Lucene search
+L
SnykMost viewed

42436 matches found

Snyk
Snyk
added 2026/07/20 3:59 p.m.16 views

Malicious Package

Overview OCI.DotNetSDK.Ai.speech is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/20 12:19 a.m.16 views

Malicious Package

Overview @vite-js/ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/19 7:51 a.m.16 views

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the views.py process of the Dashboard Module. An attacker can gain unauthorized access to restricted dashboard functionalities by sending crafted requests to endpoints without proper...

6.5CVSS6.5AI score0.0022EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zzfadgivar01 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zwcalx12 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zzpdfvar06 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zwkact8 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zzfadgivar11 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zwkopt3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zwsearch is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/17 1:33 a.m.16 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the exec approvals. An attacker can gain unauthorized access to restricted actions by sending requests from a non-allowlisted sender when the feature is enabled...

8.8CVSS5.4AI score0.00246EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/16 4:36 p.m.16 views

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the LanguageInformation handling in Kiota.Builder.Models.LanguageInformation and GenerationConfiguration when it reads x-ms-kiota-info clientClassName and clientNamespaceName values. An attacker can overwrite...

9.8CVSS6.4AI score0.01355EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/16 1:29 a.m.16 views

Malicious Package

Overview nyt-cms is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 10:00 p.m.16 views

Information Exposure

Overview cyberdrop-dl-patched is a Bulk downloader for multiple file hosts Affected versions of this package are vulnerable to Information Exposure via the Authorization header when processing URLs. An attacker can obtain sensitive API keys by submitting malicious URLs that are incorrectly matche...

6.9CVSS5.3AI score
SaveExploits0References3
Snyk
Snyk
added 2026/07/15 5:50 p.m.16 views

Malicious Package

Overview fflask is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 4:12 p.m.16 views

Malicious Package

Overview datefmt-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:37 p.m.16 views

Improper Privilege Management

Overview phpmyfaq/phpmyfaq is a FAQ system for PHP and MySQL, PostgreSQL and other databases Affected versions of this package are vulnerable to Improper Privilege Management in the user/add endpoint. An attacker can gain unauthorized administrative privileges by sending a POST request with the...

8.8CVSS5.6AI score0.00246EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:36 p.m.16 views

Arbitrary Code Injection

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

8.5CVSS6.1AI score0.00144EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:36 p.m.16 views

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-OpenMP-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package...

7.5CVSS5.9AI score0.00187EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/15 2:36 p.m.16 views

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

4.8CVSS5.4AI score0.00111EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 11:41 p.m.16 views

Malicious Package

Overview nativescript-swisspost-pcc-creative-editor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/14 6:43 a.m.16 views

Directory Traversal

Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Directory Traversal in the filtersafetarinfos process. An attacker can create symlink entries in a crafted tar archive that bypass directory validation by exploiting...

6.5CVSS6.5AI score0.00238EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/13 4:51 p.m.16 views

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass in the demographics questionnaire admin editor interface due to missing authorization checks on the /admin/demographics/questions route. An attacker can gain unauthorized access to administrative question-managemen...

5.4CVSS6.1AI score0.00171EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/12 2:31 p.m.16 views

Server-side Request Forgery (SSRF)

Overview AstrBot is a 易上手的多平台 LLM 聊天机器人及开发框架 Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ToolsRoute.testmcpconnection function. An attacker can make unauthorized requests to internal or external systems by supplying crafted input to the...

6.5CVSS6.1AI score0.00206EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/11 2:34 p.m.16 views

Use After Free

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

7.5CVSS5.9AI score0.00323EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 10:28 p.m.16 views

XML Injection

Overview @logto/connector-saml is a SAML standard connector implementation. Affected versions of this package are vulnerable to XML Injection via the SAML assertion process. An attacker can inject arbitrary XML markup into signed SAML assertions by supplying crafted profile attributes, potentiall...

8.5CVSS6.2AI score0.00298EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 9:43 p.m.16 views

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the ReverseProxy.Rewrite process when the internal authentication token is forwarded to backend services via the x-tsdproxy-auth-token header. An attacker can gain unauthorized management API access and escala...

9.2CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 8:32 p.m.16 views

Incorrect Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Authorization in the BulkUsersController::destroy process. An attacker can gain unauthorized ability to soft-delete other non-admin users by sending a direct POST...

7.1CVSS6.1AI score0.00285EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/10 6:30 p.m.16 views

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation in the SSLClient and Client processes in HTTPS mode when connecting to an IP-literal host with server certificate verification enabled. An attacker can intercept and manipulate encrypted traffic by...

