Lucene search
+L
SnykMost viewed

47469 matches found

Snyk
Snyk
added 2026/07/06 9:37 p.m.20 views

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection in the renderObjectTemplate process. An attacker can execute arbitrary code by supplying malicious input in the HTTP Referer header when saving entries in the control...

9.9CVSS6.3AI score0.00412EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:58 p.m.20 views

Malicious Package

Overview tailwindcss-framer-motion is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:54 p.m.20 views

Malicious Package

Overview chalki-pretty is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:50 p.m.20 views

Malicious Package

Overview bjs-biginteger is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 9:00 p.m.20 views

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 9:00 p.m.20 views

Malicious Package

Overview @lazyutil/dater is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/04 11:13 a.m.20 views

Improper Resource Shutdown or Release

Overview Affected versions of this package are vulnerable to Improper Resource Shutdown or Release via the RRCInactiveTransitionReport function of the NGAP Message Handler component. An attacker can cause a service disruption by sending specially crafted messages remotely. Remediation Upgrade...

5.3CVSS6AI score0.00545EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 10:19 p.m.20 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to improper enforcement of the PKCE S256 challenge during the OAuth2 token exchange process. An attacker can obtain access tokens without providing the expected code verifier by bypassing the intended...

9.1CVSS6AI score0.00495EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 4:06 p.m.20 views

Malicious Package

Overview api-ts-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 8:19 a.m.20 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to the omission of SSH host verification options in the --proto-default process. An attacker can intercept or impersonate an SSH server by exploiting the lack of host verification during connection establishmen...

7.5CVSS6AI score0.00399EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/02 9:48 a.m.20 views

Malicious Package

Overview vitest-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 9:19 p.m.20 views

Directory Traversal

Overview gradio is a Python library for easily interacting with trained machine learning models Affected versions of this package are vulnerable to Directory Traversal via the preprocess method in the FileExplorer component. An attacker can read arbitrary files outside the configured rootdir by...

8.7CVSS6.5AI score0.00933EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/01 9:19 p.m.20 views

Allocation of Resources Without Limits or Throttling

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

6.9CVSS5.9AI score0.004EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 11:20 p.m.20 views

Deserialization of Untrusted Data

Overview picklescan is a Security scanner detecting Python Pickle files performing suspicious actions Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the doctest.debugscript function. An attacker can execute arbitrary commands by crafting malicious pickle...

8.1CVSS6AI score0.00839EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 11:20 p.m.20 views

Uncontrolled Search Path Element

Overview app-builder-bin is an app-builder precompiled binaries Affected versions of this package are vulnerable to Uncontrolled Search Path Element through the execWine/executeAppBuilder command path in builder-util and app-builder-lib on non-Windows systems. An attacker can execute...

7.8CVSS6.3AI score0.00186EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/30 11:19 p.m.20 views

Heap-based Buffer Overflow

Overview json is a JSON implementation as a Ruby extension in C. Affected versions of this package are vulnerable to Heap-based Buffer Overflow via the JSON.dump or JSON::Stategenerate process when streaming oversized attacker-controlled strings to an IO object. An attacker can cause a process...

6.3CVSS5.8AI score0.00382EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 11:16 p.m.20 views

Improper Privilege Management

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Privilege Management in the updatePermissions process. An attacker can gain unauthorized administrative privileges by assigning high-value...

8.8CVSS5.8AI score0.00442EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 10:56 p.m.20 views

Deserialization of Untrusted Data

Overview com.mchange:c3p0 is a mature, highly concurrent JDBC Connection pooling library, with support for caching and reuse of PreparedStatements. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process. An attacker can execute arbitra...

7.5CVSS6.3AI score0.00284EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 10:20 p.m.20 views

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via repeated crafted connection requests to the process. An attacker can cause memory to be leaked by sending multiple specially crafted requests, which may eventually exhaust system...

8.7CVSS5.8AI score0.00646EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 5:26 p.m.20 views

Authentication Bypass Using an Alternate Path or Channel

Overview Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the WebSocket upgrade request handling process. An attacker can gain unauthorized access to downstream services by sending specially crafted WebSocket upgrade requests that...

9.3CVSS5.9AI score0.00565EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 3:59 p.m.20 views

Malicious Package

Overview chai-as-persisted is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 3:27 p.m.20 views

Incorrect Behavior Order

Overview @fastify/express is an Express compatibility layer for Fastify Affected versions of this package are vulnerable to Incorrect Behavior Order due to incorrect mount path prefix rewriting in the use middleware handling. An attacker can reach protected routes without the intended middleware ...

9.1CVSS6AI score0.00522EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 3:13 p.m.20 views

Malicious Package

Overview nbmolviz-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/30 2:10 p.m.20 views

Malicious Package

Overview ts-linting-builder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 7:28 p.m.20 views

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the rule ID path parameter of the alert-history endpoints. An attacker can execute arbitrary database queries and access sensitive data by injecting specially crafted input. This may also allow the attacker to perform...

