Lucene search
+L

37332 matches found

Snyk
Snyk
added 2026/06/15 4:39 p.m.11 views

Server-side Request Forgery (SSRF)

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via a parser differential between the strict WHATWG URL parser used for allowlist validation and the lenient Domino URL parse...

8.8CVSS6AI score0.00193EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/15 4:34 p.m.8 views

Asymmetric Resource Consumption (Amplification)

Overview org.webjars.npm:ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification when handling a large number of very small fragments and data chunks. An attacker can cause excessive...

8.7CVSS5.9AI score0.00782EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/15 4:34 p.m.11 views

Asymmetric Resource Consumption (Amplification)

Overview ws is a simple to use websocket client, server and console for node.js. Affected versions of this package are vulnerable to Asymmetric Resource Consumption Amplification when handling a large number of very small fragments and data chunks. An attacker can cause excessive memory allocatio...

8.7CVSS5.9AI score0.00782EPSS
SaveExploits1References3
Snyk
Snyk
added 2026/06/15 3:32 p.m.7 views

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via deeply nested field names in multipart form data. An attacker can exhaust CPU and memory resources by sending a single HTTP request with a crafted multipart body containing excessively nested field names...

8.7CVSS5.3AI score0.00278EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 3:32 p.m.10 views

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion via deeply nested field names in multipart form data. An attacker can exhaust CPU and memory resources by sending a single HTTP request with a crafted multipart body containing excessively nested field names...

8.7CVSS5.3AI score0.00278EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 3:16 p.m.9 views

Modification of Assumed-Immutable Data

Overview @angular/core is a package that lets you write client-side web applications as if you had a smarter browser. It also lets you use HTML as your template language and lets you extend HTML’s syntax to express your application’s components clearly and succinctly. Affected versions of this...

8.6CVSS6.1AI score0.00179EPSS
SaveExploits0References3
Snyk
Snyk
added 2026/06/15 5:15 a.m.9 views

Malicious Package

Overview um4r719-baileys is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

9.8CVSS5.4AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 4:10 a.m.11 views

Prototype Pollution

Overview org.webjars.npm:jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Prototype Pollution via several functions, including createFrame and bind. An attacker can modify object prototype attributes directly. In an additional vector, the...

6.9CVSS6.4AI score0.00314EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 4:10 a.m.10 views

Prototype Pollution

Overview jsonata is a JSON query and transformation language Affected versions of this package are vulnerable to Prototype Pollution via several functions, including createFrame and bind. An attacker can modify object prototype attributes directly. In an additional vector, the attacker can pollut...

6.9CVSS6.4AI score0.00314EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 3:45 a.m.4 views

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds via the countinstr argument in dukapibytecode.c. An attacker can cause memory corruption and potentially impact system availability or integrity by manipulating this argument during local access. Remediation There is no...

5.3CVSS6AI score0.00112EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 3:13 a.m.5 views

Authorization Bypass Through User-Controlled Key

Overview shopxo/shopxo is an e-commerce system. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the OrderClose, OrderSuccess, PayLogOrderClose, or GoodsGiveIntegral functions in the Scheduled Task Endpoint. An attacker can gain unauthorized...

7.5CVSS5.8AI score0.00292EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/15 1:9 a.m.8 views

Directory Traversal

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Directory Traversal via the userfilespath function of the API endpoint /apinosession/thumbnailimg when processing the cachepathrelative argument. An attacker can access o...

7.5CVSS6.5AI score0.00525EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/14 3:49 a.m.8 views

Insertion of Sensitive Information Into Sent Data

Overview ironic is an OpenStack Bare Metal Provisioning Affected versions of this package are vulnerable to Insertion of Sensitive Information Into Sent Data via the PATCH process on volume properties. An attacker can obtain sensitive information by sending a PATCH request to update volume...

6.9CVSS5.8AI score0.00291EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.11 views

Malicious Package

Overview @apiwizards/company-auth-sdk is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.10 views

Malicious Package

Overview xnder-sdk-js is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagious...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.8 views

Malicious Package

Overview bubblesearch is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagious...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.9 views

Malicious Package

Overview bubblestring is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagious...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.10 views

Malicious Package

Overview @sql-trigger/nodesql is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagio...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.11 views

Malicious Package

Overview @sqlite-node/createsql is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.5 views

Malicious Package

Overview subsearch is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagious Intervie...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.6 views

Malicious Package

Overview @array-util/subsearch is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.9 views

Malicious Package

Overview @antoncarlos1/nodelamp is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.9 views

Malicious Package

Overview @array-util/nodepull is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagio...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.7 views

Malicious Package

Overview express-initial is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagious...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.14 views

Malicious Package

Overview bootstrap-utils is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagious...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.8 views

Malicious Package

Overview @node-cloud/create is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the "Contagious...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.11 views

Malicious Package

Overview @apiwizards/api-client is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 9:0 p.m.11 views

Malicious Package

Overview @apiwizards/auth-middleware is a malicious package. that installs "socket io" as a remote access trojan RAT, then fetch a second-stage payload 0001.dat from the same command-and-control C2 server and execute it. The C2 is linked to FAMOUS CHOLLIMA, a North Korean DPRK group behind the...

9.8CVSS6AI score
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 5:13 p.m.6 views

UNIX Symbolic Link (Symlink) Following

Overview Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in setupPtmx and setupDevSymlinks, which enable file deletion via calls to os.Remove and os.Symlink. An attacker who supplies a container image whose /dev is a symlink can redirect these operations...

