 p.m.20 views

Incorrect Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization checks in the url endpoint for S3 attachments. An attacker can gain unauthorized access to generate S3 PutObject presigned URLs by sending...

7.7CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 8:51 p.m.20 views

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the meta.knowledge process. An attacker can gain unauthorized write or delete access to files belonging to other users by attaching a file ID, for which they only have read...

5.4CVSS5.9AI score0.0042EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/24 8:49 p.m.20 views

User Impersonation

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to User Impersonation via the wsterminal process. An attacker can gain unauthorized access to another user's terminal session by injecting crafted values into the sessionid parameter, causing the backend to...

8CVSS5.8AI score0.00391EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/07/24 5:00 p.m.20 views

Insufficient Session Expiration

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Insufficient Session Expiration in the realtime authentication process. An attacker can maintain unauthorized access to realtime features by using a JWT that has been revoked via sign-out or back-channel...

7.1CVSS5.8AI score0.00456EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/24 4:18 p.m.20 views

Cross-site Scripting (XSS)

Overview trix is a Rich Text Editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the HTMLParser process. An attacker can inject malicious scripts by pasting crafted HTML containing a span element with an empty data-trix-attachment attribute, which bypasses...

5.1CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/24 2:06 p.m.20 views

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through inefficient route matching in the manifest endpoint. An attacker can cause excessive server load and degrade response times by sending unauthenticated targeted requests. Note: This is only...

8.7CVSS5.8AI score0.00403EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 9:50 p.m.20 views

Directory Traversal

Overview io.kubernetes:client-java is a Client Java package. Affected versions of this package are vulnerable to Directory Traversal via the copyDirectoryFromPod process when enableTarCompressing is set to false. An attacker can create files in arbitrary locations on the client machine by...

4.8CVSS6.4AI score0.00353EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 8:10 p.m.20 views

Malicious Package

Overview eth-slint is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 7:58 p.m.20 views

Directory Traversal

Overview diffusers is a State-of-the-art diffusion in PyTorch and JAX. Affected versions of this package are vulnerable to Directory Traversal via the getcheckpointshardfiles function. An attacker can access arbitrary files by providing crafted weightmap values containing directory traversal...

5.3CVSS6.4AI score0.00398EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 7:34 p.m.20 views

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' in the deserializeErrors function during SSR hydration. An attacker can cause unexpected constructor execution on the client, potentially resulting in...

6.9CVSS6.1AI score0.00305EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 6:47 p.m.20 views

Malicious Package

Overview yuinpm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 3:42 p.m.20 views

Malicious Package

Overview svelte-streak-metrics is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 1:07 a.m.20 views

Malicious Package

Overview xrblocks-remote-control is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 1:07 a.m.20 views

Malicious Package

Overview create-kumo-project is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/23 1:02 a.m.20 views

Malicious Package

Overview mcp-notes-server-poc-praetorian is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/22 11:08 p.m.20 views

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in createPatchedFetcher in packages/next/src/server/lib/patch-fetch.ts. An attacker can leak a cached response body from one request to another by sending...

7.5CVSS5.9AI score0.00336EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/22 11:06 p.m.20 views

Improper Encoding or Escaping of Output

Overview next is a react framework. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the IncrementalCache.generateCacheKey function in next/dist/server/lib/incremental-cache. An attacker can make a server-side fetch return a cached response body from...

6.3CVSS5.9AI score0.00351EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/22 9:48 p.m.20 views

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the WebSocket handshake. An attacker can bypass expected header...

7.5CVSS5.8AI score0.00249EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/22 7:46 p.m.20 views

Double Free

Overview Affected versions of this package are vulnerable to Double Free in ffnvdecstartframesepref in libavcodec/nvdec.c. An attacker can corrupt memory by supplying a crafted video file that drives NVDEC decoding into the “No decoder surfaces left” error path, where the frame-description contex...

8.8CVSS5.5AI score0.00335EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/21 6:17 p.m.20 views

Directory Traversal

Overview @hono/node-server is a Node.js Adapter for Hono Affected versions of this package are vulnerable to Directory Traversal in the serve-static on Windows hosts when an encoded backslash %5C in the request path is decoded to , which the Windows path resolver treats as a separator. This allow...

8.2CVSS6.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/21 2:14 p.m.20 views

Malicious Package

Overview upllib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 11:54 p.m.20 views

Incorrect Authorization

Overview @ai-sdk/harness-opencode is a The OpenCode harness connects HarnessAgent to OpenCode through a sandboxed bridge. Affected versions of this package are vulnerable to Incorrect Authorization through the tool relay in tool-relay-auth.ts and tool-relay.ts. An attacker can invoke host-exposed...

9CVSS6AI score0.00161EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 3:59 p.m.20 views

Malicious Package

Overview Rg.Plugins.Popups.Net is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 3:59 p.m.20 views

Malicious Package

Overview Modernial.UI.WinForm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 12:19 a.m.20 views

Malicious Package

Overview @vite-js/vui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.20 views

Malicious Package

Overview zzfadgivar11 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.20 views

Malicious Package

Overview zwkopt3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/17 1:33 a.m.20 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the device-pair approval. An attacker can perform unauthorized actions by exploiting misconfigured input paths when the affected feature is enabled and...

8.8CVSS5.3AI score0.00451EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/16 4:34 p.m.20 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through PluginsGenerationService in the plugin manifest generation code. An attacker can make the generated Copilot or Teams plugin manifest reference files outside the plugin package by supplying an OpenAPI...

9.8CVSS6.4AI score0.01331EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/16 1:29 a.m.20 views

Malicious Package

Overview nyt-cms is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 4:12 p.m.20 views

Malicious Package

Overview npm-rce-poc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:36 p.m.20 views

Symlink Attack

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

4.8CVSS5.9AI score0.00124EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:36 p.m.20 views

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package ar...

2.9CVSS5.9AI score0.00102EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:36 p.m.20 views

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

7.5CVSS5.9AI score0.00187EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:36 p.m.20 views

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

7.5CVSS5.9AI score0.00187EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:36 p.m.20 views

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

6.3CVSS5.9AI score0.00353EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:32 p.m.20 views

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

2.9CVSS5.9AI score0.00139EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 6:50 p.m.20 views

Server-side Request Forgery (SSRF)

Overview alextselegidis/easyappointments is a powerful Open Source Appointment Scheduler that can be installed on your server. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the connecttoserver function. An attacker can access internal network resources by...

8.8CVSS6.1AI score0.00311EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 4:37 a.m.20 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the writeFile function in the ACP ToolBridge Workspace Handler. An attacker can access or modify files outside the intended directory by supplying crafted path input remotely. Details A Directory Traversal attack...

6.5CVSS7AI score0.00425EPSS
SaveExploits0References2
Total number of security vulnerabilities5000