Regular Expression Denial of Service (ReDoS)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the Address6 constructor in src/ipv6.ts, where the REZONESTRING regular expression /%.$/ is applie...

Malicious Package

Overview novalithtts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview driftwavets is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview glassbeakasr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tonemaptts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview quasitonnts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview emberlytts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview leakdeep is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview voltswannts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview ukraine69 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview pyrechoasr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Denial of Service (DoS)

Overview Affected versions of this package are vulnerable to Denial of Service DoS due to delayed enforcement of maximum property name length in the ReaderBasedJsonParser process. An attacker can exhaust system memory and cause a crash by submitting a JSON object with an excessively long property...

Denial of Service (DoS)

Overview com.fasterxml.jackson.core:jackson-core is a Core Jackson abstractions, basic JSON streaming API implementation Affected versions of this package are vulnerable to Denial of Service DoS due to delayed enforcement of maximum property name length in the ReaderBasedJsonParser process. An...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the ValidateResponse process when a response header is declared with content instead of schema. An attacker can cause a process crash by sending a request to an affected endpoint, resulting in a nil...

Out-of-bounds Read

Overview github.com/gomarkdown/markdown/parser is a library for parsing Markdown text and rendering as HTML. Affected versions of this package are vulnerable to Out-of-bounds Read through the IsSafeURL function. An attacker can cause a panic and crash the application by supplying a specially...

Key Exchange without Entity Authentication

Overview apache-airflow-providers-ssh is a Provider package apache-airflow-providers-ssh for Apache Airflow Affected versions of this package are vulnerable to Key Exchange without Entity Authentication via the nohostkeycheck default in SSHHook, SSHHookAsync, and SFTPHookAsync, which defaulted to...

Key Exchange without Entity Authentication

Overview apache-airflow-providers-sftp is a Provider package apache-airflow-providers-sftp for Apache Airflow Affected versions of this package are vulnerable to Key Exchange without Entity Authentication via the nohostkeycheck default in SSHHook, SSHHookAsync, and SFTPHookAsync, which defaulted ...

Key Exchange without Entity Authentication

Overview apache-airflow-providers-sftp is a Provider package apache-airflow-providers-sftp for Apache Airflow Affected versions of this package are vulnerable to Key Exchange without Entity Authentication via the deferrable code paths SFTPTrigger, SFTPHookAsync, and SFTPClientPool, which disable...

Insufficient Session Expiration

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Insufficient Session Expiration via KeycloakJWTMiddleware.dispatch in middleware.py, where the middleware unconditionally issue...

Incorrect Permission Assignment for Critical Resource

Overview apache-airflow-providers-keycloak is a Provider package apache-airflow-providers-keycloak for Apache Airflow Affected versions of this package are vulnerable to Incorrect Permission Assignment for Critical Resource via the isauthorizedview method in the Keycloak auth manager, which check...

Improper Certificate Validation

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Certificate Validation via the Agent constructor in lib/dispatcher/agent.js, where TLS options passed as the tls parameter are silently dropped and never stored ...

Origin Validation Error

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Origin Validation Error via cross-origin redirect handling in CacheHandler.onResponseStart, where a redirect to a different origin can cause the final response to be stor...

Improper Handling of Case Sensitivity

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity via the fetch implementation's Subresource Integrity SRI verification logic, which matches the algorithm token against a...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via unhandled ERRTLSCERTALTNAMEINVALID errors in onHttpSocketError, onHttp2SessionError, and onHttp2SocketError. When a TLS connection is established a...

Allocation of Resources Without Limits or Throttling

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unbounded automatic PONG write queuing in the WebSocket ByteParser receiver. A remote attacker can send a flood o...

Uncaught Exception

Overview undici is an An HTTP/1.1 client, written from scratch for Node.js Affected versions of this package are vulnerable to Uncaught Exception via the DecompressHandler in lib/interceptor/decompress.js, where an uncaught exception thrown by a downstream handler during onResponseData or...

Directory Traversal

Overview kedro-datasets is a Kedro-Datasets is where you can find all of Kedro's data connectors. Affected versions of this package are vulnerable to Directory Traversal via PartitionedDataset, where partition IDs are concatenated directly with the dataset base path without validation. An attacke...

