Improper Authentication

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Improper Authentication via the UI/CLI session token encryption context in encryptvaluehelper now encryptbearertoken within litellm/proxy/commonutils/encryptdecryptutils.py...

Missing Release of Memory after Effective Lifetime

Overview msgpack is an efficient binary serialization format. Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime via a use-after-free condition in the unpackb function and the Unpacker streaming class in msgpack/unpacker.pyx. The fix reveals tha...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via dns.name.fromwireparser in dns/name.py, where a DNS message containing a long chain of compression pointers causes excessive CPU consumption during name decompression. An attacker can send a malicious DNS...

Deserialization of Untrusted Data

Overview pylint is a Python static code analysis tool which looks for programming errors, helps enforcing a coding standard, sniffs for code smells and offers simple refactoring suggestions. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via loadresults in...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the opjj2kreadsod function in the bundled OpenJPEG library when processing a malicious JPEG 2000 image. The function writes to tpindex without first verifying that the pointer is non-null and that lcurrenttilepar...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via case-sensitive matching of server-side route rules, where route rule protections such as redirect, headers, and proxy rules can be bypassed by an attacker who sends a request path with differing letter case...

Incorrect Authorization

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Incorrect Authorization via case-sensitive matching of server-side route rules, where route rule protections such as redirect, headers, and proxy rules can be bypassed by an...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via a late busboy error event emitted after teardown in lib/make-middleware.js. When an asynchronous fileFilter is in use, a single request can trigger an unhandled error event on the busboy instance after the request...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception via the read function in lib/read.js when processing a compressed request body that contains trailing bytes. An attacker can send a compressed body with trailing data, causing the decompression stream to emit an error...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the server island head rendering pipeline in packages/nitro-server/src/runtime/handlers/island.ts, where head entries are serialized without applying the useHeadSafe allowlist. An attacker who can influence...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the NuxtLink component's anchor href resolution, where an attacker can supply a URL that bypasses protocol sanitization and redirects users to an arbitrary external destination. The previous...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via route rule matching in normalizeRouteRulePath, where route rules are compared against request paths without first percent-decoding either the rule key or the lookup path. An attacker can bypass route-level...

Cross-site Request Forgery (CSRF)

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the OpenURLFromTab handler, which fails to route modifier-click and middle-click link...

Origin Validation Error

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error via misattribution of pointerLock permission requests from in-process iframes. When a same-site,...

Missing Authorization

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Missing Authorization in TabsQueryFunction::Run in shell/browser/extensions/api/tabs/tabsapi.cc, where the tabs.query API...

Out-of-bounds Read

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/framesubscriber.cc, when processing a captured vid...

Out-of-bounds Read

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Out-of-bounds Read via the OnFrameCaptured function in shell/browser/api/framesubscriber.cc, where a captured video frame's...

Origin Validation Error

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Origin Validation Error via incorrect attribution of the requesting origin in HandleExternalProtocolInUI when handling...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution via ambiguous path-key encoding in lib/compiler.js, where the compiler tracked table origins using string-rendered path sets rather than per-object tags. Because quoteDottedString quotes a segment only when it contai...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the compiler in lib/compiler.js, where processing an array-of-tables header causes a full rescan of every path defined so far. An attacker can supply a TOML document with a large number of...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the TOML compiler in lib/compiler.js, where path strings were maintained using three string-keyed Sets. Every key segment re-joined its entire prefix on each assignment, and every array-of-tables...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the integer parsing logic in lib/parser.js and src/toml.pegjs, where BigInt conversion of oversized integer literals exhibits super-linear CPU growth relative to digit count. An...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the prerenderElementChildren function in jsx.ts and the streaming renderer in streaming.ts, where dynami...

Cross-site Scripting (XSS)

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the addAnimationProperty function in packages/astro/src/runtime/server/transition.ts, where transition...

Allocation of Resources Without Limits or Throttling

Overview graphql-core is a GraphQL implementation for Python, a port of GraphQL.js, the JavaScript reference implementation for GraphQL. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the advancelexer function in...