9.1CVSS6.1AI score0.00164EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 4:37 p.m.16 views

Incorrect Authorization

Overview FlaskBB is an A classic Forum Software in Python using Flask. Affected versions of this package are vulnerable to Incorrect Authorization via manipulation of the topicid parameter in batch requests. An attacker can perform unauthorized actions such as locking, unlocking, deleting, or...

8.1CVSS6.1AI score0.00284EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 4:35 p.m.16 views

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition through the image process in open-sse/translator/concerns/image.js. An attacker can access internal-only HTTP services by...

7.4CVSS6.1AI score0.00154EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 4:35 p.m.16 views

Directory Traversal

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...

6.8CVSS6.5AI score0.00259EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/10 4:05 p.m.16 views

Improper Authorization

Overview tarteaucitronjs is a package that provides compliance to the European cookie law. Affected versions of this package are vulnerable to Improper Authorization via the purgeBtn process. An attacker can cause unintended deletion of arbitrary cookies by tricking a user into clicking a crafted...

5.3CVSS6.2AI score0.002EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/09 9:00 p.m.16 views

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the query or queries filters in public API endpoints. An attacker can access sensitive database information by injecting crafted SQL expressions into numeric filter parameters, allowing them to infer data based on the...

8.7CVSS6.1AI score0.00047EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 9:00 p.m.16 views

Embedded Malicious Code

Overview @injectivelabs/sdk-ts is a SDK in TypeScript for building Injective applications in a browser, node, and react native environment. Affected versions of this package are vulnerable to Embedded Malicious Code. The compromised version of this package contains a malicious trackKeyDerivation...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 4:39 p.m.16 views

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the evaluations test run creation endpoint POST /workflows/workflowId/test-runs/new, which authorizes against the workflow:read scope instead of workflow:execute. A user...

7.4CVSS6.1AI score0.00161EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/08 4:38 p.m.16 views

Incorrect Authorization

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Incorrect Authorization in the evaluation test runs controller, where three state-changing endpoints authorize actions against the workflow:read permission instead of the action-appropriate...

5.4CVSS6.1AI score0.00176EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 8:57 p.m.16 views

Missing Authorization

Overview @better-auth/scim is a SCIM plugin for Better Auth Affected versions of this package are vulnerable to Missing Authorization in the management of non-organization SCIM providers when owner binding is not enforced. An attacker can gain unauthorized access to another user's provider,...

7.7CVSS5.9AI score
SaveExploits0References3
Snyk
Snyk
added 2026/07/07 4:40 p.m.16 views

Use of Cache Containing Sensitive Information

Overview Django is a high-level Python Web framework that encourages rapid development and clean, pragmatic design. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information in the UpdateCacheMiddleware and cachepage process when responses that vary on...

5.3CVSS6AI score0.00361EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 4:07 p.m.16 views

Malicious Package

Overview polytrade is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 2:48 p.m.16 views

Malicious Package

Overview @sqlite-list/schema-generator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 2:48 p.m.16 views

Malicious Package

Overview @sqlite-access/nodesql is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/07 1:59 p.m.16 views

Malicious Package

Overview mcp-server-pg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 9:37 p.m.16 views

Incorrect Authorization

Overview 9router is a 9Router CLI - Start and manage 9Router server Affected versions of this package are vulnerable to Incorrect Authorization via the /api/settings/database endpoint, which allows exporting the entire database including plaintext API keys, OAuth tokens, and sensitive settings, a...

9.9CVSS6AI score0.00387EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 9:00 p.m.16 views

Malicious Package

Overview paysafe-kyc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 8:42 p.m.16 views

Arbitrary Code Injection

Overview langroid is a Harness LLMs with Multi-Agent Programming Affected versions of this package are vulnerable to Arbitrary Code Injection in the eval process used by certain agent components when evaluating external input with fulleval=True. An attacker can execute arbitrary system commands b...

10CVSS6.2AI score0.00638EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:57 p.m.16 views

Malicious Package

Overview react-svg-render is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/06 6:57 p.m.16 views

Malicious Package

Overview react-native-template-my-starter is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 9:17 a.m.16 views

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection via the PatternParser process. An attacker can access sensitive files or interact with internal systems by submitting crafted XML data that triggers external entity resolution. Details XXE Injection is ...

9.8CVSS6AI score0.00348EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/03 8:18 a.m.16 views

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the CURLMOPTSOCKETFUNCTION callback when curleasypause is called. An attacker can execute arbitrary code or cause a denial of service by triggering the use of a dangling pointer after memory has been freed. Remediation...

8.8CVSS6.2AI score0.00295EPSS
SaveExploits1References2
Total number of security vulnerabilities5000