Origin Validation Error

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Origin Validation Error via DNSDatagramProtocol.datagramReceived in src/twisted/names/dns.py, where DNS responses are accepted solely on the basis o...

Use of Incorrectly-Resolved Name or Reference

Overview langgraph-checkpoint-sqlite is a Library with a SQLite implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the groupops function in the Postgres and SQLite store backends, due to namespaces...

Use of Incorrectly-Resolved Name or Reference

Overview langgraph-checkpoint-postgres is a Library with a Postgres implementation of LangGraph checkpoint saver. Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the groupops function in the Postgres and SQLite store backends, due to namespace...

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Use of Externally-Controlled Input to Select Classes or Code 'Unsa...

Insertion of Sensitive Information into Log File

Overview langgraph-cli is a CLI for interacting with LangGraph API Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the --image-uri flag in langgraph deploy, where the CLI pushes a built Docker image to a caller-supplied registry URI using...

Arbitrary Code Injection

Overview org.webjars.npm:happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler...

Arbitrary Code Injection

Overview happy-dom is a Happy DOM is a JavaScript implementation of a web browser without its graphical user interface. It includes many web standards from WHATWG DOM and HTML. Affected versions of this package are vulnerable to Arbitrary Code Injection via the ESM compiler...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via SQLite side-file handling in readwrite.py on Windows, where a local attacker can plant adversarial -wal or -journal side files adjacent to the lock database in a shared directory such ...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking via SoftFileLock.acquire on Windows, where a os.open call used to read a soft-lock marker file blocks indefinitely when another handle holds a Level 1 or batch oplock on that file and never acknowledges the break reques...

Origin Validation Error

Overview @azure/msal-node is a Microsoft Authentication Library for Node Affected versions of this package are vulnerable to Origin Validation Error via the acquireTokenByCode method in ConfidentialClientApplication, which fails to sanitize the caller-supplied authCodePayload before use. An...

Cross-site Scripting (XSS)

Overview org.webjars.npm:serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via escapeFunctionBody in index.js, which escapes each function bo...

Cross-site Scripting (XSS)

Overview serialize-javascript is a package to serialize JavaScript to a superset of JSON that includes regular expressions and functions. Affected versions of this package are vulnerable to Cross-site Scripting XSS via escapeFunctionBody in index.js, which escapes each function body in isolation...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts when processing email header values containing nested comments. RFC 5322 §3.2.2...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts, where the tokenizer tracks only a single open operator and does no...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser in src/addressparser/index.ts, where the tokenizer tracks only a single open operator and does not account for...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser src/addressparser/index.ts when processing angle-addr and group constructs. The tokenizer tracks...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via the address parser src/addressparser/index.ts when processing angle-addr and group constructs. The tokenizer tracks only a single op...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via fixnamespacepackages in setuptools/wheel.py during legacy wheel installation. Entries in a wheel's namespacepackages.txt are split on . and passed directly to os.path.join, which interprets its arguments as...

Insufficiently Protected Credentials

Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization serv...

Insufficiently Protected Credentials

Overview fastmcp-slim is a The dependency-slim FastMCP package. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization server advertised b...

Denial of Service (DoS)

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Denial of Service DoS via repeated full file loads triggered by malformed PDF input. When getobject in pypdf/reader.py encounters ...

Denial of Service (DoS)

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Denial of Service DoS via repeated full file reads triggered by malformed PDF input. When getobject in pypdf/reader.py encounters ...

Excessive Iteration

Overview pypdf is an A pure-python PDF library capable of splitting, merging, cropping, and transforming PDF files Affected versions of this package are vulnerable to Excessive Iteration via readstandardxreftable in pypdf/reader.py, where a PDF file containing a cross-reference xref table with a...

Improper Check for Certificate Revocation

Overview org.webjars.npm:electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, whic...

Improper Check for Certificate Revocation

Overview electron is a framework which lets you write cross-platform desktop applications using JavaScript, HTML and CSS. Affected versions of this package are vulnerable to Improper Check for Certificate Revocation via the Node.js TLS stack in the main and utility processes, which lacked an...

Missing Release of Resource after Effective Lifetime

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the Proxy middleware. An attacker can exhaust system resources by repeatedly establishing WebSocket...

Missing Release of Resource after Effective Lifetime

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime via the Proxy middleware. An attacker can exhaust system resources by repeatedly establishing WebSocket...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...

Improper Handling of Highly Compressed Data (Data Amplification)

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Improper Handling of Highly Compressed Data Data Amplification via the Decompress middleware. An attacker can exhaust memory or CPU resources by sending a small,...

Incorrect Authorization

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

Incorrect Authorization

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Incorrect Authorization in the Proxy process. An attacker can gain unauthorized access to protected resources by sending a WebSocket upgrade request that is reject...

Allocation of Resources Without Limits or Throttling

Overview github.com/labstack/echo/v4/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by...

Allocation of Resources Without Limits or Throttling

Overview github.com/labstack/echo/v5/middleware is a middleware package for echo. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the BodyDump middleware. An attacker can exhaust process memory and disrupt service availability by...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via insufficient escaping of the virtual environment prompt string in activate.sh when constructing PS1. When a virtualenv is created with a prompt value containing shell metacharacters such as $ or backticks, the...

Infinite loop

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Infinite loop via parseNestedParens in twisted/mail/imap4.py when processing an IMAP SEARCH command containing a literal with a negative octet count...

Allocation of Resources Without Limits or Throttling

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via IRC.dataReceived in twisted.words.protocols.irc, which appends incoming data to an internal...

Allocation of Resources Without Limits or Throttling

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via twisted.conch.telnet.Telnet.dataReceived when processing a telnet subnegotiation that is...

Allocation of Resources Without Limits or Throttling

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the XML element stream parsers SuxElementStream and ExpatElementStream in...

HTTP Request Smuggling

Overview Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Request Smuggling via the headerReceived function in src/twisted/web/http.py, which fails to reject bare CR \r and LF \n characters in HTTP...

Malicious Package

Overview sitecard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview sedgehaul is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview reedworker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview larchworker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview workslip is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview juniperrun is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview runpier is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview loadferry is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview marshrunner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview flintqueue is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...