Inefficient Algorithmic Complexity

Overview graphql-core is a GraphQL implementation for Python, a port of GraphQL.js, the JavaScript reference implementation for GraphQL. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the OverlappingFieldsCanBeMergedRule validation rule in...

Unsafe Dependency Resolution

Overview Affected versions of this package are vulnerable to Unsafe Dependency Resolution via insufficient validation of the required-version field in action/main.py. When the required-version key in pyproject.toml is set to a value that resembles a direct reference e.g., a VCS URL or a local pat...

Insufficient Session Expiration

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Insufficient Session Expiration via TokenProxy.delete and the proxy queryset's delete method in restframework/authtoken/models.py. Because TokenProxy maps pk ...

Inefficient Algorithmic Complexity

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via unbounded parsing of the Accept and Content-Type headers in content negotiation. An attacker can send a request with an...

Allocation of Resources Without Limits or Throttling

Overview djangorestframework is a powerful and flexible toolkit for building Web APIs. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via JSONParser and FormParser/MultiPartParser in restframework/parsers.py, which passes the client-suppli...

Access Control Bypass

Overview @sentry/nextjs is an Official Sentry SDK for Next.js Affected versions of this package are vulnerable to Access Control Bypass via the isPathnameUnderSentryTunnelRoute function in wrapMiddlewareWithSentry.ts when the tunnel route feature is enabled. The middleware wrapper incorrectly...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the fromjwk function in jwt/algorithms.py, which accepts an HMAC JWK containing an empty key "k": "" without raising an error. An attacker who can supply a JWK with an empty k value c...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the gateway handlers, where gateway-specific kernel and kernelspec endpoints are registered separately from the standard server handlers. An authenticated low-privileged user can send requests to gateway-proxied...

Malicious Package

Overview aanthropic is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview 1h1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Origin Validation Error

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Origin Validation Error via the WebSocket upgrade handler in lib/Server.js when a devServer.proxy entr...

Information Exposure

Overview webpack-dev-server is an Uses webpack with a development server that provides live reloading. It should be used for development only. Affected versions of this package are vulnerable to Information Exposure via the isValidHost method in lib/Server.js, where Host and :authority headers ar...

Malicious Package

Overview net-codec-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview log-rotate-testmetest is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview simplewave is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview formatting-subtitles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @conduitops/logview-archive is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview laravel/framework is a PHP framework for web artisans. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsafe Reflection' via the ResolvesJsonApiElements trait in JSON:API resource loading, where an attacker with read-only...

Function Call With Incorrect Argument Type

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Function Call With Incorrect Argument Type via insufficient validation of TIFF tag values before passing them to TIFFSetField in the libtiff encoder. When saving a TIFF image, tag values...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via the Arrow array export functions exportsinglechannelarray and exportfixedpixelarray in src/libImaging/Arrow.c when exporting non-contiguous images. When image rows are not stored contiguously in memory ...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via missing decompression bomb checks in the seek methods of DcxImagePlugin, MicImagePlugin, and MpoImagePlugin. When a...

Allocation of Resources Without Limits or Throttling

Overview Pillow is a PIL Python Imaging Library fork. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via linearizepagetree in src/PIL/PdfParser.py when parsing a PDF file containing a cyclic or duplicate page tree reference. An attacker ca...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the seek method in src/PIL/SpiderImagePlugin.py, which lacks a decompression bomb check after seeking to a new frame in a SPIDER format image. An attacker can supply a...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write via the JPEG COM marker encoding path in JpegEncode.c, when a JPEG image carrying an oversized comment in its im.info metadata is re-encoded. The comment length is not validated before being written as a COM marker,...

Unchecked Input for Loop Condition

Overview Affected versions of this package are vulnerable to Unchecked Input for Loop Condition via the load method in src/PIL/Image.py, where a loop consuming repeated Exif\x00\x00 headers in Exif data has no upper bound on iterations. An attacker can supply image data with an arbitrarily long...