Prototype Pollution

Overview @casl/ability is a CASL is an isomorphic authorization JavaScript library which restricts what resources a given user is allowed to access Affected versions of this package are vulnerable to Prototype Pollution via the rulesToFields function and setByPath utility, which fail to restrict...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the JobUserController process. An attacker can perform unauthorized actions on user accounts by tricking a victim into submitting malicious requests to the endpoints /user/insert, /user/update, or...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation via verifygeneraljson in src/joserfc/rfc7515/json.py, where an attacker can submit a General JSON Serialization JWS object with an empty signatures array to bypass signature verification entirely. Because the function...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of server function transport responses, where the spread of the full opts object into the server function context in createServerFn.ts allows attacker-controlled properties such as method t...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of server function transport responses, where the spread of the full opts object into the server function context in createServerFn.ts allows attacker-controlled properties such as method t...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of server function transport responses, where the spread of the full opts object into the server function context in createServerFn.ts allows attacker-controlled properties such as method t...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via improper handling of server function transport responses, where the spread of the full opts object into the server function context in createServerFn.ts allows attacker-controlled properties such as method t...

Unsafe Dependency Resolution

Overview @anthropic-ai/claude-code is an Use Claude, Anthropic's AI assistant, right from your terminal. Claude can understand your codebase, edit files, run terminal commands, and handle entire workflows for you. Affected versions of this package are vulnerable to Unsafe Dependency Resolution vi...

Improper Authorization

Overview @backstage/backend-defaults is a Backend defaults used by Backstage backend apps Affected versions of this package are vulnerable to Improper Authorization via the actions registry endpoint /.backstage/actions/v1/actions in DefaultActionsRegistryService, where the isActionAllowed filter...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference due to improper handling of array schemas that omit the items keyword in request validation. An attacker can cause the application to panic and potentially crash by submitting crafted requests that trigger...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the visitJSON and decodeValue functions when processing schemas with circular references in allOf, anyOf, or oneOf combinators. An attacker can cause a fatal process crash by submitting a crafted OpenAPI...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion through the visitJSON and decodeValue functions when processing schemas with circular references in allOf, anyOf, or oneOf combinators. An attacker can cause a fatal process crash by submitting a crafted OpenAPI...

Interpretation Conflict

Overview Affected versions of this package are vulnerable to Interpretation Conflict through the ValidationHandler.Middleware process when used with a downstream router that interprets encoded paths, such as gorilla/mux with UseEncodedPath. An attacker can access protected operations without...

Symlink Attack

Overview @appium/support is a Support libs used across Appium packages Affected versions of this package are vulnerable to Symlink Attack via the ZIP extraction logic in zip.ts when processing archive entries that contain symlinks pointing outside the destination directory. An attacker who suppli...

Excessive Platform Resource Consumption within a Loop

Overview Affected versions of this package are vulnerable to Excessive Platform Resource Consumption within a Loop through repeated compilation of a loop-invariant regular expression inside the DecodeObject process. An attacker can exhaust CPU resources and degrade or deny service to legitimate...

Infinite loop

Overview tinytag is a Read audio file metadata Affected versions of this package are vulnerable to Infinite loop via the traverseatoms method in tinytag.py when parsing a malformed MP4 file. An attacker can supply an MP4 file containing an atom with an invalid or zero size value, causing the pars...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference through the resolveComponent process in the OpenAPI specification loader when handling a self-referential $ref in additionalProperties without proper nil-checks. An attacker can cause the application to crash by...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the ValidationHandler process. An attacker can cause the application to panic and disrupt service availability by sending HTTP requests with non-canonical or unsupported HTTP method tokens to any existing static...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the openapi3filter process when handling OpenAPI 3.1 schemas that declare an array type without specifying items. An attacker can cause the application to crash by sending a crafted HTTP request with a...

Missing Release of Resource after Effective Lifetime

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via StreamableHTTPSessionManager in streamablehttpmanager.py, which prior to this fix neither expired idle stateful sessions nor capped the number ...

Infinite loop

Overview com.github.junrar:junrar is a rar decompression library in plain java. Affected versions of this package are vulnerable to Infinite loop through the RarVM.ExecuteCode process. An attacker can cause the extraction thread to enter an infinite loop and exhaust CPU resources by providing a...