8.5CVSS6.1AI score0.00323EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:53 p.m.20 views

Malicious Package

Overview @tbe-ui/ides is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:53 p.m.20 views

Malicious Package

Overview @riskine-frontend/design-elements is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:53 p.m.20 views

Malicious Package

Overview @react-thee/rapier is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:50 p.m.20 views

Malicious Package

Overview @rmlibrary/formatting is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:50 p.m.20 views

Malicious Package

Overview @multformats/multiaddr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:50 p.m.20 views

Malicious Package

Overview @settle-sea/supporting-documents is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:44 p.m.20 views

Malicious Package

Overview @source-row/source-container is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:44 p.m.20 views

Malicious Package

Overview cdocs-markdoc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:44 p.m.20 views

Malicious Package

Overview @shopbop/api-models is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 4:44 p.m.20 views

Malicious Package

Overview cdocs-data is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 2:21 p.m.20 views

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack via the getfattr or setfattr process. An attacker can gain elevated privileges by substituting a symbolic link for a pathname component during directory traversal, causing operations to be redirected to arbitrary files wh...

8.4CVSS5.8AI score0.00146EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/29 11:50 a.m.20 views

Cross-site Scripting (XSS)

Overview lollms is a python library for AI personality definition Affected versions of this package are vulnerable to Cross-site Scripting XSS via the createpost function within backend/routers/social/init.py, where user-provided content is directly assigned to the DBPost model without...

9.6CVSS7.8AI score0.0121EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/29 3:33 a.m.20 views

Malicious Package

Overview velocityfix is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/28 6:51 p.m.20 views

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in scanner.rb. An attacker can cause a stack overflow and crash the application by supplying CSS input containing numerous adjacent comments. Remediation Upgrade crass to version 1.0.7 or higher. References -...

6.3CVSS5.9AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/27 12:12 a.m.20 views

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path through the patch-remove process. An attacker can cause deletion of arbitrary files outside the intended directory by crafting a patch entry that resolves outside the configured patches directory...

7.1CVSS5.9AI score0.00401EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/26 11:55 p.m.20 views

Insertion of Sensitive Information Into Sent Data

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the listDDNS and listNotification handlers, which return full resource objects including plaintext third-party API credentials such as API tokens, secret keys, and webhook URLs witho...

6.9CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 11:10 p.m.20 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the Live Preview process. An attacker can submit unauthorized content and generate shareable preview URLs by leveraging insufficient permission checks. Remediation Upgrade statamic/cms to version 5.74.0, 6.20....

5.1CVSS5.8AI score0.00303EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 10:11 p.m.20 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the file-download API endpoint in the LocalStorage process. An attacker can access arbitrary files on the server filesystem, including sensitive data such as embedded databases, secrets, and environment variables...

8.7CVSS6.5AI score0.00567EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/26 9:23 p.m.20 views

Unlock of a Resource that is not Locked

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Unlock of a Resource that is not Locked in the editUser and updateUserRights processes. An attacker can gain unauthorized SuperAdmin privileges or grant...

8.8CVSS5.9AI score0.00442EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/26 6:15 p.m.20 views

Directory Traversal

Overview extract-zip is an unzip a zip file into a directory using 100% javascript Affected versions of this package are vulnerable to Directory Traversal via the extraction process. An attacker can access or modify arbitrary files by crafting a malicious zip archive containing symlinks that poin...

8.6CVSS6.5AI score0.00391EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/06/25 9:31 p.m.20 views

Deserialization of Untrusted Data

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the typeless deserialization process. An attacker can instantiate disallowed or dangerous types by wrapping them...

7.5CVSS5.8AI score0.00348EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/25 9:26 p.m.20 views

Allocation of Resources Without Limits or Throttling

Overview MessagePack is a MessagePackMsgPack Serializer for C.NET, .NET Core, Unity, Xamarin. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the deserialization process for multi-dimensional arrays. An attacker can cause excessive memor...

7.5CVSS5.8AI score0.00405EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/25 3:17 p.m.20 views

Cross-site Scripting (XSS)

Overview pretix is a Reinventing presales, one ticket at a time Affected versions of this package are vulnerable to Cross-site Scripting XSS via the layout specification process of PDF ticket or badge layouts. An attacker can execute arbitrary JavaScript in the browser context of another backend...

8.8CVSS5.9AI score0.00425EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/24 7:15 p.m.20 views

Arbitrary Argument Injection

Overview Jellyfin.Common is an a Free Software Media System that puts you in control of managing and streaming your media. Affected versions of this package are vulnerable to Arbitrary Argument Injection via the SubtitleEncoder.ConvertTextSubtitleToSrtInternal process. An attacker can achieve...

8.8CVSS6AI score0.00664EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/24 7:15 p.m.20 views

Cross-site Scripting (XSS)

Overview Jellyfin.Common is an a Free Software Media System that puts you in control of managing and streaming your media. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the AuthenticateByName process. An attacker can execute arbitrary JavaScript in the context o...

6.9CVSS5.9AI score0.00334EPSS
SaveExploits0References2
Total number of security vulnerabilities5000