Malicious Package

Overview rainbokit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview permcarmserver is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @akunsansan0/pucuk12 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @akunsansan0/batu1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via the request.params:subjectid parameter when no authenticateproc is configured. An attacker can gain unauthorized access and impersonate other users by supplying arbitrary subject IDs in the request parameters. Thi...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Missing Release of Memory after Effective Lifetime

Overview Magick.NET-Q8-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Missing Release of Memory after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime in the magick when invalid command-line options are provided. An attacker can cause memory exhaustion by repeatedly supplying malformed command-line arguments. Remediation A fix was...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the aggregation of incoming WebSocket message fragments without any limit on total size or fragment count. An attacker can exhaust server memory and cause a denial of service ...

HTTP Request Smuggling

Overview Affected versions of this package are vulnerable to HTTP Request Smuggling in the process that merges HTTP/1.1 chunked-body trailer fields into Request.headers. An attacker can inject arbitrary HTTP headers by sending specially crafted trailer fields, potentially bypassing header-based...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the vfquirc filter. An attacker can corrupt heap memory and potentially execute arbitrary code by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions, where the second presentation has large...

Cross-site Request Forgery (CSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the confirmChatLinkSession process. An attacker can gain unauthorized access to another user's permissions and perform actions as that user by inducing th...

Incorrect Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization due to improper authorization checks in the url endpoint for S3 attachments. An attacker can gain unauthorized access to generate S3 PutObject presigned URLs by sending...

Cross-site Scripting (XSS)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Cross-site Scripting XSS in the Pyodide code execution process. An attacker can execute arbitrary server-side code and perform authenticated actions as another user by storing a malicious payload in a shared...

Incorrect Calculation

Overview @aws-cdk/aws-codebuild is a The CDK Construct Library for AWS::CodeBuild Affected versions of this package are vulnerable to Incorrect Calculation due to the incorrect mapping of the S3LoggingOptions.encrypted property to the CloudFormation S3LogsConfig.EncryptionDisabled field. An...

Incorrect Calculation

Overview aws-cdk-lib is a Version 2 of the AWS Cloud Development Kit library Affected versions of this package are vulnerable to Incorrect Calculation due to the incorrect mapping of the S3LoggingOptions.encrypted property to the CloudFormation S3LogsConfig.EncryptionDisabled field. An attacker c...

Integer Overflow or Wraparound

Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Integer Overflow or Wraparound

Overview Magick.NET-Q16-AnyCPU is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Integer Overflow or Wraparound

Overview Magick.NET-Q8-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Directory Traversal

Overview pymdown-extensions is an Extension pack for Python Markdown. Affected versions of this package are vulnerable to Directory Traversal via the replpath function in the b64 extension when processing attacker-controlled paths. An attacker can disclose the contents of files outside the intend...

Malicious Package

Overview yuinpm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Out-of-bounds Read

Overview apple/swift-nio-ssl is a TLS Support for SwiftNIO, based on BoringSSL. Affected versions of this package are vulnerable to Out-of-bounds Read due to improper handling of the NIOSSLCertificate.subjectAlternativeNames process. An attacker can cause out-of-bounds memory access by accessing...

Malicious Package

Overview vue-demi-fix is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @bcryptln/bcryptjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS via the imagecreatefrombmp process. An attacker can cause excessive memory and CPU consumption by submitting a specially crafted BMP image with large declared dimensions embedded as a data URI in HTML. This can lea...

HTTP Request Smuggling

Overview io.netty:netty-codec-http is a network application framework for rapid development of maintainable high performance protocol servers & clients. Affected versions of this package are vulnerable to HTTP Request Smuggling in the WebSocket handshake. An attacker can bypass expected header...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through modRMRequired and decode in arch/X86/X86DisassemblerDecoder.c. An attacker can crash any application using a reduced X86 Capstone build by supplying crafted x86/x86-64 input containing a 3DNow! opcode...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the libheif/region.cc process. An attacker can trigger out-of-bounds memory access by crafting a HEIF file with large width and height values that cause an integer overflow during buffer allocation...

Integer Overflow

Overview Affected versions of this package are vulnerable to Integer Overflow in the bundled libvips GIF loader VipsForeignLoadNsgif, which can miscompute image dimensions on 32-bit systems. An attacker can crash the process by supplying a GIF whose dimensions overflow the size calculation...

Malicious Package

Overview adanbu is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview upllib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Incorrect Implementation of Authentication Algorithm

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm via the webhook token validation process. An attacker can execute arbitrary scheduled job...

Incorrect Regular Expression

Overview @astrojs/netlify is a Deploy your site to Netlify Affected versions of this package are vulnerable to Incorrect Regular Expression in the remotePatternToRegex process. An attacker can access unintended image URLs on the allowed host by crafting requests that exploit unescaped regex...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution in the Basic authentication header construction in lib/adapters/http.js and lib/helpers/resolveConfig.js, which read the username and...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview net.sf.mpxj:mpxj is a Library that provides facilities to allow project information to be manipulated in Java and .Net. Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

Malicious Package

Overview zwtd103 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zwta6000 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zzfadgivar05 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview phabricator-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the media upload. An attacker can access unauthorized network resources by submitting crafted input paths that are processed by the upload feature. Th...

Allocation of Resources Without Limits or Throttling

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the configured input path. An attacker can exhaust gateway worker resources and reduce availability by supplying specially crafted...

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the exec approvals. An attacker can gain unauthorized access to restricted actions by sending requests from a non-allowlisted sender when the feature is enabled...

Arbitrary Code Injection

Overview Affected versions of this package are vulnerable to Arbitrary Code Injection via CodeMethodWriter in CodeMethodWriter.cs and RubyConventionService in RubyConventionService.cs. An attacker can inject arbitrary Ruby code into generated client classes by supplying an OpenAPI specification...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal through PluginsGenerationService in the plugin manifest generation code. An attacker can make the generated Copilot or Teams plugin manifest reference files outside the plugin package by supplying an OpenAPI...

Information Exposure

Overview cyberdrop-dl-patched is a Bulk downloader for multiple file hosts Affected versions of this package are vulnerable to Information Exposure via the Authorization header when processing URLs. An attacker can obtain sensitive API keys by submitting malicious URLs that are incorrectly matche...

Incorrect Permission Assignment for Critical Resource

Overview garminconnect is a Python 3 API wrapper for Garmin Connect Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource due to insecure file-system permissions being set on the OAuth token store by the dump function. An attacker can gain...

Arbitrary Code Injection

Overview PraisonAI is a PraisonAI is an AI Agents Framework with Self Reflection. PraisonAI application combines PraisonAI Agents, AutoGen, and CrewAI into a low-code solution for building and managing multi-agent LLM systems, focusing on simplicity, customisation, and efficient human-agent...