4.8CVSS5.5AI score0.00222EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 5:13 p.m.6 views

UNIX Symbolic Link (Symlink) Following

Overview github.com/opencontainers/runc/libcontainer is a package for a modern container runtime. Affected versions of this package are vulnerable to UNIX Symbolic Link Symlink Following in setupPtmx and setupDevSymlinks, which enable file deletion via calls to os.Remove and os.Symlink. An attack...

4.8CVSS5.5AI score0.00222EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 10:6 a.m.6 views

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the handling of the Origin header on incoming connections. An attacker can bypass access restrictions by exploiting DNS rebinding techniques, potentially gaining unauthorized access to server resources...

9.6CVSS6AI score0.00153EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 10:6 a.m.7 views

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the handling of the Origin header on incoming connections. An attacker can bypass access restrictions by exploiting DNS rebinding techniques, potentially gaining unauthorized access to server resources...

9.6CVSS6AI score0.00153EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 6:7 a.m.5 views

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in jsonnetfetcher.go‎ that may expose the Kubernetes service account token of the Grafana Operator manager to users with sufficient privileges to create Dashboard or LibraryPanel resources. This token can be used to...

8.8CVSS5.8AI score0.00361EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/13 6:7 a.m.4 views

Credential Exposure

Overview Affected versions of this package are vulnerable to Credential Exposure in jsonnetfetcher.go‎ that may expose the Kubernetes service account token of the Grafana Operator manager to users with sufficient privileges to create Dashboard or LibraryPanel resources. This token can be used to...

8.8CVSS5.8AI score0.00361EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:9 p.m.7 views

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the trusted-proxy Control UI WebSocket process. An attacker can gain unauthorized administrative privileges by connecting as an unpaired or restricted client and...

8.8CVSS5.9AI score0.00289EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:9 p.m.15 views

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the shell wrapper argv. An attacker can execute unauthorized commands by modifying command arguments after allowlist approval but befor...

8.8CVSS5.5AI score0.00982EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:9 p.m.15 views

Missing Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Missing Authorization via the bundle MCP loopback session-spawn path. An attacker can gain unauthorized access to restricted commands by bypassing intended command restrictions through...

6.9CVSS5.4AI score0.00094EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:9 p.m.13 views

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Time-of-check Time-of-use TOCTOU Race Condition via the system.run safe-bin allowlist validation. An attacker can access arbitrary files and expose sensitive configuration data by injecti...

8.3CVSS5.5AI score0.00191EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:9 p.m.7 views

Directory Traversal

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Directory Traversal via the memory-wiki ingest process when an authenticated user with operator.write scope specifies arbitrary local file paths. An attacker can access sensitive local...

7.1CVSS6.5AI score0.00375EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:9 p.m.12 views

Server-side Request Forgery (SSRF)

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the message.action forwarding. An attacker can obtain sensitive credentials by supplying malicious loopback URLs through model-controlled action...

6.5CVSS5.3AI score0.00254EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:9 p.m.14 views

User Interface (UI) Misrepresentation of Critical Information

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Interface UI Misrepresentation of Critical Information via the approval display truncation. An attacker can execute unauthorized operations by submitting oversized exec commands with...

8.5CVSS5.5AI score0.00232EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.11 views

Insufficient Session Expiration

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Session Expiration via the secret revocation webhook. An attacker can maintain access using previously valid webhook secrets by sending webhook events during the period after...

6.5CVSS5.3AI score0.00207EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.8 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization via the native command handling process. An attacker can gain unauthorized access to privileged operations by sending crafted commands that bypass the configured...

8.8CVSS5.9AI score0.00267EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.8 views

User Impersonation

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Impersonation via improper validation of identity headers in the trusted-proxy configuration. An attacker can impersonate privileged users by supplying forged identity headers to the...

7.7CVSS5.9AI score0.00102EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.14 views

User Impersonation

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to User Impersonation in the allowFrom feature that relies on mutable Slack display names. An attacker can gain unauthorized access to agent privileges by modifying their Slack display name ...

8.6CVSS5.4AI score0.00209EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.8 views

Insufficient Session Expiration

Overview @openclaw/mattermost is an OpenClaw Mattermost channel plugin Affected versions of this package are vulnerable to Insufficient Session Expiration due to a delay in the monitor refresh process. An attacker can continue to execute unauthorized commands by exploiting the acceptance of revok...

6.5CVSS6AI score0.00181EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.8 views

Insufficient Session Expiration

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Insufficient Session Expiration due to a delay in the monitor refresh process. An attacker can continue to execute unauthorized commands by exploiting the acceptance of revoked slash toke...

6.5CVSS6AI score0.00181EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.8 views

Exposure of Resource to Wrong Sphere

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Exposure of Resource to Wrong Sphere in the sandboxed session spawning process. An attacker can access sensitive workspace path information by initiating child sessions from sandboxed...

4.3CVSS5.9AI score0.00187EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.7 views

Incorrect Authorization

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incorrect Authorization in the dynamic-agent binding process. An attacker can modify binding states without proper authorization by sending crafted requests as an authenticated user...

4.3CVSS5.9AI score0.00166EPSS
SaveExploits0References2
Snyk
Snyk
added 2026/06/12 11:8 p.m.8 views

Incomplete Comparison with Missing Factors

Overview openclaw is a 🦞 OpenClaw — Personal AI Assistant Affected versions of this package are vulnerable to Incomplete Comparison with Missing Factors via the retry endpoint validation process. An attacker can intercept authentication material by crafting a hostname prefix that resembles a...

6.5CVSS5.9AI score0.00265EPSS
SaveExploits0References2
Total number of security vulnerabilities37332