Lucene search
+L

42436 matches found

Snyk
Snyk
added 2026/07/19 12:27 a.m.12 views

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

8.7CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/19 12:27 a.m.10 views

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

8.7CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/19 12:27 a.m.12 views

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

8.7CVSS5.8AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.14 views

Malicious Package

Overview gitcredentialmanager is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid using all malicious...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.13 views

Malicious Package

Overview fastlane-plugin-runtestsfirebasetestlab is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.13 views

Malicious Package

Overview @vite-mcp/vite-type is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.11 views

Malicious Package

Overview @vite-ts/vite-ui is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.10 views

Malicious Package

Overview @vitets/vite-ts is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.10 views

Malicious Package

Overview @uw010010/vite-tree is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.14 views

Malicious Package

Overview @vite-tab/tab is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal credentia...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.11 views

Malicious Package

Overview @vite-pro/vite-ui is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

9.8CVSS6.1AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 9:00 p.m.12 views

Malicious Package

Overview Dendreo is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid using all malicious instances of...

9.8CVSS5.5AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 5:52 p.m.10 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CheckSSRF function in webshared.go of the webfetch component. An attacker can access internal network resources and potentially exfiltrate sensitive information or manipulate internal services by...

6.5CVSS6.4AI score0.0033EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 5:52 p.m.8 views

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CheckSSRF function in webshared.go of the webfetch component. An attacker can access internal network resources and potentially exfiltrate sensitive information or manipulate internal services by...

6.5CVSS6.4AI score0.0033EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 5:50 p.m.14 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

6.5CVSS6.4AI score0.00209EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 5:50 p.m.9 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

6.5CVSS6.4AI score0.00209EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 5:50 p.m.7 views

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

6.5CVSS6.4AI score0.00209EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 3:53 p.m.21 views

Directory Traversal

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal via the WebSocket routing. An attacker can access unintended upstream endpoints by sending crafted WebSocket upgrade requests containing path traversal...

10CVSS7.7AI score0.01614EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 3:53 p.m.8 views

Arbitrary Code Injection

Overview uproot is a ROOT I/O in pure Python and NumPy. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TStreamerInfo metadata processing. An attacker can execute arbitrary Python code by supplying a crafted ROOT file containing malicious streamer metadata...

8.5CVSS6AI score0.00153EPSS
SaveExploits1References2
Snyk
Snyk
added 2026/07/18 3:52 p.m.8 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the RequestApproval function of the WebSocket Approval Endpoint in execapproval.go. An attacker can gain unauthorized access to resources or perform actions with insufficient authorization by sending crafted...

6.5CVSS6.4AI score0.00282EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 3:52 p.m.11 views

Incorrect Authorization

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Incorrect Authorization via the rewritePrefix param. An attacker can access restricted upstream paths by sending requests with URL-encoded characters in the prefix, bypassing...

10CVSS5.4AI score0.00269EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 3:52 p.m.7 views

Use of Incorrectly-Resolved Name or Reference

Overview Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the extractBin function in the file internal/tools/execapproval.go. An attacker can cause incorrect name resolution by manipulating input to this function, potentially leading to...

6.5CVSS6.4AI score0.00228EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 3:50 p.m.7 views

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the isSafeBin function in the internal/tools/execapproval.go file. An attacker can gain unauthorized access to restricted functionality or data by exploiting insufficient authorization checks remotely...

6.5CVSS6.4AI score0.00209EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 3:50 p.m.7 views

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the matchesAllowlist process. An attacker can gain unauthorized access to restricted actions by manipulating authorization checks. Remediation There is no fixed version for...

4.8CVSS5AI score0.00197EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 3:50 p.m.6 views

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the isSafeBin function in the internal/tools/execapproval.go file. An attacker can gain unauthorized access to restricted functionality or data by exploiting insufficient authorization checks remotely...

6.5CVSS6.4AI score0.00209EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:46 p.m.12 views

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @fastify/reply-from is a forward your HTTP request to another server, for fastify Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the getUpstream function. An attacker can gain unauthorized access to or modify data across differen...

9.1CVSS5.3AI score0.00231EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.12 views

Malicious Package

Overview zlfr32573 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.11 views

Malicious Package

Overview zzpdfvar05 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.12 views

Malicious Package

Overview zwtenc3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.13 views

Malicious Package

Overview zrgview2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.9 views

Malicious Package

Overview zpx52534sg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.11 views

Malicious Package

Overview zrgvbif79e is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.12 views

Malicious Package

Overview zwkopt15 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.10 views

Malicious Package

Overview zwtestabc4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.11 views

Malicious Package

Overview zrgvhe14c is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.14 views

Malicious Package

Overview zwtd104 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.10 views

Malicious Package

Overview zjpage1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.12 views

Malicious Package

Overview zzlambtestf295 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.10 views

Malicious Package

Overview zztxtwtmp11 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.9 views

Malicious Package

Overview zzpdfvar03 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.12 views

Malicious Package

Overview zztest17785553774 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.9 views

Malicious Package

Overview zztxtwtmp09 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.10 views

Malicious Package

Overview zzlambcalx1778552149 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zzpdfvar06 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.11 views

Malicious Package

Overview zzwandsxabc119 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.8 views

Malicious Package

Overview zwkact2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.11 views

Malicious Package

Overview zztestno44 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.16 views

Malicious Package

Overview zzfadgivar01 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.14 views

Malicious Package

Overview zwknum4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/07/18 1:58 a.m.12 views

Malicious Package

Overview zwkopt4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

9.8CVSS5.4AI score
SaveExploits0References2
Total number of security vulnerabilities42436